# Tag Info

20

It's important to make the distinction between ciphers which use XOR internally as a component operation (which is nearly all of them), and 'ciphers' which just XOR the plaintext with a secret. If the key is the same length as the plaintext, then it's a one time pad, so in some sense, yes, with "sufficient randomness" you can safely encrypt with XOR. The ...

10

Yes, you are remembering correctly. Yes, this is a reasonable method to find the key length. The reason why this works is because, typically, the plaintext is not uniformly random. For instance, rather than a random bit-string, the plaintext might be some English text, encoded in ASCII. If $X,Y$ represent two random English letters, encoded in ASCII, ...

10

The combination between addition modulo $2^{32}$ (not modulo $32 = 2^5$) - indicated by $\boxplus$ in the diagram - and XOR (i.e. bitwise addition modulo $2$) - indicated by $\oplus$ - makes the algorithm more non-linear. Each of them for itself is a linear operation, but over different groups (addition in $GF(2^{32})$ vs. addition in $Z/2^{32})$, and the ...

9

If the key used to XOR your plaintext is any shorter than your plaintext, then the repeats will give it away. If the key is truely random, and never reused, it is effectively a one-time-pad. The historical name for XOR encryption is Vernam cipher. is there something inherently wrong with XOR based ciphers The amount of effort you need to put into ...

9

Not at all secure; generating preimages would be trivial. Here's a demonstration with a three-block message: Here is your suggested method (limited to three block messages): $E_0 = Encrypt( IV \oplus P_0 )$ $E_1 = Encrypt( E_0 \oplus P_1 )$ $E_2 = Encrypt( E_1 \oplus P_2 )$ $E_3 = Encrypt( E_2 \oplus 0 )$ $Hash = E_0 \oplus E_1 \oplus E_2 \oplus E_3$ ...

9

The name I would use for this protocol is "broken". It is insecure. An eavesdropper gets to observe $Q_0 = P \oplus CM$, $Q_1 = Q_0 \oplus SM = P \oplus CM \oplus SM$, and $Q_2 = Q_1 \oplus CM = P \oplus SM$. Notice that we have the relation $$Q_0 \oplus Q_1 \oplus Q_2 = (P \oplus CM) \oplus (P \oplus CM \oplus SM) \oplus (P \oplus SM) = P.$$ Therefore, ...

9

Within the DES block cipher itself, the XOR operation is used at two different places: On the input of S-boxes, XOR-ing 48 bits per round: 48 bits from a subkey (extracted from the 56-bit key), and 48 bits that are the output of expansion E. The 48-bit result forms the eight 6-bit inputs of the S-boxes. On the output of S-boxes, XOR-ing 32 bits per round: ...

9

On software platforms, bytewise adding will not be faster than bitwise XORing. It may be a bit slower, though, also this will be negligible with regards to the process which generated the stream (and, for that matter, will probably also be negligible with regards to the memory bandwidth). On hardware platforms (FPGA, dedicated ASIC), addition is slower than ...

6

The encryption scheme seems to be: re-use an existing 128-bit secret, originally used to unlock a read-prevention mechanism, as the 128-bit key; split the plaintext (data to protect from prying eyes) into 128-bit blocks; XOR each block with that 128-bit key. That approach is flawed. Two cardinal mistakes are made: Use XOR with a keystream that repeats. ...

5

What do you mean 'a one time pad with a password'? One time pads don't take passwords, they take samples of truly random data as long as the message. If what you're doing is taking the password, repeating it N times, and using that as if it were a random one-time pad, well, that can usually be broken even if you don't send a second message. If what you're ...

