New answers tagged

3

It depends. (Usual answer to this kind of questions. We would need more details about the data damage to answer) XTS encryption mode is short for XEX-based tweaked-codebook mode with ciphertext stealing, and XEX stands for Xor-encrypt-xor. Let's look how the XEX mode is defined: (image from wikipedia) XTS definition changes only how the last block is ...


7

What exactly does $0...0$ and $1...1$ mean usually? This simply means a (more or less) long string of $0$s or $1$s or more clearly $000000...000000$ and $111111...111111$. Related notiational notes, you may have to use soon: Sometimes the notation $0^n$ and $1^n$ is also used for these strings with exactly $n$ zeroes and ones. Even more generally ...


5

Block size does not directly affect the security of the cipher. However, if block size is too small, it can prevent you from using the cipher securely. The main effect of block size is due to the fact that a block cipher is meant to be a pseudorandom permutation (PRP). That means that any two inputs will have outputs that differ iff the inputs differ. So ...


5

Block ciphers are usually used in modes of operation. The security of a mode of operation depends on two things: the security of the underlying block cipher, and the security of the mode itself when you replace the block cipher with an "ideal" permutation. Say you're using a block cipher with block size $n$ bits, so with AES-256, $n = 128$ (the 256 refers ...


7

In addition to the other answer Using asymmetric cryptography in the meters would have some benefits: it can make passive eavesdropping of meter/server communication useless, even to a party holding or able to use the server's private key; something not achieved with secret-key cryptography. it can ensure that any central key leak can not compromise the ...


3

If the central key database is hacked, does an attacker is able to decrypt the communication of any meter? To tamper it? Indeed, if the central key database is hacked, then an attacker will know all the secret keys and so will be able to decrypt all communications. Why not choosing an asymmetric public key mechanism instead, where the central ...


5

The answer depends on the Enigma model, on the number of rotors among which the active rotors are chosen, on the number of wires used for the reflector, and on what one accounts for as part of a setting. The discrepancy between the two numbers around is because the position of the rotors (except the left one, which notch is inactive) can be accounted for - ...


0

What is your platform? PGP is a good tool for linux. Also, telegram and whatsapp already employ end-to-end encryption if that's what you're looking for.


3

I want to make it harder to decrypt AES I send. Fundamentally, the thing you are trying to do is completely unnecessary. If AES does ever become broken, the scenarios in which this makes any measurable difference are exceedingly unlikely. If AES isn't broken, then doing this was wasted effort in the first place. There is zero plausible reason why your ...


7

As SEJPM notes in the comments, the IVs will repeat after $2^{32}$ frames. This is bad (unless the key is changed more often than that). In particular, if you can temporarily capture the device and make it encrypt $2^{32}$ known messages of sufficient length, you will learn the keystreams corresponding to all the $2^{32}$ possible IVs for that device. ...


-1

If you mean perfectly secure, then YES OTP is indeed perfectly secure. But if you mean practically secure, then NO OTP is not practically secure. The reason is due to the fact that OTP requires usage of perfectly random numbers used as keys on both sides, however in practice using completely random keys is non-trivial, and usage of Pseudo Random Number ...


1

Is this secure? Yes, One-Time-Pads (OTPs) can be proven information theoretically secure. For a sketch of what this means and how to do this, please refer to this previous answer by me. Can I actually use modular addition as encryption like it said in Wikipedia? Yes, any group operation can be used to form a pefectly secret encryption scheme ...


0

DEK (data encryption key): The key that encrypts the actual content. The DEK gets changed less often than the KEK (see below). KEK (key encryption key): The key that encrypts the DEK. The KEK gets changed ("rotated") at regular intervals according to best practices and company security policies. As the volume of content grows, the more arduous it will be ...


1

The algorithm $E'(m)=E'(k,m)=E(0^n,m)$ is defined with a hard-coded key, thus the key is part of the algorithm definition of $E'$. Because of Kerckhoff's principle we generally assume the attacker to know our algorithm definition. Because of this, the attacker can just try decrypting the challenge ciphertexts of the eavesdropper security game himself (or ...


1

Your idea of addition modulo 10000 is correct. The correctness follows from the fact that $\mathbb{Z}_{10000} = \{0, 1, \dots, 9999\}$ equipped with addition modulo $10000$ forms a (finite) group. Let $m \in \mathbb{Z}_{10000}$ denotes a PIN code. Now choose a uniformly random element $r \in \mathbb{Z}_{10000}$ and define $c = m + r \bmod 10000$. It is ...


