# Tag Info

1

The main misconception here is, what part of the RSA problem is actually hard to compute. Your statement is like this: We have $e$ and $n$. We know $ed=1$ mod $\phi(n)$. So we should be able to calculate $d$. Your reasoning is exactly what is happening in the key generation algorithm. Division in modular arithmetic behaves just the same as with ...

3

Are you asking "given $e$ and $\phi(n)$, how do we find $d$ such that $de \equiv 1 \bmod \phi(n)$"? (which can also be written as $d = e^{-1} \bmod \phi(n)$ The standard way of find such a value is the Extended Euclidean Method; this is a relatively efficient method that results in $d$ given $e$ and $\phi(n)$ as inputs (assuming, of course, that $e$ and ...

3

You are correct in that knowing $\phi(n)$ it is trivial to get the private key back with a simple modular inversion. However, we are only given $e$ and $n$, and it turns out that computing $\phi(n)$ from $n$ alone is computationally equivalent to finding the factors of $n$. Namely, if you know $\phi(n) = (p-1)(q-1) = (p-1)(n/p - 1)$, you can recover $p$ by ...

1

If you use the raw RSA operation ($M^d \bmod n$ or $M^e \bmod n$), then no, it is unsafe to use the same key, because an attacker could trick the private key holder into signing a message $M$ (i.e. generating $M^d$) which is actually an encrypted message ($M = P^e$), thus allowing the attacker to recover the original plaintext ($(P^e)^d = P$). (The dual ...

3

Short Answer: NO, it is not safe, do NOT do this. Longer Answer: You are true that you can use your RSA keypair for both operations. This approach is used in many applications and scenarios. There are Web Services or Single Sign-On implementations, which enforce you to use the same key pair for both operations. X.509 certificates do not allow you (by ...

0

A generic construction could be something like this: $\def\Enc{\operatorname{Enc}}$ Take a simple hash function $H$ and encryption function $\Enc_K$. Then define $E = (\Enc_K(H(A)), \Enc_K(A))$ as the encryption, $hashA(A) = H(A)$ and $hashE(x,y) = x$. Then we have $hashE(E) = \Enc_K(H(A))$, which of course is easy to check against $H(A)$, given $K$. Of ...

1

In general, you cannot encode information such that "any variance at all in the inputs causes the decoded secret to be completely useless." That's because there's a generic attack that can be used to reconstruct the secret with a high probability, given almost enough enough information to uniquely determine it, as long as the correct secret can somehow be ...

1

It looks like what you are describing is comparable to IGE (Infinite Garble Extension) and especially biIGE mode of encryption. So I guess my question and the answer on my question here is of relevance.

2

With SSS you are sharing field elements, so if the secret to be shared is larger than one field element, you are going to have to break up the secret somehow and share the parts. I am not aware of any standard method that allows you to make the sharings dependent on one another. Probably the best way is to encrypt the secret with a key and then share the key ...

1

You need to use different IV for every message you encrypt. Thus rather than the process: encrypt plaintext reverse the ciphertext continue encrypting (now from finish to start) You need to generate IV each time. I.e.: generate IV encrypt the plaintext using the IV store/send the ciphertext and the materials required to recreate IV The ...

3

The scheme is secure against chosen-plaintext attacks up to $2^{|R|/2}$ queries. Indeed, given this number of queries, it is likely that every encryption call yields a new value $R$, which has never used as part of the permutation input. However, when this bound is reached, some problems occur. Suppose you encrypt the same message $M$ as many as ...

0

If anyone needs it, C# code to calculate the KCV (you need only the first three bytes of the GetKcv return value): class Aes { private readonly byte[] _iv; private readonly int _secretLength; private readonly byte[] _secret; private readonly RijndaelManaged _cryptoEngine; public Aes() { _iv = new byte[] { 0, 0, 0, 0, 0, 0, ...

1

$V_{1}$ and $V_{2}$ should never be equal when using correct implementation of cbc by using the same input $(a,b,c)$. See following construction scheme: Even though you have two distinct encryption processes, namely one for $V_{1}$and another for $V_{2}$, the correct implementation of CBC uses an initialization Vector IV which has to be random. By xoring ...

1

For AES-128, the block cipher works on 128 bits at a time. Whichever block cipher mode you use (ECB, CBC, CTR, etc.), the encrypting will always be done on 128-bit blocks. The assumption is also made that padding is being used. Let's assume that $m = (a||b||c)$ and that $m' = (c||a||b)$. That gives us two separate messages, each 900 bits. Using ...

