Tag Info

Hot answers tagged

24

Applied Cryptography is book which is becoming, say, not-so-recent. NSA has quite a lot of budget, but not an infinite amount, and there are other organization, in particular big private corporation, which also have impressive means. Google or Apple, for instance, are companies with R&D activity in the area of cryptography, and who are able to ...


20

Well, the standard answer is to preserve compatibility with DES; a hardware circuit that implemented 3DES (with EDE) could also be used to do DES as well (by, say, making all three subkeys the same). Now, there is one slight problem with this straightforward argument; 3DES (EEE, that is, with three encrypt operations) would have this property as well; if we ...


20

(Disclosure: I'm the author of the functionality that you're asking about (good question!).) Ubuntu's Encrypted Home Directory feature uses eCryptfs as the filesystem encryption technology. eCryptfs is a layered filesystem built directly into the Linux kernel. It mounts one directory on top of another. The top directory is really just a "virtual" ...


19

Yes, this is a widely-used cryptographic construction called a stream cipher. For more information about this and other encryption schemes, Coursera's cryptography class is a good resource.


17

There are three efficiency issues to discuss here: CPU, network bandwidth, and functionalities. The "moral" reason of public key encryption being slower than private key encryption is that it must realize a qualitatively harder feature: to be able to publish the encryption key without revealing the decryption key. This requires heavier mathematics, compared ...


17

It's a good question. As pg1989 said, this is the basis behind stream ciphers, which are very fast in practice. I thought I'd quickly expand upon your statement that "the one-time pad is the perfect cipher and impossible to crack." This is true, in a sense, but it's worth pointing out that sometimes an attacker wants to do something simpler than "cracking" ...


14

A block cipher is a family of permutations where the key selects a particular permutation from that family. With a tweakable bockcipher both key and tweak are used to select a permuation. So tweak and key are pretty similar. The main difference are the security and performance requirements for a tweak: Changing a key can be expensive, changing a tweak ...


13

Say you encrypt a message with a key $k$. With symmetric encryption (ie. symmetric ciphers), $k$ must be secret. The sender and recipient must agree (somehow) on $k$. No-one else can be allowed to find out $k$. Anyone else who finds out $k$, can decrypt all the messages encrypted with $k$. For that reason, symmetric ciphers are often called "secret key" ...


13

There are two main reasons why asymmetric cryptography is practically never used to directly encrypt significant amount of data: 1) Size of cryptogram: symmetric encryption does not increase the size of the cryptogram (asymptotically), but asymmetric encryption does. If we take the example of RSAES-OAEP in PKCS#1v2 with a 1024-bit key and 160-bit SHA-1 ...


13

Most hashes are built from permutations (either keyed permutations/block-ciphers, as in MD5, SHA-1 and SHA-2, or unkeyed permutations as in Keccak/SHA-3 and CubeHash). A permutation is a shuffling of the inputs. Once you have a good random permutation, you can easily build a hash from it. See Construction of One-way compression functions from block ciphers ...


11

Blocks ciphers work by applying operations to an $n$-bit block so as to achieve confusion and diffusion. In short, a good block cipher should "mix" the bits of the plaintext and key as thoroughly as possible, so that it becomes practically impossible to recover the key or decipher unknown ciphertext. Now, to achieve confusion and diffusion, there are a few ...


10

Symmetric encryption and asymmetric encryption algorithms are built upon vastly different mathematical constructs. In typical symmetric encryption algorithms, the key is quite literally just a random number in $\left[0 .. 2^n\right]$, where $n$ is the key length. The strength of the key is based upon its resistance to brute-force attacks, where an attacker ...


10

In complete honesty: if you have to ask this question, it's overwhelmingly unlikely that you have actually succeeded in breaking the security of AES. At best, you may have discovered a well-known attack against misuse of particular block cipher modes; for instance, plaintext recovery with a chosen-ciphertext attack against ECB, or blind manipulation of the ...


9

Padding None can be used with stream cyphers and AES-CTR in order to keep the cyphertext the same length as the plaintext. Padding Zeros cannot always be reliably removed, and so should be avoided. Any of the others can be reliably removed and are fine for use. Padding None leaks information about the length of the plaintext. Apart from that there is no ...


9

You can use bcrypt to derive a (long enough) key from your initial secret value, and then use the key for symmetric encryption. "Guessing" the key is an issue only when the key is part of a space of possible keys which is small enough that such guessing is a possibility -- i.e. when the "secret value" is a password. A 128-bit uniformly random key is immune ...


