# Tag Info

16

So the article is fluff, the details can be found in the linked paper. The just of it is a refutation of the following assertion: if you have a set of symbols chosen with identical independent distributions and subject to some kind of coding, the result can be approximated as a uniform distribution. The paper asserts, with a few citations to some examples, ...

14

For a real-world example of precisely the same ECB weakness leading to a massive password compromise, see the Adobe password database leak, as memorably illustrated in the xkcd web comic: $\hspace{83px}$ While there were several issues contributing to the scale of the compromise, one of them was that Adobe, instead of properly hashing the passwords, ...

13

First, I'll assume we're talking about encrypting/decrypting exactly 128 bits of data, i.e. the block size of AES. Otherwise, you'll need to specify a mode of operation — and if your data's length isn't a multiple of the block size, well, that'll be more difficult to deal with. So, I'll assume we're working with a single block. (If you are using a mode ...

13

The main good reasons to change keys periodically are: to mitigate the risk of a key compromise; at least some ways keys get compromised are a one-time event, e.g. eavesdropping of the keyboard protecting the passphrase; changing the key thus restores security until the next leak, and only messages enciphered with the leaked key are compromised (and only ...

12

The crucial difference between plain encryption and authenticated encryption (AE) is that AE additionally provides authenticity, while plain encryption provides only confidentiality. Let's investigate in detail these two notions. In the further text, we assume $K$ to be a secret key, which is known to authorized parties, but unknown to attackers. Goals ...

12

It illustrates the point that the same plaintext going in to the cipher will result in the same ciphertext. It just happens to be a lot better example than showing someone abc387af de7231ab abc387af abc387af a129867e Now, what does this mean in the real world? If I gave you an email encrypted with AES-128 ECB, could you look at it and figure out the ...

11

Very short answer: No Quite Short answer: No, because a scheme can only be a One-Time-Pad if the entire pad is perfectly random and secret. Concise answer: It sounds like you're trying to build a stream cipher. The security of it really comes down to how much of the scheme you think can be kept secret. If I listen in to your wifi and hear you requesting a ...

11

@fgrieu has written a good answer but there's slightly more to be said on the topic. It is entirely possible that a paper will someday be published that shows a practical attack on 2048-bit RSA. Equally, a new attack could be discovered that breaks AES in a reasonable amount of time. Finally, someone might find a collision in SHA-256! This has happened ...

10

As the name suggests, CTR mode works by encrypting a counter (that gets incremented with each 16-byte block) to generate a stream of random bits. That bit stream is then XOR'ed with the plaintext to create the ciphertext. The IV provides the initial value for the counter. CTR mode is secure as long as the probability of a counter value repeating is ...

9

Re: "So why limit the export?" The laws you're talking about are generally part of the laws that control the export of weapons and of dual-use goods. Dual-use goods are things that can be used both for a military and for a civil purpose… cryptography is such a dual-use good. In fact, the classification as dual-use good is logic when you think about the ...

9

At the time of the competition (I can talk about it, I was there), there was a lot of discussion and various people showed arguments. However, there was never an official, publicly known "board of scores" with totals and definite rules, as the pictures you show seem to purport. It is possible that the NIST people did make something similar internally, but ...

9

First, your use of 'echo' gets you: ~ % echo 'Attack at dawn!!' | hexdump -C 00000000 41 74 74 61 63 6b 20 61 74 20 64 61 77 6e 21 21 |Attack at dawn!!| 00000010 0a |.| 00000011 Note that there are 17 bytes there, not 16. echo adds a newline character. To stop that, use the -n flag: ~ % echo -n 'Attack ...

9

Diffie Hellman Diffie Hellman is a key exchange protocol. It is an interactive protocol with the aim that two parties can compute a common secret which can then be used to derive a secret key typically used for some symmetric encryption scheme. I take the notation from the link above and this means we have a group $\mathbb{Z}_p^*$ for prime $p$ ...

9

XXTEA (also known as Corrected Block TEA) is a block cipher with $128$-bit key and block width parameterizable to $n\cdot32$ bits for $n\ge2$. It is an Unbalanced Feistel Cipher making $q=6+\lfloor52/n\rfloor$ passes over the block, with $q\cdot n$ rounds each modifying $32$ bits of the block. In Cryptanalysis of XXTEA, it is presented a chosen-plaintext ...

9

I try to provide a brief intro. ABE Attribute-based encryption (ABE) is a relatively recent approach that reconsiders the concept of public-key cryptography. In traditional public-key cryptography, a message is encrypted for a specific receiver using the receiver’s public-key. Identity-based cryptography and in particular identity-based encryption (IBE) ...

