Hot answers tagged

8

You are correct: The 'workhorses' or primitives of cryptography, hash functions and block ciphers, can be used in such a way that they accomplish each others tasks: A hash function can be used to generate a key stream just as a stream cipher or block cipher in CTR mode (see e.g. Salsa20). And a block cipher can be transformed into a hash function (e.g. a ...


7

As SEJPM notes in the comments, the IVs will repeat after $2^{32}$ frames. This is bad (unless the key is changed more often than that). In particular, if you can temporarily capture the device and make it encrypt $2^{32}$ known messages of sufficient length, you will learn the keystreams corresponding to all the $2^{32}$ possible IVs for that device. ...


7

In addition to the other answer Using asymmetric cryptography in the meters would have some benefits: it can make passive eavesdropping of meter/server communication useless, even to a party holding or able to use the server's private key; something not achieved with secret-key cryptography. it can ensure that any central key leak can not compromise the ...


7

What exactly does $0...0$ and $1...1$ mean usually? This simply means a (more or less) long string of $0$s or $1$s or more clearly $000000...000000$ and $111111...111111$. Related notiational notes, you may have to use soon: Sometimes the notation $0^n$ and $1^n$ is also used for these strings with exactly $n$ zeroes and ones. Even more generally ...


5

So my question is, if they are the ones who encrypt this, then why can't they also decrypt it? Because it’s not them encrypting your message, it’s the App on your device… which is why it’s called End-To-End encryption. According to the security whitepaper (PDF), WhatsApp uses the Noise Protocol Framework which is based on the Signal protocol (formerly ...


5

If you choose $p$ and $q$ at random of the same length, then they will be far away from each other with extraordinarily high probability. Thus, this is not an issue. In the past, there were those that recommend safe primes to make sure that neither $p-1$ nor $q-1$ would have all small factors. However, this isn't necessary (and is now not even recommended). ...


5

The answer depends on the Enigma model, on the number of rotors among which the active rotors are chosen, on the number of wires used for the reflector, and on what one accounts for as part of a setting. The discrepancy between the two numbers around is because the position of the rotors (except the left one, which notch is inactive) can be accounted for - ...


5

Block ciphers are usually used in modes of operation. The security of a mode of operation depends on two things: the security of the underlying block cipher, and the security of the mode itself when you replace the block cipher with an "ideal" permutation. Say you're using a block cipher with block size $n$ bits, so with AES-256, $n = 128$ (the 256 refers ...


5

Block size does not directly affect the security of the cipher. However, if block size is too small, it can prevent you from using the cipher securely. The main effect of block size is due to the fact that a block cipher is meant to be a pseudorandom permutation (PRP). That means that any two inputs will have outputs that differ iff the inputs differ. So ...


4

No, it is not possible to semi-reliably "decrypt" an encrypted message by using the statistical distribution of symbols, if some modern encryption scheme is used, and its secret/private key does not leak. Modern encryption is practically immune to known distribution or other characteristic in the plaintext. The goal of modern encryption, that it reaches in ...


4

The quoted recommendation is generally considered obsolete in the context of RSA with secure parameters, and is either disregarded, or replaced by asking that $\left|p–q\right|>2^{(n/2)–100}$ where $n$ is the number of binary digits for $N=pq$. This modern rule was in ANSI X9.31 (1998), and is still in FIPS 186-4 (2013), appendix B.3, criteria ...


4

I hope to keep this as simple as I can. I'll begin with some terms: To establish any kind of SIP call, you first need to talk to the SIP server and well, initialize a session. The call itself happens over a media stream, which may or may not be encrypted and may or may not be proxied by the SIP server depending on what was negotiated and the presence or ...


3

Well, let's start from the beginning then. The string "Hi" is actually encoded as {0x48,0x69} (as per the ASCII table), so a string-number array conversion is as simple as a bunch of table look-ups. Now converting between hexadecimal and binary and back is easy. Just note that each hexadecimal character corresponds to exactly four bits in binary (because ...


3

It depends on the protocol. In general IND-CPA secure ciphers are assumed. That would mean that confidentiality is taken care of by the cipher. If integrity and/or authenticity are also required then it should be made explicit in the protocol. In that case it is however perfectly possible to use one key, e.g. by using an authenticated cipher such as GCM. ...


3

As SEJPM said in his comment: one proceeds by contrapositive, first suppose that such an adversary with an unfair advantage exists and use that adversary to break a well known assumption, e.g.: the adversary can be used to factorise a large composite integer (as defined in RSA). As of today, we have no efficient algorithm to factorise large composite ...


3

J.D.'s answer explains why you might want a block cipher in addition to a hash function. TL;DR: versatility. Stream ciphers, however, are not very versatile – at least synchronous stream ciphers are not. Yet they have not been replaced by hash functions. Why? Partly because they have been replaced by block ciphers instead (AES CTR, specifically), but also ...


