Tag Info

New answers tagged

2

Timestamps, as mentioned by user93353, are one possible answer. The drawback is that they require synchronized clocks, which can't always be assumed. Another possible approach to prove liveness (that is, that this isn't a replay) is for the receiver to select a random value (a "nonce"), send that to the server, and have the server sign the command ...


0

You can use time as a nonce. Add a timestamp to the message before signing it. Send the unsigned timestamp also to the receiver so that the receiver can verify the signature. Add a rule that timestamp cannot be +/- 'X' delta as compared to the current time. This rule will be verified by receiver before checking the validity of the signature. This will ...


2

"you actually solved my riddle good job you win" How to: First determine the key word number sequence by taking the key word and assigning each letter its position in the true alphabet: J U L I E T 10 21 12 9 5 20 Then take the encrypted message and assigned each letter a number by repeating the key word number sequence: I J G J H N E V ...


0

All a Vigenere cipher is is a collection of Caesar ciphers, with the $i$-th letter being encrypted with cipher number $i\pmod{7}$. That means you can just do a frequency analysis on the 1st, 8th, 15th, 22nd, etc. letters to find what shift is most likely for the first letter in the key; then analyze letters 2, 9, 16, 23, etc. for the second letter; and so ...


0

"White space has been removed" means that the original spaces between words in the message have been taken out. That means you can't tell how long the words were in the original message, so it's harder to crack the cipher by looking for common short words like "the" or "and." The resulting string of letters in the cipher may be broken into regular short ...


0

The confusion comes from the choice of representation. I'd a quick look to the referenced paper, where the autors use a 2-radix representation. Then you shoud initialise $e=\frac{m+15}{w}$ instead of $e=\frac{m+1}{w}$ as you use a 16 bit adder! The best is to read again the seminal paper of P.L. ...


0

Yep, it's possible. It's called a one-time pad; how it works is you have a truly random keystream of bits as long as the message (i.e. every bit is 0 or 1 with exactly 50% probability each, every bit is truly independent from every other bit, all possible keystreams of the right length are equally likely), exclusive-or it with the message, and the result is ...


3

In your example, $Encryption_1$ is $\textsf{AES}_{CTR}$ and $Encryption_2$ is $\textsf{Salsa20}$. Then, the encryption method you are proposing is $Encryption_1(Encryption_2(plaintext))$, which is in fact a cascade of stream ciphers. Note that, because you simply XOR the streams, this cascade cipher commutes, that is, you will have the same result if you use ...


3

Asmuth and Blakley provided a proof that, assuming the keys for each cryptosystem are chosen independently, breaking their composite cryptosystem is at least as hard as breaking the hardest part of either. [1] Building on their work, cascade ciphers have been shown to in fact be harder to break than the hardest part of either. Admittedly, what you're ...


1

It doesn't make too much sense at all to send the IV together with the key. The whole idea of an IV is that it is unique per key. But if the key changes value each time, then any IV is unique. So you could use a static IV or even an IV that consists of all zeros. In that case you only need to worry that you don't reuse the key at other locations in the ...


0

Normally you would e.g. prepend the IV to the cipher text as fgrieu suggested. But it would also be fine to send the IV together with the secret key in case they are bound to message sent. You would normally use prepending when sending several messages with the same key but of course different IVs. Thus the key has to be send securely only once whereas you ...


1

In the traditional sense, a nonce is a number that is only used once (with the same key). Though occasionally there are other requirements. For example, we may require that the nonce be unpredictable. For more on this I recommend you read this answer and this answer. Now, you don't go into enough detail on what you are doing to say whether or not you need ...


0

First, you have to know what padding you are using. In the padding, you will find the padding length. Second, you should set the padding type in the library. Third, removing and validating and using padding is tricky and can lead to some padding oracle attacks. In essential, the attacker modifies a block, which is likely to result in wrong padding and a ...


1

It depends on the format. The size suggests it is a video. However, video formats seems to be designed to be seekable. That means, the attacker seems to be able to: Create some header (guessing the resolution and some other information) If the beginning was damaged, play and seek in the file.


1

This looks like part of a problem posted from the first week's assignment of the Cryptography 1 Coursera course. Boneh outlines in his course material how XOR'ing two cipher texts encrypted with the same key result in a new cipher, similar to below. $$ m_1 \oplus k = c_1 \\ m_2 \oplus k = c_2 \\ c_1 \oplus c_2 = m_1 \oplus k \oplus m_2 \oplus k = m_1 ...


1

Information leakage in systems that do data deduplication typically involves timing hints that the data is already stored and related leverage of that information. See the comments in Online backup : how could encryption and de-duplication be compatible? for insights there. Suggest you consider your attacker's profile and see of any of those issues apply as ...


-1

Here is a great video which shows principles for public key cryptography using colors, which makes it easy to understand for everyone: https://www.youtube.com/watch?v=YEBfamv-_do Now what you missed is that it is possible to generate a secret key, and give away something which enables encryption but not decryption. This is the principle of public key ...


2

As CodesInChaos pointed out, the major flaw with this is that filenames aren't unique. If you did this on a large scale, anyone who's been given a key for a filename could decrypt any file with that filename. Even if the contents of the file are different, and they weren't intended to be given access to that file. Here's another solution that has one unique ...


