New answers tagged

1

Assuming the set of large numbers is small (otherwise you cannot represent them all as small numbers), what you are looking for can be broken into two steps: Transform the large numbers into small ones. Encrypt them. The first problem is not really cryptographic. In the simplest case it can be simply subtraction. If your set of numbers is sparse it can ...


4

What you're asking for is impossible by a very simple argument. If you're mapping a large number of things to a smaller number of things, more than one of the things from the bigger group will get mapped into the same thing in the smaller group. This is the pigeonhole principle. When you get your "small number" there will be several different large numbers ...


29

You are likely going to have both false positives and false negatives if you try to use Shannon entropy for this. Many compressed files would have close to 8 bits of entropy per byte, resulting in false positives. Any encrypted file that has some non-binary encoding (like a file containing an ASCII-armored PGP message, or just a low entropy header) could ...


7

Yes its a good indicator and no there won't be many false positives. A high-entropy file indicates that a file is either well-encrypted, well-compressed or just contains truly random bytes. Most compression formats have recognizable headers etc so these can be easily distinguished. Most people do not have files of random bytes lying around - why would ...


8

I believe the concept you're looking for is a cryptographical hash. This is a function that takes a (potentially) long input, produces a short (fixed length) output, and for which it is impractical to find two different inputs that generate the same output. It is a fixed function; anyone (including your customer) can generate a hash for any input. How it ...


2

To me that sounds like a specific type of corruption, which can also be used in simple "analog" audio encryption systems. Some analog encryption systems work by reordering of the frequency bands so they are unintelligible. I believe what you are hearing is missing specific frequency bands, most likely by a fault in the encoder, which results in them not ...


0

The idea in [1] (disregarding reception errors) is to first remove the impact of the message. This is done by computing the syndrome $\qquad\qquad\mathbf{H} \mathbf{v} = \mathbf{H} (\mathbf{m} \oplus \mathbf{k}) = \mathbf{H}\mathbf{k}$. In the case of a ${1}/{5}$ repetition code, this could correspond to adding even number of (bold) codeword symbols ...


2

No, wrapping the data key set seems a good idea to me. It's pretty standard and should even work with e.g. hardware modules. Note that your old ciphertext would still rely on the security of your old secret (password) when you choose this scheme! If $Enckey$ is ever guessed it can be confirmed by decrypting (the first part of) your ciphertext. There is a ...


0

I'm not an expert, but as far as I understand that would be impossible. My reasoning follows. In the case of encryption - even if an attacker guesses correctly - he doesn't know that. So secrecy can be perfect. With integrity, on the other hand, even if an attacker doesn't know he guessed correctly, the attacked will be fooled into believing the integrity ...


4

Yes, there is the one-time MAC. This is a scheme which ensures that an adversary (even one with infinite computational resources) has a negligible chance of altering the message or forging a fake message without detection. Edit to add: Mikero's comment and the other answer demonstrate that we need to be clear about what we mean by "perfect" integrity. "...


2

A block cipher mode is an algorithm used along with a block algorithm to encrypt arbitrary size plaintext, providing both confidentiality and authentication. A single block cipher operates only on a fixed block length. It is not alone enough to encrypt larger plaintexts. However, a single block encryption can work as a black box in the Random Oracle Theory. ...


0

The block cipher itself is used as a black box for any mode of operation. The internal design - including if the block cipher uses a Feistel network - is completely tranparent to the mode of operation. The only thing that matters for the mode of operation is the block size of the block cipher. This, together with any usage limitations, limits the ...


0

It is unfeasible with newer CPUs to just count instructions, as newer CPUs can do multiple per cycle, and have multiple cores and likewise. Cycles per byte is the usual way to measure performance these days. Of course, to make it as fair as possible and comparable to others, the code is only ideally run on one core, turboboost and hyperthreading is turned ...


3

All of the mathematical operations within the s-boxes, shift row, and mix column should be known to the attacker, correct? Yes, see Kerckhoff's principle I understand they could be hard to calculate but aren't they static operations for the most part? I'm interpreting "static operations" to mean subBytes + shiftRows + mixColumns + addRoundKey, and that ...


4

The XOR state is irreversible without the proper key which is what I understand, so whats the point of all of the other operations that happen on the key? Suppose all we had was secret keys and the XOR operation. Well, actually, it is possible to build a secure cipher out of that, called the one time pad. One time pads offer perfect secrecy, but suffer ...


2

Around and about one hundred years ago, your idea would surely have made sense… but nowadays, modern technology and evolved cryptanalytic techniques are too smart to have a real problem coping with something like that. (Also see my related answer to “Why was the Navajo code not broken by the Japanese in WWII?”) Even when we completely ignore Kerckhoffs’ ...


