# Tag Info

5

AES is a block cipher and would return wrong data when a wrong key is used. It only works on a single block of data (16 bytes). The default CBC mode of operation enables you to encrypt multiple blocks of data. The padding then enables you to encrypt plaintexts of arbitrary length. The padding has to be removed somehow after the decryption. You're seeing a ...

5

Let's say the plaintext is English text (or some language that uses the basic latin characters), encoded in Unicode. That means each byte represents one character, and because of the quirks of Unicode, the basic latin characters and typical punctuation marks all have a zero for the most significant bit. To attack your scheme, an attacker would look for ...

4

Some amount of known or controlled plaintext is clearly required for the attacker to get the block cipher output. Actually, that's not much of an issue; we can often get a reasonable amount of known plaintext from real encrypted messages. In fact, the known plaintext for each message doesn't have to be the same, and you don't have to have completely ...

4

If the keys are at least as long as the data (which is confirmed in the comments), and the keys are chosen randomly and independent of each other, no there is no way to get the data. Even if you had infinitely many encryptions. This is because this type of encryption, called the one time pad, is perfectly secure.

3

In general, no. Consider the following perfectly secret probabilistic encryption scheme. Encrypt exactly like a one-time pad. Then, with probability 1/4 add a 0-bit after the ciphertext, and with probability 3/4 add a 1-bit after the ciphertext. For decryption, first throw away the last bit, and then decrypt as in the one-time pad. The ciphertexts in the ...

3

Yes, the principle to use a common password and a unique salt per file with a key derivation function is a good and acceptable practice, as you generate the salt randomly and with the right size. The uniqueness of the salt guarantees a different password per file (actually one password per salt, so: do not reuse a salt, use a csprng). You forgot to mention ...

3

RFC4868 is not the HMAC RFC, which is actually RFC 2104. 4868 refers to the use of HMAC within IPSEC, which is why there is a key length restriction. The maximum length key that can be used internally with HMAC-SHA256 is equal to the block size, 64 bytes or 512 bits. This can be useful in cases where the key is not full entropy such as the shared secret ...

3

GCM is authenticated encryption. As such, it is secure against chosen-plaintext attacks and against chosen-ciphertext attacks. Thus, there is no problem whatsoever with the adversary having access to an encryption oracle. It will not help it at all to break any of the encrypted messages.

2

Which cryptographic algorithm would they want to use? That will really depend on the situation. To select the algorithms one should ask himself (at least) the following questions: Which standards do you trust? Which standard do you have to use? What computations can you afford? Symmetric, or public key based? It again depends on the situation. ...

1

The question why these things are chosen is not really answerable, except by the persons involved at NIST. I don't think there is too much to test though; after you test a few vectors you're testing the hash function rather than the HMAC. A quick test shows the test vector in RFC 4868 2.7.2.1. SHA256 Authentication Test Vectors to be correct, in case you ...

1

Each block of n can be decrypted using frequency analysis, similar to how Caesar ciphers are broken. In the case that n is sufficiently small enough for frequency analysis to be difficult, it can be inferred that non-printable bytes will not show up. This is enough information to mount a very practical attack. This also has the same issue as the WWII enigma ...

1

As fgrieu hints at in the comments, it is not in general possible to find $\operatorname{Enc}$. Otherwise you would be able to break an arbitrary block cipher, because the key of any block cipher can be cast as part of the algorithm instead. Even if you ignore the computational cost, there is no way to find $\operatorname{Enc}$ given values for only one ...

1

An adversary can easily win this game with $\epsilon = 0.5$ when the scheme under examination is any block cipher in ECB mode. Simply set $m_0$ and $m_1$ to the same block value, $q$. This guarantees that you'll get the encryption of $q$ back, which we'll call $r$. Then you can distinguish between $q$ and some other block value with probability $1$ on ...

1

Preliminary on notation: in the question, it seems advisable to change $C=T_{k}M$  to $C=T_{k}(M)$ , and change $M=T^{-1}_{k}C$  to $M={T_k}^{-1}(C)$ it is necessary to change $T_{k}T^{-1}_{k}=I$  to ${T_k}^{-1}\circ T_k=I$ , meaning that the function obtained by applying $T_k$ then its inverse ${T_k}^{-1}$ is identity, with $\forall M, ... 1 I think it covers both symmetric and asymmetric systems. Given a transformation$T_k$, if computing$T^{-1}_k$is easy then this is a symmetric cryptosystem. On the other hand, if this is difficult than it is an asymmetric one. Note that in this case, we are ''hard-coding'' the key$k$inside the transformation. Thus we are just given the transformation ... 1 Your definition only covers symmetric encryption since the same "index"$k$is used in$T_k$and$T^{-1}_k$(i.e., encryption and decryption use the same key) If you want to give a generic definition that covers both types of encryption, you could say that the transformations are$T_k$and$T^{-1}_{k'}$and that in the case of symmetric encryption$k'=k\$.

1

well it probably varies on how you want to access the key, one of the most extreme version could be an HSM which should keep it really safe but is also rather expensive. another way would be encrypting it with a key that just you know with plain AES and storing the base64 somewhere for example, that's what I do for some of them if you want to require ...

Only top voted, non community-wiki answers of a minimum length are eligible