# Tag Info

68

There are two somewhat orthogonal concepts in backdooring encryption algorithms: The backdoor can be explicit or implicit. An explicit backdoor is one that everybody knows it is there. An implicit backdoor strives at remaining undetected by the algorithm owners. Of course, when there is an explicit backdoor, people tend to avoid the algorithm altogether, ...

41

No, because these new insights only affect the discovery and patterns regarding finding new prime numbers. In order to break existing encryption algorithms that rely on primes such as RSA, you'd have to have a breakthrough in discovering how to factor integers into primes. Primes are used in encryption keys as the basis of their generation: two large ...

34

The answer is in the source, file sshrsag.c, line 9: #define RSA_EXPONENT 37 /* we like this prime */ This value $e=37$ matches the conditions for a reasonable fixed RSA public exponent: $e$ is odd, $e$ is at least $3$, $e$ is reasonably small. The later condition is good for speed of operations involving the public key (encryption, ...

32

You are likely going to have both false positives and false negatives if you try to use Shannon entropy for this. Many compressed files would have close to 8 bits of entropy per byte, resulting in false positives. Any encrypted file that has some non-binary encoding (like a file containing an ASCII-armored PGP message, or just a low entropy header) could ...

28

You could be thinking about the Merkle-Hellman knapsack cryptosystem. It was invented in 1978 and everything seemed well and good until it was completely broken six years later in 1984 by Shamir - it was a complete and total break, i.e. the cryptosystem became unusable overnight. That said I don't know if the knapsack cryptosystem was ever "popular" in the ...

26

Yes, there are advantages to the attacker. Using a well vetted encryption algorithm provides a better assurance of security. There may be cryptographic algorithm flaws and/or coding mistakes. As noted, relying on the algorithm being private just adds a layer of false security.

25

First : Welcome to Crypto.SE. Even though you are quite young, it should not be a reason for someone to stop you : Alan Turing was 23 (still undergraduate) when he undermined the work of Alonzo Church (on untyped $\lambda$-Calculus). I'm not saying you should always provide your idea, but if you can defend them, have fun. About your cipher : The first ...

23

If the substitution ciphers belong to the same family, then their composition will also (typically, assuming that the family is closed under composition) belong to the same family. Thus, breaking the combined cipher will be no harder than breaking an arbitrary cipher in the family. For a simple example, combining two Caesar shift ciphers with shifts ...

18

This question has many problems in the way it was asked, and clearly did not come after doing some investigation. However, since this seems to be a misconception that is spreading widely, I will relate to it. It is not true that the "crypto community" (whoever that is) believes that the NSA can break RSA. In fact, if Snowden taught us anything, it is that ...

18

DES has not been mentioned in the previous two answers. Although it was known to be quite weak from very early on it was widely used for a couple of decades at least, until newer algorithms (3DES, AES, but also e.g. RC4) displaced it. Nowadays it can be broken in hours with dedicated hardware or with at most a few thousand dollars of cloud computing time. ...

17

This is a shot in the dark, but could you be thinking of the Needham-Schroeder protocol? It was published in 1978 [1], and an attack was published as much as 18 years later, in 1996 [2]. It is not an encryption method, though, but a protocol. In fact, the original paper does not even specify an encryption method to be used, but uses encryption symbolically. ...