8

Historically, there did exist a benefit to using a language that the adversary was not familiar with. The name for this is code talkers, and the most famous ones (at least in the USA) are the Navajo code talkers of World War II. The idea was to defeat attacks that relied on statistics about the language used in the plaintext. In modern cryptography, ...


4

If you're referring to a classical cipher, it might complicate frequency analysis and other such techniques. For a modern cipher, it makes no difference. Modern ciphers operate on arbitrary patterns of information. Ideally, the ciphertext of a modern cipher should have no relation of any kind to the associated plaintext, other then the key.


2

The distance of the code word is the minimum number of bit flips that transforms one codeword into another. It's just the minimum of all possible hamming distances between the codes. Also you can define the weight of a codeword to be the distance from the zero vector. For your code it looks like $d = 2$.


7

This is identical with CTR mode encryption with a MAC. That's known to be secure. It doesn't say in your question if: the Ai blocks are completely unique; the header is included in the MIC calculation. If those preconditions are met then I don't see any issue with the protocol. The first one I cannot verify but seems likely, the second one is certainly ...


2

First use the TID as input for a KDF to generate one or more tag specific keys, using a static, symmetric master key stored in the initialization software and gadget. Use one of these keys to obtain access. Use another for verification of the tag. During initialization derive and set the access key (s). Then create a HMAC over a static value (or multiple ...


2

If I am correct, and you can just the ESN has the implicit IV, is doing so compliant with the standards? No, it would not be compliant with the RFC. The RFC clearly states that there must be 8 bytes of IV payload immediately in front of the ciphertext (see section 3). Omitting those 8 bytes would not allow interoperability with standard implementations of ...


0

Quoting “Exam Ref 70-486 Developing ASP.NET MVC 4 Web Applications (MCSD): Developing ASP.NET MVC 4 Web Applications” by William Penberthy, Pearson Education, 15 Sep 2013: Salting is a process that strengthens file encryption and hashes, making them more difficult to break. Salting adds a random string to the beginning or end of the input text prior to ...


1

It depends on the operational constraints. If you have storage or bandwidth constraints and need to compress data, you should compress first then encrypt (compressing an encrypted text doesn't make sense as the cryptogram is a random series of bytes provided the algorithm is good - so the output won't compress well). Compression will also have a performance ...


1

Java cryptography (JCA) is designed around the concept of replaceable providers; originally (in the 1990s) this was necessary to easily support US and 'foreign' (with limited crypto) versions with a single codebase. (This is all crypto -- codesigning and other things as well as SSL/TLS.) If you use the Sun-now-Oracle providers, which is the case if you use ...


4

As indicated, the header format of your proprietary encryption is entirely up to you. Still, as I see this forgotten or done imperfectly a lot of times, I'll give some general hints in the right direction. First of all, complexity is the enemy of security. If you make your header overly complex you may get into trouble. It could be possible to generate ...


1

Another danger of error correction followed by is the following. If we follow Kerchoff's principle, the error correction method/code as well as the encryption method should be public. Thus the only unknown is the secret key, assuming a symmetric scheme. Most error correction codes are linear and thus introduce dependencies between symbols that are input to ...


1

You can assume CDH assumption. Suppose A's public and private key $g^x$ and $x$. In the same way, B's public and private key $g^y$, $y$. Then shared secret key $g^xy$ will have same concept with $a=e(d_{A},B)$. IF CDH is hard, then no one but A and B can compute $a$


2

The correct procedure is Compress $\to$ Encrypt $\to$ ECC $\to$ Transmit. You would have no hope of error recovery if you were to apply error correcting information prior to encryption. It is the design goal of a cipher to introduce bit flips with probability ${1}\over{2}$ and Shannon's noisy channel coding theorem tell us we cannot communicate at all if ...


4

Yes, 3DES is a symmetric cipher and you use a secret key for both encryption and decryption with it. However, that is not the same thing as the keys used in RSA or other public key cryptography – you cannot (and should not) use either of them for 3DES. Since you are using S/MIME, you are actually using public key encryption. Any reference to 3DES is about ...


8

With some modes you can encode then encrypt, specifically stream cipher modes (CTR, OFB). Bit errors during transmission translate to identical bit errors in the encoded plaintext, and error correction will work as intended. However, with standard block cipher modes (ECB, CBC), the entire block is encrypted, and a 1 bit error in the ciphertext creates many ...


4

The cipher suite with the best theoretical security for TLS (v1.2) right now is clearly: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 with P-521 as the associated curve for the certificate and the key-exchange. The arguments are simple: ECDHE and ECDSA with P-521 both provide 256-bit security against forgery / key recovery attacks AES-256 is the strongest ...


2

TL;DR: Chances are there are no attacks against this scheme. What you are describing sounds exactly like a chosen-plaintext attack, e.g. you can query an oracle to encrypt plaintexts of your choice (using the oracle's random IVs). Now, this attack is already stopped by AES-CBC which is provably immune to this sort of attack. And furthermore it seems like ...


