# Tag Info

19

17

It's a good question. As pg1989 said, this is the basis behind stream ciphers, which are very fast in practice. I thought I'd quickly expand upon your statement that "the one-time pad is the perfect cipher and impossible to crack." This is true, in a sense, but it's worth pointing out that sometimes an attacker wants to do something simpler than "cracking" ...

13

Most hashes are built from permutations (either keyed permutations/block-ciphers, as in MD5, SHA-1 and SHA-2, or unkeyed permutations as in Keccak/SHA-3 and CubeHash). A permutation is a shuffling of the inputs. Once you have a good random permutation, you can easily build a hash from it. See Construction of One-way compression functions from block ciphers ...

9

I think you misunderstood a detail of PGP encryption. Only the random symmetric key is encrypted under the recipient's (asymmetric) public key. This way to encrypt stuff is quite common and is called KEM/DEM paradigm: Key Encapsulation Method/Data Encapsulation Method oy Hybrid Encryption. Some refs: en.wikipedia.org/wiki/Hybrid_cryptosystem and ...

9

A PGP encrypted message can be hundreds or even thousands of bytes. Encrypting and decrypting large amounts of data using asymmetric algorithms is extremely slow. Encrypting only 32 to 16 bytes (the symmetric key) is much faster. Additionally, if you encrypt the same message twice with an asymmetric algorithm, you will get the exact same ciphertext. Using ...

8

DES is a block cipher. It consists of a pair of algorithms, one for encryption and one for decryption. Each algorithm takes two inputs: the key, and the block to encrypt or decrypt; the output is the encrypted or decrypted block. For DES, the size of a block is 64 bits. So DES only tells you how to encrypt or decrypt data that consists of exactly 64 bits. ...

6

Handing keys in general is known as key management. Symmetric keys should be kept secret. Secret key is often used as a synonym for symmetric key. The establishment of symmetric keys can be performed in several ways: (Authenticated) Key Agreement (KA) Sending of an (authenticated) encrypted key, also known as key wrapping Derivation from a base key using ...

6

In hash functions (and similarly block ciphers) each round applies a non-linear function to its input. This function is somewhat difficult to calculate backwards (and it needs a few other properties, but let's leave it at that). This concept is called diffusion. On the other side, one of the goals of cryptanalysis is to reverse this diffusion in order to ...

5

Camellia is a symmetric block cipher; the same key is used for both encryption and decryption. And, as a block cipher, it can be used in any of the standard modes (CBC, CTR, CFB, GCM, even ECB, although use of ECB for any block cipher is not encouraged).

5

From Schneier's description of DES in Chapter 12 of Applied Cryptography (12.3): “DES with any number of rounds fewer than 16 could be broken with a known-plaintext attack more efficiently than by a brute-force attack.” This explains the "Why not less than 16". As for the "why not more than 16", that is a tradeoff for speed of execution (more rounds = less ...

5

If using a cryptographically-secure random number generator then the result is a stream cipher. If using actual random numbers, then it's a one-time pad. Any output you get from a random source needs to be run through a randomness extractor anyway in a 2:1 ratio (2 bits in, 1 bit out). Don't forget to provide a MAC along with the ciphertext to prevent an ...

5

Congratulations you just reinvented the stream cipher. The main strength of the one-time pad is that the key space is as large as the message space. This means that any cipher-text only attacks always fail because all plaintexts are valid. This automatically means that any construct that decreases the key space (like using a seed for a PRNG) severely ...

5

The S-Box was generated when Rijndael was designed, not in any step. It's used in every round in the SubBytes step. The S-box is constant. You could see it as a function taking a byte and returning a byte. It is used to reduce algebraic properties of Rijndael. In fact, this is it: | 0 1 2 3 4 5 6 7 8 9 a b c d e f ...

5

I'm not really sure what your geo-location and time stamp key is really giving you above one well selected 128-bit key. Let's say you're resolving the GPS co-ordinates to an accuracy of one metre. There are approximately $5 \times 10^{14}$ unique square metres of the Earth. We can probably safely exclude $2 \over 3$'rds of those metres on the basis that ...

5

Given: The attacker can call PRP() and the inverse function prp() on any message of his choosing. PRP is a pseudorandom permutation indistinguishable to the attacker from a random permutation. Assuming R and K are "sufficiently large", perfectly random, and never leaked to the attacker -- in particular, during a chosen-ciphertext attack, the decryptor only ...