3

As SEJPM said in his comment: one proceeds by contrapositive, first suppose that such an adversary with an unfair advantage exists and use that adversary to break a well known assumption, e.g.: the adversary can be used to factorise a large composite integer (as defined in RSA). As of today, we have no efficient algorithm to factorise large composite ...


1

Basically there are two ways: decode the counter to be a big number in some kind of library, increase that number, then encode it back as unsigned, statically sized, big endian value, making sure you left pad with zero valued bytes when necessary; increase the value of the right-most byte (highest index) as unsigned number, if the resulting value is zero ...


3

Well, let's start from the beginning then. The string "Hi" is actually encoded as {0x48,0x69} (as per the ASCII table), so a string-number array conversion is as simple as a bunch of table look-ups. Now converting between hexadecimal and binary and back is easy. Just note that each hexadecimal character corresponds to exactly four bits in binary (because ...


2

Edit: My brain misfired and my original answer was based on an incorrect assumption. I blame this on a case of the Mondays. RSA-OAEP Recall that RSA-OAEP is defined as follows (with $m$ being the message to encrypt, $G$ and $H$ being random oracles and $(e, N)$ being a standard RSA public key): $Encode$: Select a random $k$-bit integer $r$. Pad out $m$ ...


3

It depends on the protocol. In general IND-CPA secure ciphers are assumed. That would mean that confidentiality is taken care of by the cipher. If integrity and/or authenticity are also required then it should be made explicit in the protocol. In that case it is however perfectly possible to use one key, e.g. by using an authenticated cipher such as GCM. ...


1

The main complexity of attacks using a quantum computer with Grover's attack is explained here. I'll use the remainder of the answer to indicate some possible misconceptions in your question. It's hard to say exact QC specs, but let's assume we have decent a quantum computer using Grover's algorithm that is able to half AES-128 keyspace to that of ...


4

I hope to keep this as simple as I can. I'll begin with some terms: To establish any kind of SIP call, you first need to talk to the SIP server and well, initialize a session. The call itself happens over a media stream, which may or may not be encrypted and may or may not be proxied by the SIP server depending on what was negotiated and the presence or ...


1

as far as I know, MAC's can vary depending on implementation and/or situation, like in SSL certs. So standartizing a MAC hardly can mess things up, so that's why they're not included


3

J.D.'s answer explains why you might want a block cipher in addition to a hash function. TL;DR: versatility. Stream ciphers, however, are not very versatile – at least synchronous stream ciphers are not. Yet they have not been replaced by hash functions. Why? Partly because they have been replaced by block ciphers instead (AES CTR, specifically), but also ...


8

You are correct: The 'workhorses' or primitives of cryptography, hash functions and block ciphers, can be used in such a way that they accomplish each others tasks: A hash function can be used to generate a key stream just as a stream cipher or block cipher in CTR mode (see e.g. Salsa20). And a block cipher can be transformed into a hash function (e.g. a ...


2

I wanted to help break down exactly what you're seeing. If you take your base64 string: MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqGKukO1De7zhZj6+H0qtjTkVxwTCpvKe4eCZ0FPqri0cb2JZfXJ/DgYSF6vUpwmJG8wVQZKjeGcjDOL5UlsuusFncCzWBQ7RKNUSesmQRMSGkVb1/3j+skZ6UtW+5u09lHNsj6tQ51s1SPrCBkedbNf0Tp0GbMJDyR4e9T04ZZwIDAQAB You then decode it into hex: 30 81 9F 30 0D 06 ...


2

HMAC is a message authentication code (MAC). MACs produce "tags" that can can be used to prevent a message from being tampered with (sort of like a digital signature). There's no way to "decrypt" an HMAC tag to get back the original message, so it sounds like HMAC is not what you're looking for. I would suggest using AES-GCM instead, since it's designed to ...


0

You can't. HMAC is one way. You will never get the plaintext back. Furthermore, if you do find a mathematical function to get your plaintext back from that output, you get a free PhD for publishing it.


4

The quoted recommendation is generally considered obsolete in the context of RSA with secure parameters, and is either disregarded, or replaced by asking that $\left|p–q\right|>2^{(n/2)–100}$ where $n$ is the number of binary digits for $N=pq$. This modern rule was in ANSI X9.31 (1998), and is still in FIPS 186-4 (2013), appendix B.3, criteria ...


5

If you choose $p$ and $q$ at random of the same length, then they will be far away from each other with extraordinarily high probability. Thus, this is not an issue. In the past, there were those that recommend safe primes to make sure that neither $p-1$ nor $q-1$ would have all small factors. However, this isn't necessary (and is now not even recommended). ...


3

Short version: the signature is correct, it is a real signature and therefore it is possible to verify it with one's favourite software. The scam is not based on a cryptographic attak but on what is signed. Craig Wright has recovered an old (and real) Satoshi's signature and tried to provide it as a new signature to validate his identity. It's, as someone ...


