# Tag Info

## New answers tagged encryption

1

I don't know your exact scenario. However you have two options to encrypt data using elliptic curve cryptography (ECC). I'd recommend going with the first option I present. Use elliptic curve integrated encryption scheme (ECIES). ECIES basically performs ElGamal-like encryption on a key. The key is generated at random and encrypted like in ElGamal (replace ...

-2

Represent the text message as byte array. Note that, EC generally used for Diffie–Hellman Key Exchange and Digital Signature. The following link is about En-/decryption with elliptic curve integrated encryption system (ECIES) which may be helpful to you: Code Examples – En-/Decryption with ECIES

0

S-DES is a toy cipher intended for learning, defined by Edward F. Schaefer, A Simplified Data Encryption Standard Algorithm, in Cryptologia Volume 20, Issue 1, 1996 (paywalled with free preview). It has the same structure as DES, and uses the same notations: bits vectors (such as key and data) are numbered starting from 1 "on the left" functions of bit ...

-2

P10 and P8 are standard transposition keys that just need to be learnt. They are part of the S-DES standard.

4

You can generate a random string $s_1$ as long as the plaintext. Then XOR this value with the plaintext generating $s_2$. Now encrypt both parts using $\mathrm{Enc}_1$ and $\mathrm{Enc}_2$. You need to decrypt both to XOR the two parts together again. This is similar to secret sharing where you need two parts of a key to decrypt. If $\mathrm{Gen}_1$ and ...

2

Faliure of indistinguishablity of encryptions under a eavesdropper does imply faliure of indistinguishablity of encryptions under a chosen-plaintext attack. But the converse is not necessarily true (ex. OTP) The aim of CPA-secure is not to decrypt previously unobserved ciphertext but to pass the distinguishability test after a set of (plaintext, ciphertext) ...

3

Yes, if (and this is important) the keys for $E$ and $S$ are selected independently. Consider that we had two encryption methods $E$, $S$ for which their composition $E(S(x))$ is not CPA secure; that is, we have some distinguisher $D$ that had some advantage in distinguishing that from a random function. Then, we can build a distinguisher for $E$ (by ...

3

Note: In this answer, I stick to a definition of the One Time Pad where the random pad is used only One Time; at least, I've the name of it as support! Otherwise, it is well known that the OTP encryption scheme consisting of XOR with a repeated key is insecure by even the weakest standard (unknown plaintext with redundancy). INDistinguishability under ...

0

Ciphertext indistinguishability under CPA is equivalent to semantic security. Semantic security is the computational complexity analogue to Shannon's concept of perfect secrecy. OTP is perfectly secure, therefor is CPA secure. Under CPA, the adversary will be presented with a ciphertext corresponding to a plaintext queried (the adversary chose the ...

0

Well, not all of the AES-candidates have been considered good. In fact one of them even got broken at the presentation (within 20min!). I'll list any (non-author) occurence of algoriths I'm aware of. Note: This list doesn't claim to be complete and may be extended by other people. Now for a list of algorithms, for which I know there're an option SAFER, ...

0

If you really can use all 95 printable ASCII characters, you're better off encoding everything in binary (however you want) into 64 bits, then encrypting that with your secret key (using a cipher with a 64-bit block size, such as 3DES), then turn the result of that into 10 characters using an encoding from binary into base-95. You can actually encode 64 ...

2

I'm not aware of any classical polyalphabetic ciphers where the key could not be longer than the message. For the Vigenère cipher, the key is, effectively, repeated to make it as long as the message. There is no reason why it could not be repeated less than once, effectively discarding the unnecessary characters at the end of the key. Similarly, in the ...

3

If you can efficiently find a $P$ that is not coprime to $N$, then you can easily factor $N$ (use GCD). If you know the factorization of $N$ (say $N=pq$), you can easily find a $P$ that is not coprime to $N$ ($kp$ for some constant $k$). This established the fact that finding $P$ not coprime to $N$ and factoring are equivalent problems. Now, how many ...

