New answers tagged

3

Wrapping up my comment as an answer: Imagine you’re a Japanese cryptanalyst in the year 1944. There is no such thing yet called “television”, and you’re still decades away from a wordwide network feeding you with all the knowledge you could wish for. In that case there’s only a minimal chance you’ve ever heard or seen a Navajo. So, you’ll be wondering ...


0

In order to provide message integrity, a hash or message authentication function (MAC) is used. Sometimes, encryption and integrity are used together as (i) encrypt-then-MAC: provides ciphertext integrity, but no plaintext integrity, (ii) MAC-then-encrypt: provides plaintext integrity, but no ciphertext integrity, and (iii) encrypt-and-MAC: provides ...


3

Using generic homomorphic encryption the answer for all three is essentially yes. Although 3. in general is probably mainly of theoretical interest as it would be impractically slow. For simply compressed data this is simple since compression should not do anything to hide the data. Just decompress, do the operation and possibly compress the result if ...


1

Remember that the initial value is split into two halves, and each half is shifted independently. If all the bits in each half are either 0 or 1, then the key used for any cycle of the algorithm is the same for all the cycles of the algorithm. This can occur if the key is entirely 1s, entirely 0s, or if one half of the key is entirely 1s or the other half is ...


4

Can AES work with Cyrillic letters? No, AES is a block cipher that can only operate on blocks of 16 bytes. AES may be securily used within a mode of operation to operate on plaintext of any bit/byte size. So you only have to encode your Cyrillic letters to any bit or byte encoding. Unicode - which designates code points to a huge range of characters - ...


11

Modern cryptographic algorithms are specified in terms of bytes or even bits, not characters. Whether the data you encrypt happens to represent latin or cyrillic letters or pictures or audio data or anything else does not matter at all to an encryption algorithm; all it ever sees is a bunch of bytes. What this means in practice is: You have to fix some ...


1

Modern cryptographic algorithms work on strings of bits, independently of how such strings are interpreted in any specific application.


1

This is - in a way - Functional Encryption. From Wikipedia: Functional encryption is a type of public-key encryption in which possessing a secret key allows one to learn a function of what the ciphertext is encrypting. So, YES, it is possible. For more information this paper might prove useful.


0

Solving for $D$ in this case is known as the discrete logarithm problem. This is a known hard problem, as there are no known algorithms to calculate it in polynomial time. In other words, as the size (i.e. the number of digits) of the numbers increase, the time it takes to calculate gets higher exponentially. For this reason, it's used in cryptography as a ...


2

what is the range for exponent e? Actually, there is no required upper bound for $e$ (except that some implementations may reject ridiculously large values). The math behind RSA states that any $e$ that is relatively prime to both $p-1$ and $q-1$ will work, no matter how large it is. There might not appear to be a need for an $e > lcm(p-1, q-1)$ (as ...


0

As explained on this page you have: $1 < e < \phi(n)$ so with the specific values you mentioned we have: $\phi(n) = \phi(p \times q) = \phi(p) \times \phi(q) = (p-1) \times (q-1) = 12 \times 16 = 192$ (see Euler's totient function definition) The threshold on the maximum integer you can encrypt is $n-1$ which is $76$ if $p=7$ and $q=11$. Note that if ...


0

I suppose your question is related to RSA cryptosystem. To put it in a nutshell: yes we can possibly calculate $a$, but we can make this harder by fixing some properties on $n$ and $e$. That's what is done in RSA cryptosystem which is well-known: you can find a lot of documentation about it on the internet. But to go into further details, to calculate $a$ ...


0

It is closed related with the RSA problem, which is defined as follows by the Wikipedia: The RSA problem is to efficiently compute $P$ given an RSA public key $(N, e)$ and a ciphertext $C \equiv P^e \pmod N$. [...] with N being a large semiprime, $2 < e < N$, and $e$ be coprime to $\phi(N)$ The only two differences are: You don't require $N$ to ...


0

It is conjectured to be hard to recover $a$ given only $b$, $e$, and $n$. This is called the RSA assumption. If an efficient factorization algorithm exists, this assumption is false. However, it is possible that the RSA assumption is false and there exists no efficient factorization algorithm. In other words, the hardness of factoring might not imply the ...


4

What you are looking for is a definition of PEM, privacy enhanced mail. Obviously PEM is not just used for mail anymore. The definition of the header lines seems to be best described by section 4.6: "Summary of Encapsulated Header Fields" of RFC 1421: "Privacy Enhancement for Internet Electronic Mail: Part I: Message Encryption and Authentication ...


5

Let's say the plaintext is English text (or some language that uses the basic latin characters), encoded in Unicode. That means each byte represents one character, and because of the quirks of Unicode, the basic latin characters and typical punctuation marks all have a zero for the most significant bit. To attack your scheme, an attacker would look for ...