1

Functional encryption might fit your description; as far as I know it's still far from practical though.


0

No, it is not possible. The encryption step of CBC is $c_i = E(c_{i-1} \oplus p_i)$. When you double encrypt, the previous block ciphertext gets XORed with an independent block cipher output. The only place where something weird could happen is the beginning. If you assume that the (identical) IV $I$ is prepended to the ciphertext, as is common, you get ...


0

This illustrates the importance of getting the key order right with 3DES two-key keying option. With the correct order of $k_1$, $k_2$, $k_1$ you get something that should be impossible to attack with current resources, while with the incorrect order in the question it is feasible to attack. The outer two encryption layers can be joined into a single ...


3

I don't have enough space to expand on yyyyyyy's answer in a comment so I am making this an answer in and of itself. TruthSerum is correct, but it seems like an explanation is wanted, so here goes. Imagine you have a regular (all the sides have the same length, all the angles are the same) n-gon. That sounds complex, but trust me it isn't. A 4-gon is ...


5

So my question is, if they are the ones who encrypt this, then why can't they also decrypt it? Because it’s not them encrypting your message, it’s the App on your device… which is why it’s called End-To-End encryption. According to the security whitepaper (PDF), WhatsApp uses the Noise Protocol Framework which is based on the Signal protocol (formerly ...


2

Scheme is not IND-CPA for any message longer than one block. I'll include a image of CBC mode below for reference (Source: Wikipedia). Suppose instead of block cipher encryption we have plaintext xor-ed with the key as you propose. You'll note that for message block 1, $M_1$, the ciphertext block $C_1 = M_1 \oplus IV \oplus Key$. Similarly $C_2 = M_2 ...


2

I haven't looked at watsapp specifically, this is a general answer on the practicalities of this. It's possible to have end to end encryption where the private key never leaves the client. If the provider doesn't have the private key then they can't decrypt the traffic. There are two problems though. Can alice and bob trust the client to do what it says ...


1

The EFF Secure Messaging Score Card uses a checkmark system to rate different communications products. WhatsApp gets only 6 of 7 checkmarks. It gets an X in the "Is the code open to independent review?" category.


1

Since the client is not open source, you cannot verify their statement. That is, it could very well be encrypted but in a way that would allow either WhatsApp or another third party to break the security. To verify that it does encrypt data, you could use tools like WireShark to see whether text messages are sent in plain or encoded/encrypted. Bottom line: ...


1

In a sense, I don't think it matters. It's probably realistic for average users who aren't under direct investigation by a government for high-level drug-, terrorism-, or leak-related offenses. If you have reason to suspect you may fall under one of those categories, it's in your best interest not to trust that WhatsApp isn't capable or can't be compelled ...


2

If you ask about the protocol itself, as a theoretical construct, then it is safe. In theory it indeed provides all the feature that it promises. And now for the "but..." part. When you use a protocol to communicate, you are actually using one implementation of the protocol. The implementation tries to do exactly what the protocol says. However you can ...


2

I would not consider your case to be a cascading encryption. The reason why is the fact you need multiple interventions before getting access to your file. Here is what I would consider a cascading encryption (let's go crazy) : $$E(k_1,k_2,k_3,m) = \text{KEYAK}(k_1,\text{NORX}(k_2,\text{AES}(k_3,m)))$$ which you would decipher with : ...


0

You can try Playfair Cipher and find implementation here.


4

No, it is not possible to semi-reliably "decrypt" an encrypted message by using the statistical distribution of symbols, if some modern encryption scheme is used, and its secret/private key does not leak. Modern encryption is practically immune to known distribution or other characteristic in the plaintext. The goal of modern encryption, that it reaches in ...


3

There are some works both theoretical and practical that they do solve your problem efficiently and in a secure way. By efficiently i mean the search efficiency is linear on the size of the searched substring. This is achieved by using auxiliary data structures known as suffix tree. Chase and Shen follow this approach, by encrypting the suffix tree with ...


3

I am afraid you are a little early: searchable encryption is quite a new field in cryptography, and I am not sure there exists any good implementation yet. However, answers to this question suggest cryptdb Also, I do not think the Rabin-Karp Algorithm is easily transposable to searchable encryption. I believe it has many optimisations, which could conflict ...


-1

$$2360221=1117 \times 2113$$ $$\phi(2360221)=2356992$$ $$d\equiv e^{-1} \equiv 942797 \pmod{2356992}$$ $$C \equiv M^e \equiv 1637411 \pmod{2360221}$$



Top 50 recent answers are included