1

The threshold for a perfectly secure system is that a computationally unbounded adversary cannot conclude anything about the plaintext from the ciphertext. With a public-key system, the attacker can try to encrypt messages with the real public key; this is not possible with one-time pads. What the attacker can do, quite simply, is to try all one-bit ...

0

This depends on the circumstances. If you just make a copy of your container you don't reduce security at all besides maybe giving attackers an easier way to get your container, but they still can't attack it. If you use the same (strong) password for both containers but created each one (using the wizard) it's still unbreakable as the effort has reduced ...

0

The standard definition of RSA (PKCS#1) has two formats for a private key corresponding to public key $(n,e)$ with $n=p\;q$ where $p$ and $q$ are distinct odd primes: $(n,d)$ where $e\;d\equiv 1\pmod{\operatorname{lcm}(p-1,q-1)}$ and $0<d<n$, from which it follows there are at least two private keys in this format; $(p,q,dp,dq,qInv)$ where ...

1

You cannot, you can however create a hash over the modulus. This is sometimes used as identifier for a key pair, e.g. in PKCS#11. The modulus is unique for RSA key pairs.

1

You can't. Recovering the md5sum of the private key means uncovering the private key, which is considered impossible for large values of $n$.

1

Yes this would work as stated by you. Explanation: If you're using a library supporting ECB (which you are actually using in this example) you can input the whole 32 bytes of plaintext and will receive the corresponding 32 bytes of ciphertext. Splitting the operation into two calls doesn't make any difference for libraries as internally they do nothing ...

1

What you described is to use a so-called "stram cipher". Stream ciphers output a random sequence of bytes for the same Key/IV pair. The usual usage of stream ciphers is to XOR the data with the stream to obtain the encrypted data. You may want to follow the same approach by replacing the LSBs by the bits that were output by the encryption procedure (Data ...

0

The problem is not really in the design of an algorithm. In published papers, an algorithm description takes only a few lines. Then you have done 0% of the crypto work: You have to find a provable lower bound for its security level, something O(the minimum amount of work a clever attacker will require). This fills pages and pages of mathematical papers, and ...

0

Mathematically, yes, it will work. Practically, you will require an extremely very long time and an incredible amount of energy, considering the sizes of the primes involved in RSA (usually around 1024-bit prime numbers). It is about billion and billions of years and billions and billions times the energy of the whole universe (RSA: How effective is this ...

9

"Allowed" or "forbidden" are not the right terms; the Pope won't excommunicate you if you dare implement your own algorithms. The question is rather whether doing your own implementation is a smart move or not. For learning, doing your own implementation is a good idea. It will teach you a lot on how the said algorithms work. A lot of details on how ...

4

A lot of software security vendors will implement their own crypto libraries simply because they don't want to depend on outside code. Usually for security reasons ("we don't know who wrote it, or who's allowed to push updates to it") and/or for maintenance reasons ("every time they push an update, we have to also") Note that these companies then spend lots ...

2

The way I see it, you have a few options. The right one will depend on the details of the application, which are sparse in the question. Use a stream cipher (or stream-like mode). Each party has a separate key and encrypts/decrypts with their individual key. With this you only get n-out-of-n, not m-out-of-n where $m<n$. Use MPC. You can evaluate the AES ...

8

It depends. Specifically, it depends on the type of cipher, and on the way it's used. For stream ciphers like RC4, and for block ciphers like AES in CTR and OFB modes, decryption is effectively identical to encryption, and thus takes the exact same time. (Minor exception: encryption may require generating a unique nonce / IV, which might take a small ...

2

I'd say the people dealing in homomorphic encryption are at the forefront of applied mathematical research (Shai, Smart, Gentry, Boneh...). So world-class certainly wouldn't hurt! Pick up a paper cited by HELib (for one example starting place), read it. Fail to understand it, find a cited paper, read it... repeat until eventually you find a text book ...

