Tag Info

New answers tagged

5

Decrypt the ciphertext with every possible key and store the result: $2^{56}$ decryptions. Now encrypt the (known) plaintext of the ciphertext with every possible key: $2^{56}$ encryptions. You have found the correct key pair if you find a result of the first list in the second list. All in all $2^{56} + 2^{56} = 2^{57}$ operations, not $2^{112}$. Just the ...


2

Key generation and key scheduling are different things. The key scheduling is part of the cipher, the key generation generally isn't. Symmetric keys should be indistinguishable from random, so often they are the product of a secure random number generator. There are other ways as well, such as derivation from a password using a Password Based Key Derivation ...


3

Simply put: No. First recall that this is a mis-use of the term "One Time Pad" So lets call it a vigenere cipher instead. You can determine this is insecure with a simple algebraic combination: $ \text{attack} = cipher_1 + cipher_2 + cipher_3 + cipher_4 \\ \text{Simplify: } \\ \text{attack} = character_1 + key_1 + IV_1 + character_2 + key_2 + IV_1 + ...


1

First, you wouldn't call it a one-time-pad any longer if you reused the key. Second the security of the OTP can only be proven if the key is as long as the message. (which wouldn't be the case if you'd reuse a key) Third, OTP usually use XOR operation to combine key and message. If the key is never reused, you're safe, but if an attacker can mount a known ...


0

If I'm understanding things right you want something that can encrypt data at abritrary size with high speed. You have several options here: CTR mode. This turns any block cipher into a stream cipher allowing you to encrypt arbitrary amounts of data at high speeds. (cipher would be AES-128) a dedicated streamcipher like Salsa20 or ChaCha. They are ...


0

As this question is still on the list of "questions without answers", I'll quickly answer it (Basically repeating all of the above comments). Increase iteration count to something larger (1 Million?) You don't want to attach your HMAC of the plain-text after the contents. Rather authenticate either the ciphertext or (even better) use CCM/EAX/GCM mode. ...


1

The keystream is as long as the message, so you don't want to send that to the receiver. The keystream is generated by a much shorter key (e.g., 128-bit private key). That is what the receiver needs in order to decrypt the message. So, how do you get that to the receiver? Well, clearly you can't just send it in the clear or anyone watching the channel would ...


0

The keystream is not transmitted - if it were, anyone could decrypt it. The stream cipher produces a pseudo-random number sequence based on a given key. If you give it the same key twice, it'll produce the same sequence. As such, if the receiver has the same key as the sender, then he can generate the same keystream and decrypt the message.


1

Anyone who has the keystream and the ciphertext can trivially calculate the plaintext — it's a xor operation bit by bit. Sending the keystream alongside the ciphertext would completely defeat the purpose of encryption. The principle of stream ciphers is that the sender and the receiver agree on an algorithm, a secret key and some parameters, and both ...


5

Here are some hints on how it's done on Mega: The password provided is passed through a KDF to derive a key, that is used to en-/decrypt the master key (later provided by the server through an API call). To bring it down to the crucial bits: The KDF applies $2^{16}$ rounds of AES-128 with it. The details can be found in the function prepare_key() of the ...


8

Review of the paper The paper's goal is to offload to a server the computation of the inverse of a (non-singular) $n\times n$ matrix $X$ of (the floating-point approximation of) real numbers, while keeping $X$ and $X^{-1}$ confidential. Towards that goal, the paper's method is to draw a secret key consisting of two random permutations and $2n$ non-zero ...



Top 50 recent answers are included