# Tag Info

19

17

It's a good question. As pg1989 said, this is the basis behind stream ciphers, which are very fast in practice. I thought I'd quickly expand upon your statement that "the one-time pad is the perfect cipher and impossible to crack." This is true, in a sense, but it's worth pointing out that sometimes an attacker wants to do something simpler than "cracking" ...

13

Most hashes are built from permutations (either keyed permutations/block-ciphers, as in MD5, SHA-1 and SHA-2, or unkeyed permutations as in Keccak/SHA-3 and CubeHash). A permutation is a shuffling of the inputs. Once you have a good random permutation, you can easily build a hash from it. See Construction of One-way compression functions from block ciphers ...

9

I think you misunderstood a detail of PGP encryption. Only the random symmetric key is encrypted under the recipient's (asymmetric) public key. This way to encrypt stuff is quite common and is called KEM/DEM paradigm: Key Encapsulation Method/Data Encapsulation Method oy Hybrid Encryption. Some refs: en.wikipedia.org/wiki/Hybrid_cryptosystem and ...

9

A PGP encrypted message can be hundreds or even thousands of bytes. Encrypting and decrypting large amounts of data using asymmetric algorithms is extremely slow. Encrypting only 32 to 16 bytes (the symmetric key) is much faster. Additionally, if you encrypt the same message twice with an asymmetric algorithm, you will get the exact same ciphertext. Using ...

8

DES is a block cipher. It consists of a pair of algorithms, one for encryption and one for decryption. Each algorithm takes two inputs: the key, and the block to encrypt or decrypt; the output is the encrypted or decrypted block. For DES, the size of a block is 64 bits. So DES only tells you how to encrypt or decrypt data that consists of exactly 64 bits. ...

6

Handing keys in general is known as key management. Symmetric keys should be kept secret. Secret key is often used as a synonym for symmetric key. The establishment of symmetric keys can be performed in several ways: (Authenticated) Key Agreement (KA) Sending of an (authenticated) encrypted key, also known as key wrapping Derivation from a base key using ...

6

In hash functions (and similarly block ciphers) each round applies a non-linear function to its input. This function is somewhat difficult to calculate backwards (and it needs a few other properties, but let's leave it at that). This concept is called diffusion. On the other side, one of the goals of cryptanalysis is to reverse this diffusion in order to ...

5

From Schneier's description of DES in Chapter 12 of Applied Cryptography (12.3): “DES with any number of rounds fewer than 16 could be broken with a known-plaintext attack more efficiently than by a brute-force attack.” This explains the "Why not less than 16". As for the "why not more than 16", that is a tradeoff for speed of execution (more rounds = less ...

5

Most vulnerabilities in block ciphers are related to key security. Successful attacks have not been practical against anything except smaller keysizes than 256 bits or fewer rounds of encryption. Since there are no variables to be selected for AES except the S-box and the P-box, the Holy Grail is key management. Lateral attacks against AES rely on bad ...

5

If using a cryptographically-secure random number generator then the result is a stream cipher. If using actual random numbers, then it's a one-time pad. Any output you get from a random source needs to be run through a randomness extractor anyway in a 2:1 ratio (2 bits in, 1 bit out). Don't forget to provide a MAC along with the ciphertext to prevent an ...

5

Congratulations you just reinvented the stream cipher. The main strength of the one-time pad is that the key space is as large as the message space. This means that any cipher-text only attacks always fail because all plaintexts are valid. This automatically means that any construct that decreases the key space (like using a seed for a PRNG) severely ...

5

The S-Box was generated when Rijndael was designed, not in any step. It's used in every round in the SubBytes step. The S-box is constant. You could see it as a function taking a byte and returning a byte. It is used to reduce algebraic properties of Rijndael. In fact, this is it: | 0 1 2 3 4 5 6 7 8 9 a b c d e f ...

5

I'm not really sure what your geo-location and time stamp key is really giving you above one well selected 128-bit key. Let's say you're resolving the GPS co-ordinates to an accuracy of one metre. There are approximately $5 \times 10^{14}$ unique square metres of the Earth. We can probably safely exclude $2 \over 3$'rds of those metres on the basis that ...

5

Given: The attacker can call PRP() and the inverse function prp() on any message of his choosing. PRP is a pseudorandom permutation indistinguishable to the attacker from a random permutation. Assuming R and K are "sufficiently large", perfectly random, and never leaked to the attacker -- in particular, during a chosen-ciphertext attack, the decryptor only ...

