Tag Info

Hot answers tagged

7

EEE and EDE are effectively the same in terms of security. EDE is used because it is "backwards compatible:" by setting all three keys to be the same, it becomes equivalent to just single encryption (E) with that key.


6

I don't know about computing things in parallel, so I will ignore that part of the question. First, please note that the encryption algorithm is rarely the the weak point of the security. It is far more likely that you will have problems with the implementation, some spyware installed on your computer, a weak password (If you use qwerty as your password, ...


5

I won't say someone would be able to break it 'easily'; however it won't be anywhere as difficult as with a true 128 bit cipher (or even 120 bit cipher; your construction ignores 8 of the key bits). Here's an outline of how the attack would work: we assume we know the plaintext and the ciphertext, and are trying to recover the key. When we do is encrypt ...


3

The actual security would probably be about 65 bits. A meet-in-the-middle attack can be used to find the keys of both ciphers in less time than naive brute force. The attack would decrypt the ciphertext with all the 64 bit l keys of the outer cipher, encrypt the plaintext with all the 56 bit keys of the inner cipher, then look for matches. It only requires ...


2

What you propose is called Double Encryption. With two independent keys, it is vulnerable to meet-in-the-middle attacks as described in another comment. I just add that this attack can be performed almost memoryless. Details are in the answer to similar question about Double-DES.


2

In short: does storing these encrypted files in an encrypted partition/folder create the same potential weaknesses as cascade encryption? If not, what of encrypting a .tar of encrypted documents? An encrypted file inside an encrypted container is a cascade of ciphers, almost by definition. Is that a problem? Not really. A cascade of ciphers shouldn't ...


2

At its simplest, to encrypt a message for $n$ different recipients, you could just make $n$ copies of the message, encrypt each one with a different key, and join the encrypted messages together into a single long ciphertext. Of course, the disadvantage of this scheme is that the ciphertext length grows linearly with the number of recipients. To avoid ...


2

They rely on problems not so different as you might think. They are based either in the factoring problem or in the discrete logarithm problem, which have a deep connection between each other. Once you have an algorithm that can efficiently solve one, you most likely would be able to adapt it to reproduce an answer for the other in polynomial time. Thus ...


1

For a crypto algorithm that acts like a group, the first thing that comes to mind is Pohlig-Hellman. In this method, we have a large prime $p$, and define: $$E_A(Data) = Data^A \bmod p$$ (with $A$ relatively prime to $p-1$) This has the property that $E_B(E_A(Data)) = E_{A \times B \bmod p-1}(Data)$; however it has the security properties you're looking ...


1

This technique is known as Ciphertext stealing. Ciphertext stealing avoids padding, but only works if the total message size is bigger than one block. Ciphertext stealing secure in principle, but as @mikeazo already pointed out using ECB and using 64 bit block ciphers is generally a bad idea. There are fancier length preserving encryption schemes. FFX mode ...


1

It seems the result is specifically for multiple encryption with a single cipher (like in 3DES). It probably applies for different ciphers as well, but key and block sizes would need to be equal. You might get a lower bound by using the minimum key size, but don't quote me on that. However, I don't think this is really relevant for a practical ...


1

Two things to consider: encryption and authentication. In general you can only say that a cascade of ciphers is as secure as its weakest link. If the encryption in NaCL had a side-channel attack, it might leak information about the plaintext, whether or not the ciphertext is sent through TLS. Authentication, on the other hand, is additive. If you can ...


1

If you have a secret key (256-bits) shared between the two systems that see the entity identifiers, you can use HMAC-SHA256 to map entity identifiers to a random string. Under the assumption that HMAC-SHA256 security is good (which is widely believed to be a reasonable one), this is just as secure as having generated a truly random mapping, but requires ...



Only top voted, non community-wiki answers of a minimum length are eligible