2

Yes, it's safe, as you can't calculate the secret key from the HMAC result. HMAC would be useless without this feature No, Bob will not be able to use his key to calculate the other keys, as long as you use a reasonable hash function (SHA-2 should fit) It's the same as 1., Bob doesn't get more information by more derived keys But when Bob get the key for ...


1

Check out www.Coursera.org. There are two fairly rigorous courses there (both free). One from Stanford (upper undergrad level) and another from Univ Maryland (lower undergrad level). Both require some hard work, college algebra, and some integer number theory (taught in the class) - no calculus or complex number. Working familiarity with a programming ...


2

Dmitry's suggestion to use AES in counter mode sounds good to me, assuming that you only need confidentiality, and not integrity protection. (Counter mode, like most stream ciphers, is very malleable.) One trick you can use to save a bit of space is to use the current time as part of the nonce. (Of course, this only works if your devices have fairly well ...


2

A self-made modification to CBC is a bad idea, since your "IV" will not be random enough, whereas it must be truly random for CBC. Stream cipher is a good idea. You may use AES in the Counter mode, or you could use Salsa20, or any other eStream portfolio cipher (software and hardware implementations are available for all of them). Ensure that you have ...


2

What you're looking for is called a key derivation function, and more specifically a key stretching function. A key derivation function takes some variable-size material and turns it into a fixed-size key in a deterministic way, such that calling the same function on the same input yields the same key, and the original material cannot be reconstructed from ...


2

Your example is missing something: your two calls to the OpenSSL library are entirely entirely independent, but your calls to the mcrypt library reuse an existing handle. CBC has the property that identical plaintext blocks are exceedingly unlikely to encrypt to the same value due to chaining of the previous output into the next input. Your OpenSSL calls ...


-3

it's called homomorphic cryptography. A fully homomorphic cryptosystem allows E(a) +/* E(b) = E(a +/* b). This implies operations on encrypted data, which is a nice thing to have, an example is storing E(a) and E(b) on the server and you can query the server for E(a+b) without exposing plaintext a and b. This is an active research area since first practical ...


1

In addition to yyyyyyy's answer, there is also probabilistic encryption, in which the encryption process incorporates some randomness. That allows many identical messages with the same key to be encrypted differently; it doesn't necessarily encrypt the same text differently in the same message (it might encrypt $a+a$ as $E(a)+E(a)$), but it does let you send ...


2

I don't think there is a dedicated name for this. If I had to find a word, it would probably be "stateful" or "with explicit state". What you observe is actually the usual case: The user initializes an encryption system with a key, resulting in some state of the system. Then, each time the user wishes to encrypt some data, he has to pass the current state ...


0

Something that might bite is that the ASN encoding requires the numbers to be positive. So when a 2048-bit random prime happens to have a '1' as the first bit, it is prefixed with a byte of 0 to make it positive. This means half of your 2048-bit primes are 256 byte and the others are 257 bytes.


1

The first 32 bytes seem to be the ASCII representation of a 16-byte hexadecimal string. Possibly an Initialization Vector (IV) or similar. That would leave us with 88 bytes remaining. My guess is that this encryption is made by some 128-bit block cipher (e.g., AES-128), using some mode of operation such as CTR or CBC. Note that 88 bytes is not a valid ...


0

Yes, an attacker may be able to distinguish which message is send to which recipient, but it depends on the message. Imagine the following setting: the moduli of the keys of Stalio and Olio differ (this is a requirement for RSA). The public key is set to a well known constant, say the fourth number of Fermat, 65537. Textbook RSA encryption of the number 1 ...


6

Current symmetric cryptography and hashes are actually believed to be reasonably secure against quantum computing. Quantum computers solve some problems much faster than the best known classical algorithms, but the best known quantum attack against AES is effectively "try all the keys." In a quantum computer, the time taken to solve a general search problem ...


2

I did some more research and yes it does include both AD length and ciphertext length, so is not vulnerable to a length extension attack as length is part of GCM GHASH. Based on NIST SP-800-38D (PDF) page 18 len(A) and len(C) are both part of the input into the GHASH function. And double-checked this in an implementation gcm_finish method: both lengths are ...


4

There are many reasons why the IV could be expected as an input parameter: it could be to let the user use his/her own random number generator, possibly because the device has none (as G_G has already stipulated) it could be to allow for creating larger ciphertext (as ArtjomB has already mentioned) by using the IV to contain the last vector it could be to ...


1

0: you have the wrong CipherValue. The one you show is in MACMethod/MACKey and is the encryption of the MAC key, see 6.1.1. The encryption of the subject key is in Key/Data/Secret/EncryptedValue and is AAECAwQFBgcICQoLDA0OD+cIHItlB3Wra1DUpxVvOx2lef1VmNPCMl8jwZqIUqGv. 1: openssl enc in most cases, including the one you used, does password-based encryption. ...


3

It offers more flexibility in using that API. Having a separate IV parameter enables bigger plaintexts than would not be possible in a single invocation, because of for example memory restrictions. I assume CBC is used. You generate the IV and invoke the encryption on the first part of the big plaintext with the generated IV. For every other part of the ...



Top 50 recent answers are included