1

I'm going to assume that the comma $,$ operator used in your question means 'concatenate' (normally written $a||b||c$). Moreover, I'm assuming that $a,b,c$ are distinct. In that case, With incredibly high probability, No: $V_1$ and $V_2$ will not be equal. Think of it this way: if they were equal, then what would $D_k(V_1)$ be? Supposing $V_1=V_2$, we ...

1

Check out Chaffing and Winnowing and other Data Privacy stuff like k-anonymity etc from Data mining world http://en.wikipedia.org/wiki/Chaffing_and_winnowing

4

Given: The attacker can call PRP() and the inverse function prp() on any message of his choosing. PRP is a pseudorandom permutation indistinguishable to the attacker from a random permutation. Assuming R and K are "sufficiently large", perfectly random, and never leaked to the attacker -- in particular, during a chosen-ciphertext attack, the decryptor only ...

0

add noise to the cleartext to obfuscate the true text among a bunch of garbage .... I need an attacker to believe that the message is not encrypted So first of all, a small disclaimer. You realize that regular encryption standards would be much stronger and existing libraries are designed to handle data. On top of that it's generally not a good ...

4

You first need to consider your adversary and what are your goals for this mechanism. This kind of mechanism appears less effective than proper cryptographic means: having secure PRNG means that both ends of the message exchange have access to some proper cryptographic means Adding noise means that the information exchange is less efficient: there is much ...

1

To calculate the KCV for AES, you take the first three bytes of the encryption of zero under your key. Indeed, the case you've given is precisely this - the zero vector encrypted under the key 48C3B4286FF421A4A328E68AD9E542A4 is 77dc841daeb43315fed9acdf2f965f45, which restricts to 77dc84. In your question you say you already have AES-128 encryption, at ...

0

I think that it's more proper for your title to be named "Why hashing the shared value to get session key?" Next I'll answer your question in my understanding. The basic problem is to establish a shared key between Lecturer and undergraduate office securely. In the original Diffie-Hellman key-exchange protocol, Alice and Bob use the $g^{ab}$ as their ...

2

No. You cannot use the same key and IV for more than one vector (with the most AES modes of operation). The only AES mode of operation which is (somewhat) resistant for IV reuse is SIV. For usual modes of operation like CBC, CTR, GCM, etc. reuse of Key+IV pair is a bad mistake. It is important to acknowledge that there are further requirements for ...

2

Speaking in broad strokes, reuse of the key is fine - reuse of the IV: not fine. From wikipedia: "Properties of an IV depend on the cryptographic scheme used. A basic requirement is uniqueness, which means that no IV may be reused under the same key". You also need to decide on a mode of operation, as different modes will dictate different requirements for ...

4

Yes. Assume that the attacker knows the ciphertext $c = c_1 \mathbin\| c_2$, the initialization vector $v$ and the plaintext $m = m_1 \mathbin\| m_2$. This tells them that $D_k(c_1) = m_1 \oplus v$ and $D_k(c_2) = m_2 \oplus c_1$, where $D_k(\cdot)$ denotes block cipher decryption under the (unknown) key $k$. In particular, this implies that, if the ...

1

Are you trying to prove this for a specific encryption scheme or for any scheme? If you have a specific scheme in mind, you can consider using rejection sampling. In your case, it would be quite straightforward to use : Let's say each key $k\in \{0,1\}^n$ is output by $Gen$ with a probability $p(k)$, and $p_{min} \overset{def}{=} \min\limits_{k} p(k)$. You ...

0

Actually, the attack is on CBC mode (which IPSec uses). In the attack, it modifies the encrypted packets, and uses the IPSec decryptor as a decryption Oracle. How it works is based on how CBC-mode decryption works: Note that any particular plaintext block depends only on the corresponding ciphertext block, and the one immediately before it (and the ...

1

Some devices I've been working with do indeed update biometric information. The reasons is that there may be additional information: acceptable fingerprint was scanned (required features are found), but the scan shows some area of finger not involved in previous scans. some other additional information helping make more exact scans in the future

0

This depends on the degree of non-uniformity and the ability of $\Pi$ to produce uniform key-independent outputs. For instance, a deterministic encryption scheme that always selects $k=k_0$ is just a fixed permutation and can not be used to build a secure scheme without additional tools. However, if $\Pi$ produces a uniform $IV$, simply take it as a key and ...

