# Tag Info

1

The Playfair cipher has a key consisting of a square of $5 \times 5$ letters (usually the J is not used, or I/J are considered one letter). Filling the square can be done in $25!$ ways (pick a letter for left upper corner, a new one for the place next to it, and so on), but then every square has equivalent forms, formed by rotating the columns and/or ...

0

AES-GCM encrypts the plaintext in the Counter Mode. GHASH operates on the resulting ciphertext, so no weakness in GHASH could compromise the confidentiality of plaintext. The GCM authentication is not as strong as that of SHA-256, in particular on short tags. If the tag is $\tau$-bit, an adversary can forge the tag after $2^{\tau/2}$ attempts given the ...

0

You may be interested in reading up on the The TESLA Broadcast Authentication Protocol which uses the one-way key chain concept to achieve authentication. The basic idea of the key chain is to hash a secret key value repeatedly and use the hashes or "keys" in the reverse order for authentication. A simple example would be for Alice to compute ...

-1

I have some thoughts about it. If two persons Alice and Bob are sharing secret symmetric key, which known only by them, then if Bob will send to Alice encrypted with key K, message M, it will be enough for proof that M was really created by Bob. Because only Bob knows secret key K, so only he could to encrypt message M with this key. Only one problem for ...

0

Bob's side seems to be "secure", because Bob generates the session-key which is encrypted with a preshared key (which obviously is not transmitted over an insecure channel). If you dismiss the possibility the easiness of a known plaintext attack the last step saves Bob side. This just saves the messages from Bob to Alice. For the rest of the communication ...

1

If a weak cipher is being used, it could be a possibility that an attacker could gather information about k(R1) and k(R2) and derive the k value. Following which, S could be decrypted with the derived k value. Eavesdropping could take place too. Similarly, a MITM would be possible too.

1

A MITM could note Rn and k(Rn) from one round of this session or a previous session, then replace Bob's k(S) with k(Rn), and continue talking with Alice using Rn as the session key.

1

Under some algorithms, if you are just encrypting (not authenticating with a MAC) S may be manipulated by the adversary and thus he would be able to see all data sent from Alice (he could impersonate Bob).

1

Obvious, but not serious weakness that numbers R1 and R2 will be sent in plain text. This means that MITM is able to modify R1 or R2 so that Alice or Bob will always be failed at authentication, although they have legal key K. I have one suggestion how you can improve this protocol. Just because in the last step of protocol, Bob send only encrypted S, MITM ...

0

Yes, as long as you obey all the total usage limits and choose the IV appropriately (see below). Whilst IV is a general term for any initialisation vector the recent trend has been to use the term 'IV' to refer to a random vector, and "nonce" (a contraction of "n-umber used once") to refer to an input vector that need not be random, but cannot be repeated. ...

1

IV (initial value or initialization vector) is a vague term that describes some kind of starting value for a mode of operation that is known to both parties, and generally sent in the clear with the encrypted data (and known to the attacker) IVs in many modes of operation have specific requirements to that mode. In some modes the requirement is that is ...

-1

usually you two key are involved in any cipher. One for encrypting and the other for decrypting. The terms symmetric and and asymmetric apply to key spaces. symmetric ciphers: The cipher key is as good as the decipher key. If you know one of them, you could derive the other. Sometimes they are even the same. asymmetric ciphers: You can derive the public ...

4

Ciphers with Arbitrary Finite Domains by Black and Rogaway have some options like Prefix Ciphers, Generalized Feistel networks , Cycle walking etc. Also Format preserving encryption has traits that you are looking for , but NIST standardized ones are patented by Voltage Inc. In general Feistel networks + Cycle walking would give a good option for any ...

Top 50 recent answers are included