# Tag Info

7

The general scheme is called Three-pass protocol and works for all commutative ciphers. It is secure for some of them, but xor (and modular addition) are insecure choices. Your scheme: A->B: $c_1 = m \oplus a$ B->A: $c_2 = c_1 \oplus b$ A->B: $c_3 = c_2 \oplus a$ B computes $m = c_3 \oplus b$ an attacker sees all of $c_1$, $c_2$ and $c_3$. So they can ...

4

In practical cryptography, you do not use state-of-the-art, the newest and shiniest algorithms, but instead something required or recommended by the appropriate standards. In PCI, AES, Triple-DES, SHA-1, RSA etc. are fairly common. PCI is bit slow to adopt new cryptographic standards. This is for part that payment industry uses devices (like cards) with ...

4

Given: The attacker can call PRP() and the inverse function prp() on any message of his choosing. PRP is a pseudorandom permutation indistinguishable to the attacker from a random permutation. Assuming R and K are "sufficiently large", perfectly random, and never leaked to the attacker -- in particular, during a chosen-ciphertext attack, the decryptor only ...

4

Yes. Assume that the attacker knows the ciphertext $c = c_1 \mathbin\| c_2$, the initialization vector $v$ and the plaintext $m = m_1 \mathbin\| m_2$. This tells them that $D_k(c_1) = m_1 \oplus v$ and $D_k(c_2) = m_2 \oplus c_1$, where $D_k(\cdot)$ denotes block cipher decryption under the (unknown) key $k$. In particular, this implies that, if the ...

4

You first need to consider your adversary and what are your goals for this mechanism. This kind of mechanism appears less effective than proper cryptographic means: having secure PRNG means that both ends of the message exchange have access to some proper cryptographic means Adding noise means that the information exchange is less efficient: there is much ...

3

You are correct in that knowing $\phi(n)$ it is trivial to get the private key back with a simple modular inversion. However, we are only given $e$ and $n$, and it turns out that computing $\phi(n)$ from $n$ alone is computationally equivalent to finding the factors of $n$. Namely, if you know $\phi(n) = (p-1)(q-1) = (p-1)(n/p - 1)$, you can recover $p$ by ...

3

Are you asking "given $e$ and $\phi(n)$, how do we find $d$ such that $de \equiv 1 \bmod \phi(n)$"? (which can also be written as $d = e^{-1} \bmod \phi(n)$ The standard way of find such a value is the Extended Euclidean Method; this is a relatively efficient method that results in $d$ given $e$ and $\phi(n)$ as inputs (assuming, of course, that $e$ and ...

3

Short Answer: NO, it is not safe, do NOT do this. Longer Answer: You are true that you can use your RSA keypair for both operations. This approach is used in many applications and scenarios. There are Web Services or Single Sign-On implementations, which enforce you to use the same key pair for both operations. X.509 certificates do not allow you (by ...

3

The scheme is secure against chosen-plaintext attacks up to $2^{|R|/2}$ queries. Indeed, given this number of queries, it is likely that every encryption call yields a new value $R$, which has never used as part of the permutation input. However, when this bound is reached, some problems occur. Suppose you encrypt the same message $M$ as many as ...

3

The banking and financial communities, in particular, are very conservative. For example, 3DES has long been the standard for PIN encryption, and replaced DES when DES became too long in the tooth. It may be slower than AES, but is venerable and trusted. IBM z-series mainframes have long supported hardware encryption. Their latest in processor ...

2

Actually, every encryption algorithm has an associated message space which defines the maximum message size which can be encrypted and the ciphertext is always of size of the associated ciphertext space. If the message at hand is larger than the message space of the encryption algorithm, you have to encrypt the message "block by block" (where a block can ...

2

Ok, I sum it up. In ECIES, which is a hybrid encryption scheme, the ciphertext size is one point of the curve + the size of the encrypted message (size of the message + small overhead of padding for the symmetric cipher) + the tag length of the used MAC. As CodesInChaos pointed out, if you work on a 256 bit curve (giving 128 bit security), then using point ...

2

The part of this answer that talks about key storage is at the end, the first part is about implementing a cascade. There are 2 main methods for cascading block ciphers, inside of the mode and outside of the mode. Within the encryption you have your mode of operation, and you have your block cipher cascade. The first cipher in the cascade will be considered ...

2

Decoding AES256-CTS-HMAC-SHA1-96 AES256 = AES using 256-bit key CTS = ciphertext stealing HMAC-SHA1-96 = HMAC using SHA-1 hash function with mac truncated to 96 bits. The benefits of HMAC truncation are discussed in FIPS PUB 198-1, chapter 5. For HMAC-SHA1 96 bits is very common truncation, used for instance by IPsec/ESP. For figuring out what key ...

2

No. You cannot use the same key and IV for more than one vector (with the most AES modes of operation). The only AES mode of operation which is (somewhat) resistant for IV reuse is SIV. For usual modes of operation like CBC, CTR, GCM, etc. reuse of Key+IV pair is a bad mistake. It is important to acknowledge that there are further requirements for ...