1

Each block of n can be decrypted using frequency analysis, similar to how Caesar ciphers are broken. In the case that n is sufficiently small enough for frequency analysis to be difficult, it can be inferred that non-printable bytes will not show up. This is enough information to mount a very practical attack. This also has the same issue as the WWII enigma ...


3

I'm not sure I understand your question entirely. If there is only one possible message, then the ciphertext can be trivially decrypted simply by choosing this message. I'll assume instead that the ciphertext contains the shuffled bit pattern of a name chosen from a set of more than one name. The problem with bit shuffling is that the number of set bits ...


1

As fgrieu hints at in the comments, it is not in general possible to find $\operatorname{Enc}$. Otherwise you would be able to break an arbitrary block cipher, because the key of any block cipher can be cast as part of the algorithm instead. Even if you ignore the computational cost, there is no way to find $\operatorname{Enc}$ given values for only one ...


3

That doesn't hide Bob's identity from eavesdroppers. (The OP mentioned in chat that the OP isn't trying to do that.) I can no longer spot any other problems with the key exchange part. The encryption/decryption of application level data is vulnerable to arbitrary replays and reflection and dropping. ​ The public MAC input should indicate direction and ...


0

For Feistel ciphers such as DES, encryption and decryption are performed using the same algorithm – decryption simply uses the round keys in the reverse order as encryption. If a hash function was substituted for the round function of a Feistel cipher, then there would be no round keys and encryption and decryption would use the same algorithm – the ...


0

Although I'm certainly not going to recommend using it, one well known way to do this is to hash the previous ciphertext block concatenated with the key, then XOR the result with the current plaintext block. In this case, the block size is equal to the length of one output from the hash function. In effect, is uses the hash about like a block cipher in CFB ...


2

There are many block-cipher modes. CBC for example works only on full blocks of plaintext and produces ciphertext as a multiple of the block size, it is therefore not applicable to your case. CTR transforms a block-cipher into a stream-cipher, which produces a ciphertext that has the same length as the plaintext. This mode requires the use of a nonce as ...


0

So lets assume a few things: just symmetric primitives suffice; a symmetric key derivation function and single block encrypt with a 64 bit block cipher is sufficiently fast; the ID's are unique and not related to customers; we're not afraid of customers sharing ID's; there is protection against customers simply guessing ID's; Scheme: establish a master ...


2

Which techniques can I use? You can use a system like the ones used for the encryption of credit card numbers: AES (for a good grade of encryption) + FPE (for preserve length). Have a look at “A Synopsis of Format-Preserving Encryption” by Phillip Rogaway (PDF)


1

Which techniques can I use? The most ideal option is to use synchronous-stream ciphers. They are not only fast, but also let you retain the plaintexts length. The best pseudorandom number generator I know is AES-CTR. How secure are these techniques as compared to the ones which increase the size of the data. It completely depends on the ...


0

OTR is trying to achieve the same unbreakability of OTPs by changing keys. The unbreakable part of OTPs comes from the following: Consider if the one-time pad is used to encode the word "otter." If an attacker tries to brute force the contents of the pad, the message will "decrypt" into every possible combination of 6 characters (e.g.: "lemur." "badger" ...


2

What you ask is very well possible. Let's assume you have a document DATA you want to encrypt. You first randomly generate a symmetric key K and authenticate and encrypt DATA using this one. In the next step you asymmetrically encrypt K with the end user's public key and store the resulting cipher text along with the encrypted data. For allowing your ...


1

Basically you would be constructing an AEAD scheme. You will need to perform HMAC over the IV, the ciphertext and possibly over additional associated data (AAD). If you just need to authenticate the ciphertext then you may simply leave out (or leave empty) the AAD - but not the IV during the HMAC function. Fortunately somebody already thought about ...


7

The standard answer to this question is format-preserving encryption (FPE). FPE is a class of techniques that allow you to encrypt data while preserving some of its format (which can include its length). In terms of security, most FPE schemes are deterministic, which means they do not achieve the standard IND-CPA notion of security. However, for ...


3

Any cryptosystem in which the size of the ciphertext equals that of the plaintext is necessarily deterministic, and thus can only be secure if each key is used to encrypt only one message.


1

well simply said true, with more key changes she can bruteforce the same keys over more messages which may give her faster results but when one key actually has hit, it is just valid for one part of the message and not everything. Essentially a one-time-pad uses a different key for every message which is the whole point of it. because key re-usage makes the ...


0

The number of your ID card is not really a secret, and probably shouldn't even considered one. You could use it as a key for symmetric encryption (but for this purpose you'd have to share it with your communication partners, and everybody knowing the ID could read the communication), but not for public/private key cryptography. This is the reason why the ...


1

Q: Is there any way I can infer what is being used to encrypt the file? A: Yes there is some way. Examples: Reverse engineer the software to figure out what algorithm they use as Gilles said. This is not related to cryptography. Learn crypt-analysis to infer the enc alg used. You might win several prestigious awards along this path. The reason it's so ...


