Hot answers tagged

11

If you combine two affine ciphers, you obtain one affine cipher. Say the first cipher is $e_1(x) = a_1x+b_1$ and the second is $e_2(x) = a_2x+b_2$. Then $e_1(e_2(x)) = a_1(a_2x+b_2)+b_1 = (a_1a_2)x+(a_1b_2+b_1)$. Note that if $a_1$ and $a_2$ are both relatively prime with the modulus, then so is $a_1a_2$, so the new cipher can also be deciphered.


10

The usual method to do this is to turn the block cipher into a stream cipher. In that way the ciphertext is generated by XOR'ing the plaintext with a generated key stream. This key stream in turn is generated by the mode of operation that turns the block cipher into a key stream. There are several of these modes, but CTR mode of operation is most often used ...


4

You could be able to reduce the space required for a meet-in-the-middle attack, if you follow a similar idea as the application of Grover's algorithm on collisions. Suppose you have two layers of $n$-bit encryption: Partition the inner keyspace into $2^{n/4}$ parts of size $2^{3n/4}$. For each partition generate the inner encryption table. Run Grover's on ...


4

Since you are deriving the key from a password, there is generally not a security advantage to using multiple encryption in the way you described. The entropy of key material generated is less than the maximum security provided by AES, which means an attack on the password will be more effective than a generic key recovery attack on the cipher. A ...


3

There is a very simple, completely generic solution, that unlike the other solution doesn't assume anything about how the two encryption schemes work internally (e.g., that they are built from block ciphers or have pseudorandom ciphertexts): given a message $m$, choose a uniformly random $m_1$ of the same length and let $m_2 = m \oplus m_1$. Then encrypt ...


3

There's quite a few things wrong with this. For starters, a block cipher does not imply authentication. Common block cipher modes such as CTR, CBC, and (god forbid) ECB provide nothing but pure encryption. If you want authentication, look into the GCM block cipher. AES-GCM is possibly the better way to go here. You state that it is built on the idea that ...


3

If you're using a real encryption scheme then no it cannot weaken or strengthen the system because the encryption scheme's security is supposed to be independent the actual data being encrypted. The plaintext could be random bytes or all zeroes for all it cares, it will be just as secure. All this modification achieves is lower your encryption scheme's ...


2

The combination of Grover algorithm and man in the middle attack is the main subject of a paper (arXiv:1410.1434) published last year by Marc Kaplan (Full disclosure: Marc is a friend of mine.) In this paper beyond applying Grover to MITM to reduce the time needed to analyse double-encryption, he also looks at the time-space gain, which is different, and ...


2

For a crypto algorithm that acts like a group, the first thing that comes to mind is Pohlig-Hellman. In this method, we have a large prime $p$, and define: $$E_A(Data) = Data^A \bmod p$$ (with $A$ relatively prime to $p-1$) This has the property that $E_B(E_A(Data)) = E_{A \times B \bmod p-1}(Data)$; however it has the security properties you're looking ...


2

EDIT: I think what I do is provide a little more than a hint so don't read further if that is an issue. That is: Resulting in: Alternatively: and


1

If the ciphers are different, with independent keys, you can say that it is at least as strong as the first cipher. If the ciphers commute, like with stream ciphers, you can even say that it is at least as strong as the strongest. See Cascade Ciphers: The Importance of Being First. That's really all you can say in general. In practice, the combinations you ...


1

In general, all you can say is it can be as weak as the weakest encryption layer, if you're lucky. Edit: It can also be even weaker, for badly chosen components that cancel out some mathematically desirable properties, as pointed out in the comment.


1

Without more context the answer isn't quite precise. In the following answer $\oplus$ always denotes bit-wise XOR. First let's quickly revisit "plain" cascade encryption. You encrypt arbitrary messages using the keys $K_1,K_2,K_3$ and the encryption algorithm $E$ as follows: $C=E_{K_1}(D_{K_2}(E_{K_3}(P)))$ Now the first possible XOR-cascading construction ...


1

This technique is known as Ciphertext stealing. Ciphertext stealing avoids padding, but only works if the total message size is bigger than one block. Ciphertext stealing secure in principle, but as @mikeazo already pointed out using ECB and using 64 bit block ciphers is generally a bad idea. There are fancier length preserving encryption schemes. FFX mode ...


1

Modern ciphers - when used with a proper mode for encryption - return a ciphertext that is - except for the size - indistinguishable from random bytes. So if you would introduce random values at random locations then you would not be able to decrypt the ciphertext. You could try to brute force the randoms away, but in that case you need to perform as many ...



Only top voted, non community-wiki answers of a minimum length are eligible