0

Conversion and Proxy Functions for Symmetric Key Ciphers By Cook and Keromytis has conversion techniques that seems to be practical for achieving PRE .

3

The banking and financial communities, in particular, are very conservative. For example, 3DES has long been the standard for PIN encryption, and replaced DES when DES became too long in the tooth. It may be slower than AES, but is venerable and trusted. IBM z-series mainframes have long supported hardware encryption. Their latest in processor ...

2

Ok, I sum it up. In ECIES, which is a hybrid encryption scheme, the ciphertext size is one point of the curve + the size of the encrypted message (size of the message + small overhead of padding for the symmetric cipher) + the tag length of the used MAC. As CodesInChaos pointed out, if you work on a 256 bit curve (giving 128 bit security), then using point ...

4

In practical cryptography, you do not use state-of-the-art, the newest and shiniest algorithms, but instead something required or recommended by the appropriate standards. In PCI, AES, Triple-DES, SHA-1, RSA etc. are fairly common. PCI is bit slow to adopt new cryptographic standards. This is for part that payment industry uses devices (like cards) with ...

0

With this cipher, it's pretty easy to retrieve at least 1 key that is consistent with 2 pairs of plaintext,ciphertext . (Other ciphers are better or worse at making it nearly impossible to recover even 1 key consistent with the given plaintext,ciphertext). With this cipher, it is not possible to fully retrieve the key from only 2 known pairs of ...

0

There is a straightforward brute force method. Take for example the lowest 8 bits of everything and check for valid values of $K_1$ and $K_2$, mod $2^8$. You will need about $2^{16}$ checks to get the lower 8 bits of $K_1$ and $K_2$. Proceed then to values mod $2^{16}$, as you know the lower 8 bits of $K_1$ and $K_2$, only bits 8..15 of these must be ...

2

The part of this answer that talks about key storage is at the end, the first part is about implementing a cascade. There are 2 main methods for cascading block ciphers, inside of the mode and outside of the mode. Within the encryption you have your mode of operation, and you have your block cipher cascade. The first cipher in the cascade will be considered ...

7

The general scheme is called Three-pass protocol and works for all commutative ciphers. It is secure for some of them, but xor (and modular addition) are insecure choices. Your scheme: A->B: $c_1 = m \oplus a$ B->A: $c_2 = c_1 \oplus b$ A->B: $c_3 = c_2 \oplus a$ B computes $m = c_3 \oplus b$ an attacker sees all of $c_1$, $c_2$ and $c_3$. So they can ...

1

"Now, who promises that $|Enc(m)|$ depends on $|m|$?" $\:$ the protocol designers "Isn't it possible that $|Enc(m_0)| = |Enc(m_1)|$?" It is perfectly possible that $\:\:\big|\hspace{-0.03 in}\operatorname{Enc}(m_{\hspace{.02 in}0})\big| \:=\: \big|\hspace{-0.03 in}\operatorname{Enc}(m_1)\big|\;\;$. I will use $k$ to denote the security parameter. $1$ ...

2

Decoding AES256-CTS-HMAC-SHA1-96 AES256 = AES using 256-bit key CTS = ciphertext stealing HMAC-SHA1-96 = HMAC using SHA-1 hash function with mac truncated to 96 bits. The benefits of HMAC truncation are discussed in FIPS PUB 198-1, chapter 5. For HMAC-SHA1 96 bits is very common truncation, used for instance by IPsec/ESP. For figuring out what key ...

2

Actually, every encryption algorithm has an associated message space which defines the maximum message size which can be encrypted and the ciphertext is always of size of the associated ciphertext space. If the message at hand is larger than the message space of the encryption algorithm, you have to encrypt the message "block by block" (where a block can ...

0

If you're asking about block ciphers. Yes, it's possible. Security against non-adaptive attacks does not imply security against adaptive attacks. A simple example of a block cipher that is secure against non-adaptive attacks but insecure against adaptive attacks would be a random involution. No, it doesn't need to be nondeterministic. We say that a ...

1

I'm not quite sure if I understand you correctly. As far as I understand it, you want to produce a threshold signature on the hash value of an X.509 certificate. It is not sure if you require a distribute key generation of the private key, or you are in possession of the signing key and distribute shares of the key to all stakeholders. 1) Actually, in ...

Top 50 recent answers are included