# Tag Info

7

Let's clear some bullshit first: Now as the NSA GCHQ et al know very well the more efficient you make the implementaiton of crypto code the more side channels it has unless extream caution is observed. One thing we do know is that optomised for speed and minimized number of gates is an almost certain guarentee of side channels no matter how clever you ...

7

Well, how resistant to attack would depend on what security properties you would need from it. There are three standard assumptions we can make about a hash function: Given a hash value, it is difficult to find an image that hashes to that value; this is known as preimage resistance Given a image that hashes to a specific value, it is difficult to find ...

6

How long are parameters used for? Usually $g$ and $p$ are kept static for a very long time indeed. In fact, the values to use are actually written in to standards. See here for an example. Those were values standardised ten years ago. So the answer is basically decades. The impossibility of brute force Let's suppose that I as an attacker decide I'm going ...

5

One way to address this question is to notice that if there was such a vulnerability in reusing $g$ and $P$ multiple times, then that vulnerability can be used to attack a specific exchange, even if they use $g$ and $P$ only that one time. That is, changing $g$ and $P$ cannot help matters. Here is how this observation works; suppose we have a black box ...

5

I don't think NSA can break the underlying encryption primitives. What they may do is record the whole SSL traffic and decrypt the whole traffic using server private key. So you can use introduce perfect forward security as the blog article “SSL/TLS & Perfect Forward Secrecy” suggests. In addition man in the middle can be performed with fake ...

3

The standard definition of existential forgery allows the adversary to ask and obtain the signature of any message she wants, and claim success if she can exhibit (with sizable odds) any acceptable (message, signature) pair, for any message for which she did not ask signature. Update: There is also strong existential unforgeability, where the adversary ...

3

Reductionist security In a reductionist security proof for some cryptographic protocol $\Pi$ to some alleged hard problem $P$ means, that we can build an algorithm $\cal B$ for solving $P$ if we have access to a hypothetical algorithm $\cal A$ that efficiently breaks the security definition for the protocol $\Pi$. In general, showing a polynomial time ...

3

Good brief topic on security of this protocol for each version can surprisingly easy be found in Wikipedia. Also, please take a look on blog posts about SSL-stripping attack, also BEAST and SSL Recognition Attacks.

3

The scheme itself seems pretty standard, so it should be secure, if defined and implemented correctly. A simple textual descripion as you have provided here is not enough to prove your protocol secure. The authentication part only describes the RSA algorithm and key size - it does not specify how trust is established, nor does it define how the session keys ...

3

There are various adversary models, in fact it is typical to test our schemes against multiple adversaries to prove various nuances of security. The most intuitive of all is an adversary that can produce the plaintext (or a part of it) given only the ciphertext. An extension to this model, stronger than the other, is the one you mentioned, letting the ...

2

A quick glance at their most recent paper shows some security analysis. Secton 2 talks about some different threats, what guarantees they can provide, etc. Section 8.3 also evaluates the security of the system. This may or may not be what you are looking for, you'd have to decide for your self.

2

The resume of that other answer could be: When you have a password hashed, it's hard (very hard) to find out what was the original password: you have to try all combinations, until you find the hash. That's brute-force. Someone can speed up a bit this process, by pre-computing many passwords: he'll store all those passwords / hashes, and will try to find ...

2

The idea you describe is vulnerable to a meet-in-the-middle attack that work in approximately $2^{128}$ time and $2^{128}$ memory. The attack assumes knowledge of plaintext/ciphertext pair(s). Given a pair, you encrypt the plaintext with every possible key 1 and store those values. You then decrypt the ciphertext with every possible key 2 and look for a ...

1

Security properties of hash functions are generally concerned with collision resistance, but preimage resistance is also important. For most common hash functions with an $n$-bit digest size, a successful preimage attack has generic $2^n$ maximum complexity, and a successful collision attack has generic $2^{n/2}$ maximum complexity. Most common hash ...

1

As already discussed by @fgrieu in his answer and myself in the comments of your question and his answer, the standard notion of security of digital signature schemes, namely (strong) existential unforgeability under adaptively chosen message attacks (UF-CMA), does not cover the case you are concerned about. At least for hash-then-sign signatures built ...

1

If the salt value is not secret and may be generated at random and stored with the password hash, a large salt value prevents precomputation attacks, including rainbow tables, by ensuring that each user's password is hashed uniquely. This means that two users with the same password will have different password hashes (assuming different salts are used). In ...

1

According to some sources, NSA is actually able to perform man-in-the-middle attacks using fake certificates to impersonate websites. Some people said that they somehow managed to hack a CA and stole compromised certificates. Since SSL/TLS relies mainly on certificates for authentication. With a valid "spoofed" certificate, users are easily tricked into ...

1

Digital signatures provide authentication, data integrity and non-repudiation. Thus, you are right to say that the authentication check is also basically an integrity check. If it didn't have an integrity check (i.e. no digital signatures) then you cannot be sure that the message you received is the original and unmodified version sent by the claimed sender. ...

1

The scheme as you describe it in itself may be secure in some (especially) theoretical environment. However, I don't suggest to use it, because any attempt to use of values passed between the peers can possibly undermine the security of the scheme as can e.g. insecure RNGs. I have expressed a few concerns below. I'm bit concerned about calling the scheme ...

1

I found this information which may be useful for you: Is encrypting twice good or bad? Does encrypting twice using the same block cipher produce a security weakness? Is there any benefit to encrypting twice with pgp? The general rule as far as I know, is that encrypting twice (regardless if its using the same cipher or not) is rarely ever going to ...

1

The "tricks" are Build "arbitrary-size FPE with associated data" by using S2V$\:\:$($\:\:$master_key$\:\:$,$\:\:$associated_data || plaintext_length$\:\:$) as the key for format-preserving encryptions with a disjoint domain for each possible $\:$ plaintext_length . and Map pairs $\:\langle$nonce,plaintext$\rangle\:$ into the domain determined by the ...

Only top voted, non community-wiki answers of a minimum length are eligible