5

The inequality is obtained by a distance argument. Consider two points $X,Y$ on the real line. Taking another point $Z$, you have $|X-Z| + |Y-Z| \geq |X-Z+Z-Y| = |X-Y|$. Applying this "triangle" inequality to your equality 1, we have for any $z \in \mathbb{R}$, $\begin{array}{l} \bigl\lvert\Pr[A(x\oplus g(U_n))=1] - z\bigr\rvert + \bigl\lvert ... 5 You can use any invertible operation to apply the key stream to the plaintext for encryption (and use the inverse to apply the key stream to the ciphertext for decryption). Addition/subtraction are such a pair, but you have to take care for the carry - either use it$\bmod 256$(i.e. byte-wise), or use it$\bmod 2^n$with$n$some block size in bits. Make ... 5 The short answer is no. The scheme gives poor protection against collisions, that is inputs detected as having the same content (within order) when they have not. As noted in the question, this can occur when entries in an input are duplicated; e.g. ("O","X","O") and ("X") collide. This can also occur for maliciously crafted entries. For a start, MD5 is ... 5 What you are proposing in effect means that you use a not-really-random one-time-pad, which is used twice (i.e. a two-times-pad). This is not secure. Using a single hash to generate a key from a password is a bad idea - especially if the password is short, it is easy to brute-force it (i.e. try lots of passwords). Using the simple XOR cipher to encrypt a ... 5 To answer your question: no this is not homomorphic encryption because one of the plaintexts is used unencrypted. There may be times when it is a useful property, but the only uses I know of it are to demonstrate the malleability of xor ciphers. To be a homomorphic encryption function, it should be possible to calculate the encryption of some function of ... 4 This looks totally weak. If you know 128 bits of known plaintext, you can infer the corresponding 128 bits of keystream. The keystream being the multiplication of the random matrix by the key (in the vector space$\mathbb{F}_2^{128}$), the key is then revealed through a basic matrix inversion. 4 I've got a feeling that I'm going to write this a lot on here: define "sufficient". The question you must answer is "what do you want to protect and how much is it worth to you"? In general, a plain XOR cypher with a key shorter than the total plaintext encrypted is pretty weak, and methods for decrypting are more or less trivial. So if there's a lot of ... 4 We typically refer to a homomorphic cipher if we can take two ciphertexts and combine them in a way that has a predictible result on the plaintexts. In your example you have taken one ciphertext and one plaintext. Using a stream cipher correctly you should never have 2 ciphertexts encrypted with the same portion of a keystream. So, combining two ciphertexts ... 3 Occasionally, for instance in very constrained environment, it can be useful to use only a few cryptographic primitives for all processing. (When you only have a hammer everything looks like a nail.) In such environments, it may be useful to use key derivation function to derive stream to be used as a stream cipher, or use hash function as cipher and so on. ... 3 For most purposes, you probably don't need to provide confidentiality protection for the version field. There may be some settings where the version field allow traffic analysis, and to analyze that, we'd need to know so much detailed information about your particular protocol that the question would probably become too localized to be a good fit for this ... 3 The most known example of just XOR would be the One-time pad (or at least, one of its implementations). It just takes a random key stream and XORs it with the plaintext stream to create the cipherstream. The one-time pad is also the only provably perfect cipher, where knowing any amount of ciphertext and plaintext does not help to know any single additional ... 3 If I understand right, your operation effectively is $$\forall i: c_i = p_i \oplus k_0 \oplus k_1 \oplus k_2 \oplus \dots \oplus k_n,$$ whith$c_i$the ciphertext bits,$p_i$the plaintext bits, and$k_j$the key bits. As$\oplus$(this is XOR) is associative, this is equivalent to $$k^* := k_0 \oplus k_1 \oplus k_2 \oplus \dots \oplus k_n,$$ $$\forall ... 3 There are two points to consider here: How likely is it that two different strings give the same MD5 hash? This is known as a hash collision. A good hash function makes this probability as small as possible (this would be about 1/2^{128} for MD5). If you have a larger number of strings to hash, the probability of any collision between any of them grows ... 3 XOR operations, fixed bit movements (as in taking the 2 topmost bits or concatenating bits etc.) and data dependent rotations form a functional complete set of operations. This means that you can realize any function between fixed length binary strings, including all possible blockciphers, using them. To show that these operations form a functional complete ... 3 This is called an Even-Mansour cipher. Actually, for the differential cryptanalysis it does not matter what sort of difference you use, you only need that it propagates deterministically through linear transformations (whatever linearity means). In this case you use a difference modulo 2^{32}:$$ A \boxminus B \equiv (A-B)\pmod{2^{32}}.$$You compute ... 2 If$K$is random and you only know$A$or$B$(but not both) then, no, there is no way to infer anything about the key - this is the (in)famous one-time-pad. If you know$A$and$B$, then you can recover$K$very easily. Exclusive-or has those properties:$\forall n$,$~~~~ n \oplus n = 0\forall n$,$~~~~ n \oplus 0 = n$(identity element)$\forall a, ...

2

Unless you are badly (and I mean truly badly) misrepresenting the idea, it is one of the worse ideas I've seen in crypto in quite some time. The first bit is effectively exclusive or'ed with the parity of the key; the ciphertext bit will be either the plaintext bit (if the key has an even number of '1' bits) or the complement of the first plaintext bit (if ...

2

If you have known plaintext, namely one input file that is known in its entirety, this is trivial to break. So I'll explore methods that might lead to a break, if you don't know what's in the input file that was compressed. I suggest that you start by analyzing the DEFLATE stream format carefully (see also these handy notes). This will probably help you ...

2

So a fundamental property of multi-party anonymous systems is you are only anonymous out of the number of honest participants in the system. If the Stasi control everyone else at the dinner table and know they didn't send the message, then they know you did no matter what protocol you use. In your case with this ring topology, because only your two ...

2

The Hamming distance is more effective when you suspect that the plaintext has been XORed with some repeating keystream. That's because XOR works at a bit level, as does the Hamming distance. The Index of Coincidence is more effective when you suspect that the plaintext has been combined with some repeating keystream, where the combiner works ...

Only top voted, non community-wiki answers of a minimum length are eligible