0

Yes; virtually all of them. Quantum computers give a quadratic speedup on a general search problems (so key lengths need to double), but I don't know of any symmetric schemes in actual use for which quantum computation gives a bigger speedup.

2

It you need a deterministically derived key for AES, the DRBG algorithms of NIST SP 800-90A are suitable, and their output is directly usable as an AES key. An example use case is when computing an AES session key from a longer-term master key, and the nonce corresponding to that session. AES will expand its key (128, 192 or 256-bit) to 128-bit subkeys (one ...

1

Can it also be used as a one-time encryption scheme? You cannot build asymmetric encryption from just hash functions. There is an impossibility proof for that. So for asymmetric encryption the answer is no. For symmetric encryption, you can simply use the hash function directly to build encryption, no need to bother with Winternitz. But you could use ...

1

There's a lot of ways to attack this. The first thing to notice is that if you know the value of plaintext at index $i$, you can then deduce the value of all the plaintext bytes at index $i+8k$; for all integers $i$ (!). That's because the relation between plaintext and ciphertext bytes is $P_{i} = C_{i} \oplus P_{i-8}$; if you know $P_{i-8}$ (and, of ...

1

I would prefer to use standardized (like FIPS 140-2) secure random generator, since the whole point is to secure the encryption key. Of course, you might want to check this website for reference: http://www.cryptosys.net/rng_algorithms.html

2

First, don't roll your own crypto. Second, why would you want to use CBC-MAC, if you have GMAC (GCM-mode) and CMAC and even better HMAC? (all of which are better than CBC-MAC) Third, don't try to fix problems that have been fixed. (see second) Fourth, I'm not aware of this construction being standardized and I'd doubt it has been. (see points 1 to 3) ...

1

The stream cipher generates 128 key stream bits per iteration. Usually these bits are buffered internally. When the encryption or decryption (identical operation, encryption = decryption) takes place then the bits are taken out of the buffer and the plaintext at the same location is xorred with it. When the keystream buffer is exhausted the next iteration ...

0

Padding oracle attacks are targeting servers, where the padding oracle attack is performed to attack the encrypted connection between client and server. You use encryption only internally, without an external interface, so yes you are right: There is no interface, where an external attacker could perform this attack. However, your entire setup is flawed ...

2

Key stretching is only used to make small-entropy keys less vulnerable to brute force attacks. If it is (nearly) impossible to break the original key, than there's little sense in using a iteration count of more than 1. If the input to the function is as big (in sense of entropy in bit) as the output, then an attacker could just attack the algorithm which ...

7

In computer science, and implementation of crypto, ROTL stands for ROTate Left. ROTL is also noted ROL, or RLNC for Rotate Left No Carry. On a $w$-bit word with bits numbered from $0$, bit number $j$ of the input of ROTL with a shift count of $n$ goes to bit $j+n\bmod w$ of the result; $n=1$ unless otherwise specified (and is the only value available on ...

-1

It seems that you do want to be given the answer and not just hints, so I will do that. But I'll go step by step so that you can stop reading if you want to finish by yourself. It seems to me that both solutions satisfy the first requirement consisting in authenticity. Breaking this property would consist in changing the content of $R$ to fool $A$ (this ...

1

The "significance of inside attacker or threat" is making the problem non-trivial. We "should we care about it in this case" because the protocol apparently claims to provide some sort of revocation.

1

My own two cents on this is that it started with a psychological bias, due to the illusion that AES-ciphering consecutive numbers in CTR mode is a weakness compared to the recursive AES-ciphering in CBC. Actually, I think I remember it was more of less told during that course on Coursera, that a consensus about the inoffensiveness of that counter with regard ...

1

It seems you want some sort of anonymization, and you already jump to a conclusion with encrypting symbols. Maybe you should step away of that for a moment, and ask yourself what your actual goal is. Encryption is useful, if you want to be able to reverse that process. If you don't hashing is a better choice in general. Your set is small enough that you ...

Top 50 recent answers are included