9

A PGP encrypted message can be hundreds or even thousands of bytes. Encrypting and decrypting large amounts of data using asymmetric algorithms is extremely slow. Encrypting only 32 to 16 bytes (the symmetric key) is much faster. Additionally, if you encrypt the same message twice with an asymmetric algorithm, you will get the exact same ciphertext. Using ...


9

I think you misunderstood a detail of PGP encryption. Only the random symmetric key is encrypted under the recipient's (asymmetric) public key. This way to encrypt stuff is quite common and is called KEM/DEM paradigm: Key Encapsulation Method/Data Encapsulation Method oy Hybrid Encryption. Some refs: en.wikipedia.org/wiki/Hybrid_cryptosystem and ...


8

I really don't have an answer (other than saying that storing a hash of the password is good as any other way of solving your immediate problem; there are other ways, but they all allow an attacker to run a dictionary attack on the database). On the other hand, I do have these comments on what you're doing: If getting decrypted gibberish will really crash ...


8

One major reason is that modular arithmetic allows us to easily create groups, rings and fields which are fundamental building blocks of most modern public-key cryptosystems. For example, Diffie-Hellman uses the multiplicative group of integers modulo a prime $p$. There are other groups which would work (i.e., certain elliptic curves).


8

DES is a block cipher. It consists of a pair of algorithms, one for encryption and one for decryption. Each algorithm takes two inputs: the key, and the block to encrypt or decrypt; the output is the encrypted or decrypted block. For DES, the size of a block is 64 bits. So DES only tells you how to encrypt or decrypt data that consists of exactly 64 bits. ...


8

From Schneier's description of DES in Chapter 12 of Applied Cryptography (12.3): DES with any number of rounds fewer than 16 could be broken with a known-plaintext attack more efficiently than by a brute-force attack. This explains the "Why not less than 16". As for the "why not more than 16", that is a tradeoff for speed of execution (more rounds = ...


7

No, they do not gain an advantage; part of the definition of IV is "information that is used to encrypt data which can be sent in the clear". In fact, it is actually rather common to send the IV along with the encrypted message. TLS version 1.1, IPsec, IKEv2 are all protocols that do that. In CBC mode (which you didn't specifically ask about, but it is ...


7

As @David Schwartz said, using something like 3AES should work to scale up the security (but see my comment on the meet-in-the-middle attack). But seriously, why would you even need 512-bits of security in a symmetric algorithm? According to the analysis on wikipedia it would take 50,955,671,114,250,100,000,000,000,000,000,000,000,000,000,000,000,000 years ...


7

A reason to use CBC (or CFB) over CTR and OFB could be that they are a bit more misuse-resistant: If you use CBC with a repeated initialization vector, a (read-only) attacker only can get the fact that the plaintexts are equal up to some block, and not much more (and from the first different block the rest is different). With CTR and OFB, a repeated ...


7

A few reasons: As mentioned, modular arithmetic allows groups. See @mikeazo's answer. Cryptography requires hard problems. Some problems become hard with modular arithmetic. For example, logarithms are easy to compute over all integers (and reals), but can become hard to compute when you introduce a modular reduction. Similarly with finding roots. ...


7

I suspect that KCV's are in general not used because they don't add enough to be worth the small overhead. There are a number of cryptographical attacks on encrypted methods that involve the attacker modifying a valid ciphertext, and then having the receiver decrypt the modified message (and watch how the receiver reacts). Because of these attacks, it is ...


7

Yes, this is a fine approach. This sort of technique is known as "key separation". Since your master key is a cryptographically secure key, you do not need to use a large iteration count. Also, you could use any PRF, in place of PBKDF2. (The iteration count is normally used if you are applying PBKDF2 to a passphrase, instead of a cryptographically secure ...


6

For asymmetric encryption such as embodied by RSA, the "key length" is conventionally taken to be the length of one of the public key elements. Such a key is highly structured (only a very few sequences of bits of that length are valid keys) and security relies on robustness of this structure with regards to some specific analysis algorithms. E.g., in RSA, ...


6

The usual ways to check that a user-supplied encryption key is correct are to either: store a (salted) hash of the key, and check that it matches, or encrypt a (partially) known block of data with the key and check that the decrypted output has the expected form. The former method is exactly same as what your OS, for example, does to verify that you ...


6

If you go through the math, it appears that exactly the expected amount of ciphertext expansion is happening. Here's what's happening: The GCM takes the plaintext as a byte string of size N, and generates a ciphertext which is a byte string of size N+28, where 12 of the 28 is the nonce, and the other 16 is the authentication tag. Then, that octet string ...



Only top voted, non community-wiki answers of a minimum length are eligible