2

Speaking in broad strokes, reuse of the key is fine - reuse of the IV: not fine. From wikipedia: "Properties of an IV depend on the cryptographic scheme used. A basic requirement is uniqueness, which means that no IV may be reused under the same key". You also need to decide on a mode of operation, as different modes will dictate different requirements for ...

2

With SSS you are sharing field elements, so if the secret to be shared is larger than one field element, you are going to have to break up the secret somehow and share the parts. I am not aware of any standard method that allows you to make the sharings dependent on one another. Probably the best way is to encrypt the secret with a key and then share the key ...

1

When we transmit information across an insecure channel, we wish for our data to be secure. So, what does this mean? To discuss these we'll use the standard cryptographic situation of Alice and Bob. Alice wants to send something (the plaintext) across an insecure channel (what this means will be discussed) to Bob. This channel will be listened to by Eve ...

1

The main misconception here is, what part of the RSA problem is actually hard to compute. Your statement is like this: We have $e$ and $n$. We know $ed=1$ mod $\phi(n)$. So we should be able to calculate $d$. Your reasoning is exactly what is happening in the key generation algorithm. Division in modular arithmetic behaves just the same as with ...

1

If you use the raw RSA operation ($M^d \bmod n$ or $M^e \bmod n$), then no, it is unsafe to use the same key, because an attacker could trick the private key holder into signing a message $M$ (i.e. generating $M^d$) which is actually an encrypted message ($M = P^e$), thus allowing the attacker to recover the original plaintext ($(P^e)^d = P$). (The dual ...

1

In general, you cannot encode information such that "any variance at all in the inputs causes the decoded secret to be completely useless." That's because there's a generic attack that can be used to reconstruct the secret with a high probability, given almost enough enough information to uniquely determine it, as long as the correct secret can somehow be ...

1

To calculate the KCV for AES, you take the first three bytes of the encryption of zero under your key. Indeed, the case you've given is precisely this - the zero vector encrypted under the key 48C3B4286FF421A4A328E68AD9E542A4 is 77dc841daeb43315fed9acdf2f965f45, which restricts to 77dc84. In your question you say you already have AES-128 encryption, at ...

1

$V_{1}$ and $V_{2}$ should never be equal when using correct implementation of cbc by using the same input $(a,b,c)$. See following construction scheme: Even though you have two distinct encryption processes, namely one for $V_{1}$and another for $V_{2}$, the correct implementation of CBC uses an initialization Vector IV which has to be random. By xoring ...

1

For AES-128, the block cipher works on 128 bits at a time. Whichever block cipher mode you use (ECB, CBC, CTR, etc.), the encrypting will always be done on 128-bit blocks. The assumption is also made that padding is being used. Let's assume that $m = (a||b||c)$ and that $m' = (c||a||b)$. That gives us two separate messages, each 900 bits. Using ...

1

I'm going to assume that the comma $,$ operator used in your question means 'concatenate' (normally written $a||b||c$). Moreover, I'm assuming that $a,b,c$ are distinct. In that case, With incredibly high probability, No: $V_1$ and $V_2$ will not be equal. Think of it this way: if they were equal, then what would $D_k(V_1)$ be? Supposing $V_1=V_2$, we ...

1

Some devices I've been working with do indeed update biometric information. The reasons is that there may be additional information: acceptable fingerprint was scanned (required features are found), but the scan shows some area of finger not involved in previous scans. some other additional information helping make more exact scans in the future

1

Are you trying to prove this for a specific encryption scheme or for any scheme? If you have a specific scheme in mind, you can consider using rejection sampling. In your case, it would be quite straightforward to use : Let's say each key $k\in \{0,1\}^n$ is output by $Gen$ with a probability $p(k)$, and $p_{min} \overset{def}{=} \min\limits_{k} p(k)$. You ...

1

"Now, who promises that $|Enc(m)|$ depends on $|m|$?" $\:$ the protocol designers "Isn't it possible that $|Enc(m_0)| = |Enc(m_1)|$?" It is perfectly possible that $\:\:\big|\hspace{-0.03 in}\operatorname{Enc}(m_{\hspace{.02 in}0})\big| \:=\: \big|\hspace{-0.03 in}\operatorname{Enc}(m_1)\big|\;\;$. I will use $k$ to denote the security parameter. $1$ ...

1

I'm not quite sure if I understand you correctly. As far as I understand it, you want to produce a threshold signature on the hash value of an X.509 certificate. It is not sure if you require a distribute key generation of the private key, or you are in possession of the signing key and distribute shares of the key to all stakeholders. 1) Actually, in ...

1

It looks like what you are describing is comparable to IGE (Infinite Garble Extension) and especially biIGE mode of encryption. So I guess my question and the answer on my question here is of relevance.

Only top voted, non community-wiki answers of a minimum length are eligible