# Tag Info

0

Using a search engine, you would quickly have discovered hints that they’re “home-brew riddles”. For example: Travers uncovers the same messages hidden inside the crossword puzzles of several major newspapers. He stumbles upon a series of 27 10-digit numbers, one set for each World Series the Yankees have won, that, by way of historic baseball dates, ...

4

I think that the answer to this question is a bit more involved than it first seems. The reason is that the compression attacks work when different lengths after compression reveal information about the plaintext. This is of course a huge problem. However, you have to ask the question without compression as well: when does the plaintext size leak information....

1

There are of course places where compression would be OK. Say you'd have a message space $M$ and the compression function on any message of $M$ returns a specific length, say $\#m / 2$ where $m$ is the message and $\#$ calculates the length. In that case no information is leaked. You could make this more likely to happen by adding additional data until a ...

2

For some modes of operation you can easily show that an involution would be insecure: OFB would be most clearly insecure, since the keystream just repeats the nonce/IV and its corresponding encrypted block. CFB would likewise be insecure, since zero blocks encrypt just like with OFB. This is of more limited advantage to an attacker, but far from secure. ...

1

Shift cipher or ceasar cipher attains perfect secrecy only in the special case with the assumption that $26$ keys are used in equal probability in the shift cipher, and to encrypt each symbol we use a different key which is choosen equiprobably (i.e. perfectly random) from the key space. It is easy to check all keys given a plaintext when the key is fixed ...

7

Before we start with vectorial Boolean functions, let's recall the definition of the nonlinearity of a Boolean function: $$\mathcal{NL}(f) = \min_{a \in \mathbb{F}_2^n} d_H(f, \ell_a \oplus b),$$ where $\ell_a \oplus b$ represents the affine Boolean function defined by the bitvector $a$: $\ell_a(x) = a \cdot x$ ($\cdot$ is the dot product). The above ...

3

It depends on the application if base 64 is being used to represent keys. Many applications that implement/use cryptography have been originally designed in a time where ASCII based communication was commonplace. If you would directly use BER / DER - a binary encodoing of parameters - then you had a high chance of losing data. For instance, you would not be ...

3

Base-64 is simply a way to represent binary data using the ASCII character set. It's used because a single base64 digit represents a whole number of bits (6 bits), where each decimal digit represents ~3.3 bits, which can make conversion a little tricky. Being able to represent more bits per digit also means its more space efficient than decimal. It takes ...

0

My question is - are there any known methods (e.g. ever used in history) for selecting specified positions in point 2)? Your construction is quite similar to the Running Key Cipher, which is soemtimes considered a variant of the Vigenere cipher. There they just start at one position and use all subsequent symbols as keystream. ... He told me that he ...

9

Your problem is equivalent to solving $m^3 \equiv c \pmod n$. This corresponds to breaking RSA for $e=3$. We know no efficient way for doing that without factoring $n$. If you know the factors of $n$ you can compute the private exponent $d$ as $e \cdot d \equiv 1 \pmod{\varphi(n)}$ using the extended euclidean algorithm and then compute $m$ as $c^d$.

2

The keychain was moved to the Secure Enclave, the Apple WWDC 2015 Session 766 transcript states: "We also moved the KeyStore component from the kernel into Secure Enclave and it's that component which controls the cryptography around Keychain items and the data protection."" Thus both symmetric and asymmetric keys are now in the Secure Enclave if the ...

3

Since any cipher must be able to decrypt every message that it encrypts, it follows that, given a fixed key, any cipher must be an injective function: In mathematics, an injective function or injection or one-to-one function is a function that preserves distinctness: it never maps distinct elements of its domain to the same element of its codomain. In ...

6

Use DLIES, which is essentially Diffie-Hellman with an ephemeral sender key. Assuming you know the receiver's public key, that will cost no extra round trips. The sender does: (eph_sender_private, eph_sender_public) = Generate_Key_Pair() shared_key = SHA-512(Diffie-Hellman(receiver_public, eph_sender_private)) ciphertext = Encrypt(shared_key, message) ...

5

Rather than using a form of encryption which is slow in one direction, you could use a proof-of-work function instead, as Ricky Demer pointed out in the comments. This allows you to freely tune the slowdown while still using normal, widely accepted encryption and authentication algorithms. For example, you could make the sender look for a partial preimage ...

5

Perhaps not of relevance if the question is meant in a purely thoretical (i.e. asymptotical) sense, but the CBC encryption mode is inherently sequential, while decryption can easily be performed in parallel.

5

In lattice-based encryption schemes, the encryption is often slower than the decryption (not artificially, but just as the natural way it works). See this paper Efficient Software Implementation of Ring-LWE Encryption (encryption is 3 times slower than decryption).

1

Is it fine to do that? Yes, it should be fine, as long as you do not reuse the key/salt-pair for encrypting another piece of data. Or is there a more standard construct? Any authenticated encryption algorithm would work. E.g. AES-GCM with the PBKDF2-derived key. If you are going to use the same password for encrypting many such pieces of data there ...

1

I'm sorry, but chances are this doesn't work. The reason is of course that ECDSA signatures are usually fully randomized, meaning that there's randomness introduced in between the private key and the final signature. If you're looking at an ECDSA specification, the relevant value usually is called $k$. What you'd rather need would be an RSA encryption / ...