0

My recommendation will be to use a stream cipher consisting of any block algorithm in CTR mode. You could use block ciphers like AES, or hash functions like BLAKE2. Stream ciphers are very efficient and light weight, hence it is the preferred cipher for encrypting phone calls. It should be good enough for your project. Block ciphers and hash functions make ...


1

Diffie-Hellman relies on a mathematical problem on positive integers. To use it with bytes you just have to convert the bytes to - or use the bytes as - an integer. Usually this would be a unsigned big-endian (or network order) integer. For Diffie-Hellman the parameters consist of the modulus and the base. The public value could be 1024 bits (128 bytes). ...


1

It's trivial to code your own wrapper function if you really want to use such API. Here is a Python-inspired pseudo code: def mywrapper(data, offset, encspecs): subdata = data[0:offset] ciphertext = whatever_enc_function(subdata, encspecs) return ciphertext encspecs = ... plaintext = "...etc" ciphertxt = mywrapper(plaintext, offset, encspecs) ...


2

What you seem to be looking for is a scheme like the following: It consists of two algorithms, a key generation algorithm $K$ and a "key use" algorithm $U$. The key generation algorithm outputs a pair of keys $(k_0, k_1)$. The "key use" algorithm takes as input a key and an element from some set $S$ (which may depend on $k_0$ and $k_1$), and outputs an ...


4

There is no security difference; there are a handful of practical ones: With xor, you can have the same code to do encryption and decryption With xor, you don't have to pick a 'word size'; a larger CPU can handle 4 or 8 bytes at a time, while a microcontroller can handle 1 byte at a time, without changing the ciphertext With xor, you don't have to worry ...


5

AES is a block cipher and would return wrong data when a wrong key is used. It only works on a single block of data (16 bytes). The default CBC mode of operation enables you to encrypt multiple blocks of data. The padding then enables you to encrypt plaintexts of arbitrary length. The padding has to be removed somehow after the decryption. You're seeing a ...


0

I think the answer is in some ways very obvious and in some ways less obvious. The advantage is that if it's proprietary, then that means you're almost certainly paying another party for it and therefore holding them responsible for reviewing, maintaining, and debugging the encryption library when problems arise. Contrast this with a library like OpenSSL, ...


1

This is an example of an attack in a multi-key setting. Since the objective is that all communications remain secret, rekeying does reduce the effective security. In the case of only a thousand keys this is not very severe, since it only amounts to about a 10-bit loss: 118-bit security is still large enough by a clear margin. However, if you had a million ...


2

A possible advantage is the need for cryptanalysis. Using only standard algorithms, an adversary who had a machine capable of breaking them could just feed your ciphertext into the machine. With a proprietary algorithm they would not have a ready-made machine for breaking it, so they would have to analyze it first, even if after that it would be very easy ...


-1

Obscurity can work if your application is, indeed, obscure. If you're Microsoft, that won't work. If millions of dollars depend on the security, that won't work either. But don't make up your own encryption algorithm - chances are it'll be easy to break. Instead, modify an existing encryption algorithm that's already good. For instance, use AES but ...


3

Strictly speaking, we can't know for sure that the output of AES is indistinguishable from random noise. It's conjectured to be true but no "proof" of that fact exists. For most commonly-used ciphers, it is conjectured that their output is indistinguishable from random. Specifically, modern ciphers are conjectured to be "strong pseudorandom permutations", ...


0

I can think of only one answer: DRM. Or rather, anywhere you have a system in which the consumer must be able to decrypt and consume the encrypted data in a controlled fashion, but at the same time must not be able to do so freely. Consider, as an example, a 2D game with user-provided content, where users can create graphical assets for their own areas, ...


5

Custom crypto can be valuable when other aspects are more important than the confidentiality guarantee, and the well-known ciphers don't address those aspects. A custom cipher or custom application of a cipher would tend to offer a weaker guarantee of confidentiality than well-tested systems. But some users of encryption can handle an eventual breach so ...


0

Are you implementing this for cryptographic purpose ? If so, you should use True Random Number Generators (TRNGs) to generate your master key.Your key should have following properties: Statistical independence = For a given generated sequence of values, a particular value should not be more likely to appear next. Uniform distribution = All numbers are ...


8

The main advantage is that using a proprietary algorithm gives you access to trade secrets like additional cryptographic attacks that other algorithms fall to but to which the proprietary algorithm is resistant. Whether this is important depends on the amount of trust you have in the vendor. As other answers have noted, usually the staff of any one ...


2

The reference definition of Spritz seems to be: Ronald L. Rivest and Jacob C. N. Schuldt, Spritz - a spongy RC4-like stream cipher and hash function, presented at Charles River Crypto Day (2014). The code snippet of the question shows how the state of Spritz repeatedly used in DBRG output mode is updated and its next output byte $z$ produced; the state ...



Top 50 recent answers are included