8

DES is a block cipher. It consists of a pair of algorithms, one for encryption and one for decryption. Each algorithm takes two inputs: the key, and the block to encrypt or decrypt; the output is the encrypted or decrypted block. For DES, the size of a block is 64 bits. So DES only tells you how to encrypt or decrypt data that consists of exactly 64 bits. ...

8

When talking about a circuit (FPGA, ASIC...) implementing some encryption algorithm, the relevant measures are: Bandwidth: how many input bytes can be processed per second. Latency: how much time occurs between the moment an input byte (or block) is injected, and the corresponding output byte (or block) is obtained. Circuit area, energy consumption... ...

8

Any protocol with long-term security becomes harder to break after the protocol execution has finished. In the Bounded-Storage Model, protocols become harder of break as [information about the randomizer that's not stored by the adversary] is lost. $\:$ (This point is similar to minar's observation.)

8

For a meet-in-the-middle attack with known plaintext, you break all $K_i$ at the same time. The goal is to split the work into multiple sides, trading off some exponential work for some exponential space and some linear work. Split the encryption and decryption sides evenly. You need $(2^8)^4 \times 2 = 2^{33}$ block cipher calls, because you need 4 layers ...

8

Security issues related to block size boil down to the following: a pseudorandom permutation is not a pseudorandom function, and the difference becomes visible when you query the function too many times. Imagine a function which accepts as inputs, and offers as outputs, elements from a set of size $N$. For instance, the inputs and outputs are blocks of $n$ ...

8

The general scheme is called Three-pass protocol and works for all commutative ciphers. It is secure for some of them, but xor (and modular addition) are insecure choices. Your scheme: A->B: $c_1 = m \oplus a$ B->A: $c_2 = c_1 \oplus b$ A->B: $c_3 = c_2 \oplus a$ B computes $m = c_3 \oplus b$ an attacker sees all of $c_1$, $c_2$ and $c_3$. So they can ...

8

When encrypting something with RSA, using PKCS#1 v1.5, the data that is to be encrypted is first padded, then the padded value is converted into an integer, and the RSA modular exponentiation (with the public exponent) is applied. Upon decryption, the modular exponentiation (with the private exponent) is applied, and then the padding is removed. The core of ...

8

This is the Shamir Three Pass protocol; it turns out the attacker can deduce some information about $m$; whether that information is meaningful depends on exactly what you are sensitive to. Exactly what information is leaked turns out to depend on the factorization of $p-1$ (assuming, of course, that $p$ is large enough to make solving the discete problem ...

8

Perceptual encryption is a term used to describe various encryption methods intended for audio, speech, image and video data. The idea is that one performs encryption for multimedia content in a way that only a certain amount of "perceptual information" is touched by the encryption. It may be considered as intentionally degrading the quality of the ...

7

If a popular encryption scheme is being used: No. The typical solution is that symmetric stream/block ciphers generate a constant stream of new pseudo-random bits which are merged/XOR'd with the plaintext to produce the ciphertext. The pseudo-random stream is seeded indirectly by the private key - so as long as the previous or future bits of the PRNG can ...

7

You first need to consider your adversary and what are your goals for this mechanism. This kind of mechanism appears less effective than proper cryptographic means: having secure PRNG means that both ends of the message exchange have access to some proper cryptographic means Adding noise means that the information exchange is less efficient: there is much ...

7

When $n$ is prime, solving for $e$-th roots modulo $n$ is easy, since it suffices to compute $d = e^{-1} \pmod {n-1}$ and then $s = m^d \pmod n$. If $n$ is not prime, but is instead a RSA modulus (a composite integer that is the product of two big primes), then the problem becomes apparently hard (in the sense that we don't have a clue how to do it ...

7

If you are using a modern, secure cipher, there is no reason whatsoever to perform such manipulations of the plaintext. I'm not sure how to elaborate much more on the topic than that. The entire purpose of a cipher is to perform the exact types of confusion and diffusion you describe. Only, the approach that it will use has been designed, peer-reviewed, and ...

7

The XXTEA cipher is badly broken. Even though the paper is not published at a conference, the author verified it on reduced versions of XXTEA. You should never ever use a cipher or a hash function, that has been broken in academic terms, in particular if you are not a cryptographer. Attacks always get better, and a cipher does not attract much attention ...

7

Yes. Modern cryptosystems are designed and analysed under the assumption that the key is never used for anything else. If you use your encryption keys for digital signatures, you are violating that assumption, and it is very easy to construct schemes where this violation will compromise security. It is possible to construct schemes that can use the same ...

Only top voted, non community-wiki answers of a minimum length are eligible