3

Short version: the signature is correct, it is a real signature and therefore it is possible to verify it with one's favourite software. The scam is not based on a cryptographic attak but on what is signed. Craig Wright has recovered an old (and real) Satoshi's signature and tried to provide it as a new signature to validate his identity. It's, as someone ...


3

I don't have enough space to expand on yyyyyyy's answer in a comment so I am making this an answer in and of itself. TruthSerum is correct, but it seems like an explanation is wanted, so here goes. Imagine you have a regular (all the sides have the same length, all the angles are the same) n-gon. That sounds complex, but trust me it isn't. A 4-gon is ...


3

There are some works both theoretical and practical that they do solve your problem efficiently and in a secure way. By efficiently i mean the search efficiency is linear on the size of the searched substring. This is achieved by using auxiliary data structures known as suffix tree. Chase and Shen follow this approach, by encrypting the suffix tree with ...


3

I am afraid you are a little early: searchable encryption is quite a new field in cryptography, and I am not sure there exists any good implementation yet. However, answers to this question suggest cryptdb Also, I do not think the Rabin-Karp Algorithm is easily transposable to searchable encryption. I believe it has many optimisations, which could conflict ...


3

I want to make it harder to decrypt AES I send. Fundamentally, the thing you are trying to do is completely unnecessary. If AES does ever become broken, the scenarios in which this makes any measurable difference are exceedingly unlikely. If AES isn't broken, then doing this was wasted effort in the first place. There is zero plausible reason why your ...


3

If the central key database is hacked, does an attacker is able to decrypt the communication of any meter? To tamper it? Indeed, if the central key database is hacked, then an attacker will know all the secret keys and so will be able to decrypt all communications. Why not choosing an asymmetric public key mechanism instead, where the central ...


3

It depends. (Usual answer to this kind of questions. We would need more details about the data damage to answer) XTS encryption mode is short for XEX-based tweaked-codebook mode with ciphertext stealing, and XEX stands for Xor-encrypt-xor. Let's look how the XEX mode is defined: (image from wikipedia) XTS definition changes only how the last block is ...


2

I would not consider your case to be a cascading encryption. The reason why is the fact you need multiple interventions before getting access to your file. Here is what I would consider a cascading encryption (let's go crazy) : $$E(k_1,k_2,k_3,m) = \text{KEYAK}(k_1,\text{NORX}(k_2,\text{AES}(k_3,m)))$$ which you would decipher with : ...


2

If you ask about the protocol itself, as a theoretical construct, then it is safe. In theory it indeed provides all the feature that it promises. And now for the "but..." part. When you use a protocol to communicate, you are actually using one implementation of the protocol. The implementation tries to do exactly what the protocol says. However you can ...


2

I wanted to help break down exactly what you're seeing. If you take your base64 string: MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqGKukO1De7zhZj6+H0qtjTkVxwTCpvKe4eCZ0FPqri0cb2JZfXJ/DgYSF6vUpwmJG8wVQZKjeGcjDOL5UlsuusFncCzWBQ7RKNUSesmQRMSGkVb1/3j+skZ6UtW+5u09lHNsj6tQ51s1SPrCBkedbNf0Tp0GbMJDyR4e9T04ZZwIDAQAB You then decode it into hex: 30 81 9F 30 0D 06 ...


2

I haven't looked at watsapp specifically, this is a general answer on the practicalities of this. It's possible to have end to end encryption where the private key never leaves the client. If the provider doesn't have the private key then they can't decrypt the traffic. There are two problems though. Can alice and bob trust the client to do what it says ...


2

Scheme is not IND-CPA for any message longer than one block. I'll include a image of CBC mode below for reference (Source: Wikipedia). Suppose instead of block cipher encryption we have plaintext xor-ed with the key as you propose. You'll note that for message block 1, $M_1$, the ciphertext block $C_1 = M_1 \oplus IV \oplus Key$. Similarly $C_2 = M_2 ...


2

HMAC is a message authentication code (MAC). MACs produce "tags" that can can be used to prevent a message from being tampered with (sort of like a digital signature). There's no way to "decrypt" an HMAC tag to get back the original message, so it sounds like HMAC is not what you're looking for. I would suggest using AES-GCM instead, since it's designed to ...


2

Edit: My brain misfired and my original answer was based on an incorrect assumption. I blame this on a case of the Mondays. RSA-OAEP Recall that RSA-OAEP is defined as follows (with $m$ being the message to encrypt, $G$ and $H$ being random oracles and $(e, N)$ being a standard RSA public key): $Encode$: Select a random $k$-bit integer $r$. Pad out $m$ ...



Only top voted, non community-wiki answers of a minimum length are eligible