15

If we want to compact an existing RSA private key expressed as $(N,e,d,p,q,d_p,d_q,q_\text{inv})$, we can reduce it to $(e,p,q)$ and easily recompute the rest as: \begin{align} N&=p\cdot q\\ d&=e^{-1}\bmod\operatorname{lcm}(p-1,q-1)\;\text{ or }\;d=e^{-1}\bmod((p-1)\cdot(q-1))\\ d_p&=d\bmod(p-1)\;\text{ or equivalently }\;d_p=e^{-1}\bmod(p-1)\\ ... 15 Both of your formulations for encryption backdoors are valid. However, a more efficient way and harder to detect method consist in biaising the random generators used to generate private and public keys (known example). The idea being, if you can predict the random generator output, therefore you can trivially generated the same private/public keys, and then ... 14 Both of the other answers tackle the question of encryption in a particular format, but I would argue that neither of them is necessarily a good fit for your use case. You want to be able to generate 20 character codes that a server will be able to verify. A symmetric MAC is sufficient for this use case, if you don't need the codes to contain any secret ... 14 Anye$such that$\gcd(e, (p-1)(q-1)) = 1$will do. There is no need for it to be in the set$\{3,17,65537\}$; these last numbers are chosen for speed of encryption, mostly (two set bits leads to faster computation of modular exponentation), and these numbers happen to be prime, so the condition is easily checked. One often encounters other$e$, but many ... 14 Your punctuation is slightly off: What's in a name? A rose by any other name would smell as sweet. It's a reference to Romeo and Juliet 13 Assuming that: the functions$F_k(s) = {\rm hash}(k + s)$form a pseudorandom function family (PRF) indexed by the key$k$, and each key is only used to encrypt one message, then this construction is provably1 secure against chosen-plaintext attacks. Being a PRF is not a standard property of a cryptographic hash function, so one cannot just assume that ... 13 There are a number of considerations here, I'll try to lay them out one at a time for ease of following: What must the site do with the data? Oftentimes, we ask web sites to do things on our behalf when we are not actually visiting them. For example, I may want crypto.SE to email me when there are responses to this post. The site could not do that ... 12 So I'm trying to find a method of encryption that not only obfuscates text, but also compresses the result. For example, if I encrypted ninechars, the ideal result would be less than nine characters. Even without encryption, it's not possible for a reversible data compression scheme to shorten all of its inputs. This can be easily proven using the ... 12 You can use a seed to start a PRNG. Then you can use that PRNG to generate the two (or more) primes required to generate the key pair. Now if you save that seed you can regenerate the key pair, which means you don't have the store the modulus, CRT components or private exponent. So yes, it is possible to reduce the size, but this approach does have ... 12 Honestly, I don't see any obvious reason why a novel cipher design couldn't be the subject of a bachelor's thesis. And presenting it as part of a thesis could even be a decent way to get others to look at it and maybe analyze it. Admittedly, a more conventional choice for a bachelor's thesis might be something like a basic cryptanalysis of an existing ... 11 It is usually assumed that the length of the message is not secret. Even with padding the approximate length is leaked, and necessarily any encryption reveals a maximum length – or at least information content if compression is used – because the ciphertext cannot in general be shorter than the message. NaCl's secretbox does not use a block cipher, but a ... 11 You've actually been trapped by the mindset that OTP will hide all information about the underlying plaintext. This is not true as you have observed. The definition of perfect secrecy, given in Introduction to Modern Cryptography by Katz-Lindell, reads like this: Definition 2.3 An encryption scheme$(\text{Gen, Enc, Dec})$with message space$\mathcal ...

11

If you combine two affine ciphers, you obtain one affine cipher. Say the first cipher is $e_1(x) = a_1x+b_1$ and the second is $e_2(x) = a_2x+b_2$. Then $e_1(e_2(x)) = a_1(a_2x+b_2)+b_1 = (a_1a_2)x+(a_1b_2+b_1)$. Note that if $a_1$ and $a_2$ are both relatively prime with the modulus, then so is $a_1a_2$, so the new cipher can also be deciphered.

11

The main advantage is that using a proprietary algorithm gives you access to trade secrets like additional cryptographic attacks that other algorithms fall to but to which the proprietary algorithm is resistant. Whether this is important depends on the amount of trust you have in the vendor. As other answers have noted, usually the staff of any one ...

11

Modern cryptographic algorithms are specified in terms of bytes or even bits, not characters. Whether the data you encrypt happens to represent latin or cyrillic letters or pictures or audio data or anything else does not matter at all to an encryption algorithm; all it ever sees is a bunch of bytes. What this means in practice is: You have to fix some ...

11

First of all, yes, the message digest is the hash of the message. Secondly, do not mix things up. You are talking about public key encryption and signature. Let's redefine them to make sure we have everything right. Alice and Bob got pairs of key ($A_{pub}$, $A_{priv}$), ($B_{pub}$, $B_{priv}$). Alice knows $B_{pub}$ and Bob knows $A_{pub}$. Alice wants ...

11

A quick search turns up a quote of Shakespeare from Romeo & Julia. It is often a good idea to simply search the internet, even for (smallish) hexadecimal values or values encoded as base 64. In general it can be expected that decryption has succeeded if the attacker gets English text without invalid words. Words are usually not encrypted separately, so ...

11

In general the AAD itself is not required or won't change the security of the GCM mode of operation itself. It may however directly influence the security of the protocol in which GCM is deployed. For instance, you may have specific configurable parameters outside the ciphertext itself. These parameters may very well include: version number of the ...

Only top voted, non community-wiki answers of a minimum length are eligible