5

BitTorrent, when encryption is used (optional in most clients), uses the Diffie-Hellman protocol for key exchange and RC4 for confidentiality. It also drops the first 1kb of data from the RC4 output as part of the specification. There is no authentication, not really enforceable anyway due to the nature of peer-to-peer sharing networks. Standard theory ...


2

The eprint version has the following to say (adapted for your notation): Authenticated-decrypt: [...] Check that $s = H_3(\gamma, Msg)$. If not, reject the ciphertext, otherwise output then plaintext $Msg$. In the attackers case, the decryption oracle would try to check if $s = H_3(\gamma', Msg)$ with $\gamma'=\gamma \oplus H_{2}(a,s) \oplus H_{2}(t,...


3

You can compute a statistical distance measure between the observed letter frequencies in your candidate plaintext and the typical letter frequencies in English text. There are a number of different ways to measure the similarity between two statistical distributions, and I'm not aware of any theoretical or empirical studies on which of them would be ...


2

"I'm using [AES] in CBC mode, but the implementation doesn't add the randomness I want, the same message when encrypted looks the same." This is a problem. If you were using CBC mode correctly (i.e. with a random IV), then encrypting the same message twice would produce completely different ciphertext. Since you're not using CBC mode in the way it's ...


0

The technique called "Angecryption" might be relevant to you. It allows you to encrypt a known plaintext to a given ciphertext under a given key. However, I'm not sure what file types it supports, and if the types supported are relevant to you. The example in the article is turns a picture of annakin skywalker into darth vader given the key "Anger = ...


4

Exponential cipher is a symmetric-key algorithm, not public-key one. So you don't have any public and private keys. You only have one secret key and it's used for encryption of messages between people that know the key. The security of exponential cipher is not in the computiation of $d$ from $e$, which is easily computable by EEA as you said. The security ...


0

It all depends on your restriction of length of initial password. If your user is able to enter password of just 4 characters, then doing SHA1 etc is not going to add any entropy (in simple words the brute force space for the attacker is not going to increase). Assuming attacker can check One million password per second then below is a summary for your ...


0

all the cryptography methods except one time pads from the BC (before computer) era were effectively made obsolete by computers. The amazing WW2 work against enigma were a bridge between the old and the new eras.


1

"Guessed ID" means ID that the oracle guesses the attacker algorithm $A$ will attack.


13

There are a number of considerations here, I'll try to lay them out one at a time for ease of following: What must the site do with the data? Oftentimes, we ask web sites to do things on our behalf when we are not actually visiting them. For example, I may want crypto.SE to email me when there are responses to this post. The site could not do that ...


0

I think I can spot an implicit assumption that you're making that could easily trip this up: Assumption: None of the ciphers is its own inverse. Counterexample: Stream ciphers are a popular class of algorithms where encryption and decryption are the same function: encyrpt(key, encrypt(key, plaintext) = decrypt(key, encrypt(key, plaintext)) = plaintext. ...


0

I am no expert in cryptography, so this method of encryption sounded pretty good until you explained how the password was the only thing that seemed to matter. While this does mean that if someone gets the encrypted password it will be difficult to decrypt. It also means that this method would be very prone to brute force attacks. This is why RSA is so ...


3

Loading and using encrypted firmware usually requires one of the following conditions to be met: You have a security (co-)processor and the processor is trusted to follow the instructions given by that (co-)processor You have a trusted processor and some tamper-resistant storage Scenario 1 You have a security (co-)processor and the processor is ...


4

In 2006-07, NIST published a new standard for cryptographically secure random number generation. One of their suggestions was based on elliptic curves, DUAL_EC_DRBG. in 2006, Daniel Brown and Kristian Gjosteen discovered that this algorithm had a subtle bias for certain numbers. Later, in 2007, Dan Shumow and Niels Ferguson said they had found what caused ...


3

WEP for securing wireless networks: Wired Equivalent Privacy (WEP) is a security algorithm for IEEE 802.11 wireless networks. Introduced as part of the original 802.11 standard ratified in 1997, its intention was to provide data confidentiality comparable to that of a traditional wired network. WEP, recognizable by the key of 10 or 26 hexadecimal digits, ...


18

DES has not been mentioned in the previous two answers. Although it was known to be quite weak from very early on it was widely used for a couple of decades at least, until newer algorithms (3DES, AES, but also e.g. RC4) displaced it. Nowadays it can be broken in hours with dedicated hardware or with at most a few thousand dollars of cloud computing time. ...


17

This is a shot in the dark, but could you be thinking of the Needham-Schroeder protocol? It was published in 1978 [1], and an attack was published as much as 18 years later, in 1996 [2]. It is not an encryption method, though, but a protocol. In fact, the original paper does not even specify an encryption method to be used, but uses encryption symbolically. ...



Top 50 recent answers are included