5

We need clear goals. The question asks for "plausible deniability" or "deniable encryption", and these terms needs a precise definition in a public-key context (implied by RSA). I assume that in addition to the IND-CPA and IND-CCA1 properties of a cipher, including hybrid (as implied by AES), it is desired that: One without the private key can't ...

5

Symmetric encryption is no longer necessary, because all security services can be implemented with public-key cryptography. No. The speed of asymmetric encryption is prohibitive when it comes to encrypting more than a few hundred bits of data. This is why most protocols that implement encryption with asymmetric cryptography are hybrid, using asymmetric ...

5

Quite apart from the correction that Reid made (it takes $2^{127}$ attempts to achieve a probability of 50% of finding the right key; with $2^{64}$ attempts, the probability of success is $2^{-64}$), with AES, there is no known way to take advantage of known (or even chosen) plaintext to speed up any brute force search; even with $2^{64}$ chosen ...

4

KEM/DEM hybrid encryption has another advantage. It enables a very efficient multi-recipient encryption. The payload is encrypted and transmitted only one time. Haven't you wondered yet why you are able to decrypt and read your own message although it was encrypted with the recipient's public key? Normally PGP encrypts the message key for symmetric ...

4

From what I understand from your question, you are describing a stream cipher. If the one-time pad is the perfect cipher and impossible to crack, why would the following algorithm not be one of the strongest ... You're on the right track; a one-time pad is essentially a perfect (unbreakable) stream cipher. Without going into (any) mathematical ...

4

You elaborated that your goal is to make it possible to decrypt a message successfully "only when the device is in a specific location". Great goal, but yeah, well, the particular scheme you describe in your question ain't gonna work. Someone who is not physically at the specific location, but who knows where the specific location is, can still infer the ...

4

Non-authenticated symmetric encryption schemes are generally malleable, meaning that an attacker who intercepts a message may be able to modify it even without knowing the key, e.g. by flipping arbitrary bits in it. A MAC prevents such attacks by detecting any modifications made to the ciphertext. Also, there are various chosen-ciphertext attacks that work ...

4

Ciphers with Arbitrary Finite Domains by Black and Rogaway have some options like Prefix Ciphers, Generalized Feistel networks , Cycle walking etc. Also Format preserving encryption has traits that you are looking for , but NIST standardized ones are patented by Voltage Inc. In general Feistel networks + Cycle walking would give a good option for any ...

4

Yes, absolutely. Here is the standard construction to address this problem. Let $pk_1,\dots,pk_n$ be the public keys of the $n$ recipients. We pick a random symmetric key $k$, encrypt the message $m$ (using authenticated encryption) under key $k$ to get $c=AE_k(m)$, and then encrypt $k$ under each of the public keys. Finally, we form the whole ciphertext ...

4

The idea you have is: lets say we have a known plaintext/ciphertext pair; can we use a precomputed table to speed up the recovery of the key? Well, the main problem with that precomputed tables don't actually speed up the search time, if you count the time taken to generate the precomputed table. What the table precomputation does is (for example) generate ...

3

It will depend on the exact system. The cryptosystem of Castelluccia is additively homomorphic and is thus a PHE cipher. The cipher of Domingo-Ferrer was broken by Wagner and others. Thus, I wouldn't classify it as either. The cipher of Xiao, et al. is fully homomorphic. To determine if a symmetric scheme is a PHE or FHE, just look at what operations it ...

3

This appears to be describing an attack that allows an active attacker to defeat a seemingly-secure protocol. In the normal setting where no one is attacking them, Alice and Bob share a password $W$; Alice derives a symmetric key $K$ from the password $W$ and encrypts her message with $K$, then sends it to Bob; now Bob can derive the same key (since he ...

3

The key must be kept secret or it is no longer an encryption system. They key must be shared at some point, when is not important, but how is, and how determines when. You can send encrypted messages to someone, then hand them the key on a post-it note at a later point in time so they can decode it, or on a flash drive, or some other physical handoff or ...

3

This is indeed a good question; let me try to make it a bit more precise. Suppose: Alice has a plaintext message of some number of bits, call it p. Alice and Bob share a crypto-strength random number generator that generates n truly random bits. Alice and Bob share a pseudo-random number generator that can take a seed of size n and produce one of 2n ...

3

Occasionally, for instance in very constrained environment, it can be useful to use only a few cryptographic primitives for all processing. (When you only have a hammer everything looks like a nail.) In such environments, it may be useful to use key derivation function to derive stream to be used as a stream cipher, or use hash function as cipher and so on. ...

Only top voted, non community-wiki answers of a minimum length are eligible