5

We need clear goals. The question asks for "plausible deniability" or "deniable encryption", and these terms needs a precise definition in a public-key context (implied by RSA). I assume that in addition to the IND-CPA and IND-CCA1 properties of a cipher, including hybrid (as implied by AES), it is desired that: One without the private key can't ...

5

Symmetric encryption is no longer necessary, because all security services can be implemented with public-key cryptography. No. The speed of asymmetric encryption is prohibitive when it comes to encrypting more than a few hundred bits of data. This is why most protocols that implement encryption with asymmetric cryptography are hybrid, using asymmetric ...

5

Quite apart from the correction that Reid made (it takes $2^{127}$ attempts to achieve a probability of 50% of finding the right key; with $2^{64}$ attempts, the probability of success is $2^{-64}$), with AES, there is no known way to take advantage of known (or even chosen) plaintext to speed up any brute force search; even with $2^{64}$ chosen ...

5

Yes, we need symmetric cryptosystems, for many reasons; to give three of these: We need a hash function to make most asymmetric cryptosystems secure (e.g. we simply do not have a secure signature system based on RSA without a hash), and current hash functions are (or are built from) symmetric cryptosystems. All asymmetric encryption cryptosystems are bound ...

4

KEM/DEM hybrid encryption has another advantage. It enables a very efficient multi-recipient encryption. The payload is encrypted and transmitted only one time. Haven't you wondered yet why you are able to decrypt and read your own message although it was encrypted with the recipient's public key? Normally PGP encrypts the message key for symmetric ...

4

From what I understand from your question, you are describing a stream cipher. If the one-time pad is the perfect cipher and impossible to crack, why would the following algorithm not be one of the strongest ... You're on the right track; a one-time pad is essentially a perfect (unbreakable) stream cipher. Without going into (any) mathematical ...

4

You elaborated that your goal is to make it possible to decrypt a message successfully "only when the device is in a specific location". Great goal, but yeah, well, the particular scheme you describe in your question ain't gonna work. Someone who is not physically at the specific location, but who knows where the specific location is, can still infer the ...

4

Non-authenticated symmetric encryption schemes are generally malleable, meaning that an attacker who intercepts a message may be able to modify it even without knowing the key, e.g. by flipping arbitrary bits in it. A MAC prevents such attacks by detecting any modifications made to the ciphertext. Also, there are various chosen-ciphertext attacks that work ...

4

Ciphers with Arbitrary Finite Domains by Black and Rogaway have some options like Prefix Ciphers, Generalized Feistel networks , Cycle walking etc. Also Format preserving encryption has traits that you are looking for , but NIST standardized ones are patented by Voltage Inc. In general Feistel networks + Cycle walking would give a good option for any ...

4

Yes, absolutely. Here is the standard construction to address this problem. Let $pk_1,\dots,pk_n$ be the public keys of the $n$ recipients. We pick a random symmetric key $k$, encrypt the message $m$ (using authenticated encryption) under key $k$ to get $c=AE_k(m)$, and then encrypt $k$ under each of the public keys. Finally, we form the whole ciphertext ...

4

The idea you have is: lets say we have a known plaintext/ciphertext pair; can we use a precomputed table to speed up the recovery of the key? Well, the main problem with that precomputed tables don't actually speed up the search time, if you count the time taken to generate the precomputed table. What the table precomputation does is (for example) generate ...

4

For simple XOR-based encryption algorithms such as OTP, the key size must be the same as the message size. If you choose a smaller key and try to divide the message into chunks, you would not have a perfectly secure scheme anymore. Now, since you tagged java, I'm assuming that this increase in time for smaller key sizes is due to the code trying to divide ...

3

The key must be kept secret or it is no longer an encryption system. They key must be shared at some point, when is not important, but how is, and how determines when. You can send encrypted messages to someone, then hand them the key on a post-it note at a later point in time so they can decode it, or on a flash drive, or some other physical handoff or ...

3

GMAC is quite simply GCM mode where all data is supplied as AAD (or additional authenticated data), or as NIST SP 800-38D puts it: If the GCM input is restricted to data that is not to be encrypted, the resulting specialization of GCM, called GMAC, is simply an authentication mode on the input data. If you don't have access to a cryptographic provider ...

3

This is indeed a good question; let me try to make it a bit more precise. Suppose: Alice has a plaintext message of some number of bits, call it p. Alice and Bob share a crypto-strength random number generator that generates n truly random bits. Alice and Bob share a pseudo-random number generator that can take a seed of size n and produce one of 2n ...

Only top voted, non community-wiki answers of a minimum length are eligible