0

It isn't secure at all unless the GUIDs are completely inaccessible to everything except the encryption code. I doubt that is the case in a real application; I assume every DB query and API call passes those GUIDs around. Any anyone who can access the database can easily hash the GUIDs as well and decrypt any of the data. Your scheme as described is ...

1

Let $K$ be the set of all possible keys (for AES-256, this set has $2^{256}$ elements.) Let $M$ be the set of all possible messages (for AES, it has $2^{128}$ elements). Let $C$ be the set of all possible cipher texts (for AES, again $2^{128}$ elements). I was reading a proof to the statement: Perfect privacy implies that $|K|=|M|$ ...

0

As far as I know the statement is not correct. perfect secrecy implies $|K|\geq |M|$ (as you can see in Theorem 2.10 in Introduction to Modern Cryptography) and does not implies $|M|=|K|$ necessarily. Your mentioned proof works well for $|K|>|M|$ (and yes I believe $p$ refers to probability) . also here is Katz and Lindell proof for this theorem (this ...

6

If I understand you properly, you are going to test some cryptographical primitives by running them on some plaintext, and then taking the resulting ciphertext and giving it to a randomness test suite; your question is "what plaintext should I use? If I pick a random plaintext, then the test results might reflect the randomness of the plaintext, and no ...

1

What you are describing is called a transposition cipher. First of all, it would be easy to detect which method you are using since the frequency distribution of your cipher text will be the same as the language of the plain text. I think the biggest problem with using only transposition as opposed to a combination of both substitution and transposition ...

4

Well, there are indeed differences between the two standards, as you can see below: key pair generation X9.31 requires that $p-1$, $p+1$, $q-1$, $q+1$ all have prime factors between $2^{100}$ and $2^{120}$, and that $p$ and $q$ differ in at least one of the first 100 bits. These requirements are there to frustrate suboptimal factoring methods, ...

0

It is simply a parameter for indicating the length of the keystream in bits. Internally, EEA2 will call AES the appropriate number of times to produce that much output, truncating the last block as needed. It is not mixed into AES inputs or the key, so like you said it has no effect on the output bits themselves, beyond choosing how many are taken.

3

Let $a$ and $b$ be the numbers emited rsp. by person A and person B. $E(x)$ means encoded form of $x$. $E(a)$ and $E(b)$ are publicly known, right? Note that if person A knows $a$, $E(a)$, $E(b)$ and person B knows $b$, $E(a)$, $E(b)$ and it is possible to calculate $a+b$ from $E(a)$ and $E(b)$ (that is what you want to do, right? So it must be possible) ...

1

Assuming the set of large numbers is small (otherwise you cannot represent them all as small numbers), what you are looking for can be broken into two steps: Transform the large numbers into small ones. Encrypt them. The first problem is not really cryptographic. In the simplest case it can be simply subtraction. If your set of numbers is sparse it can ...

4

What you're asking for is impossible by a very simple argument. If you're mapping a large number of things to a smaller number of things, more than one of the things from the bigger group will get mapped into the same thing in the smaller group. This is the pigeonhole principle. When you get your "small number" there will be several different large numbers ...

32

You are likely going to have both false positives and false negatives if you try to use Shannon entropy for this. Many compressed files would have close to 8 bits of entropy per byte, resulting in false positives. Any encrypted file that has some non-binary encoding (like a file containing an ASCII-armored PGP message, or just a low entropy header) could ...

6

Yes its a good indicator and no there won't be many false positives. A high-entropy file indicates that a file is either well-encrypted, well-compressed or just contains truly random bytes. Most compression formats have recognizable headers etc so these can be easily distinguished. Most people do not have files of random bytes lying around - why would ...

9

I believe the concept you're looking for is a cryptographical hash. This is a function that takes a (potentially) long input, produces a short (fixed length) output, and for which it is impractical to find two different inputs that generate the same output. It is a fixed function; anyone (including your customer) can generate a hash for any input. How it ...

2

To me that sounds like a specific type of corruption, which can also be used in simple "analog" audio encryption systems. Some analog encryption systems work by reordering of the frequency bands so they are unintelligible. I believe what you are hearing is missing specific frequency bands, most likely by a fault in the encoder, which results in them not ...

0

The idea in [1] (disregarding reception errors) is to first remove the impact of the message. This is done by computing the syndrome $\qquad\qquad\mathbf{H} \mathbf{v} = \mathbf{H} (\mathbf{m} \oplus \mathbf{k}) = \mathbf{H}\mathbf{k}$. In the case of a ${1}/{5}$ repetition code, this could correspond to adding even number of (bold) codeword symbols ...

2

No, wrapping the data key set seems a good idea to me. It's pretty standard and should even work with e.g. hardware modules. Note that your old ciphertext would still rely on the security of your old secret (password) when you choose this scheme! If $Enckey$ is ever guessed it can be confirmed by decrypting (the first part of) your ciphertext. There is a ...

0

I'm not an expert, but as far as I understand that would be impossible. My reasoning follows. In the case of encryption - even if an attacker guesses correctly - he doesn't know that. So secrecy can be perfect. With integrity, on the other hand, even if an attacker doesn't know he guessed correctly, the attacked will be fooled into believing the integrity ...

Top 50 recent answers are included