Reputation
2,576
Top tag
Next privilege 3,500 Rep.
Protect questions
Badges
3 23
Newest
 Explainer
Impact
~49k people reached

Mar
25
comment Authentication using a one-time pad
Have you modeled the value this system is protecting? $2^{32}$ sounds like it would be very simple to brute force attack it. All an attacker needs to do is forge a key offset of 0 for each message, and he has the winning hand. I like @poncho's suggestion of using a minimal-memory strong cypher as both the encryption and hash mechanisms, which gets further away from the roll-your-own nature of the OTP suggestion.
Mar
24
comment Authentication using a one-time pad
Not hare-brained, but you need enough bits in each of message to defend against corrupted or tampered messages, which takes a lot more than 4 bits. You also need to consider how these machines will securely re-sync if a message is lost. Restarting a one-time pad would make it be more than one-time!
Mar
24
comment credit card number encryption using aes-ctr mode
it's been a few years since I've seen them, but they were issued by American banks. I was,also basing my statement on your wording choice of "characters", not digits. 16 characters is 128 bits (ASCII), but you can obviously encode many more digits if you are willing to encode it as a big integer or BCD value. That conversion also risks loss of fidelity in the case where an issuer encodes any other value, such as a driver's license or proprietary gift card.
Mar
24
comment credit card number encryption using aes-ctr mode
Credit card account numbers are 16 digits today only by convention. The ISO standard (7314?) permits card numbers up to 22 digits in length. I've seen some debit card account numbers that are already up to 19 digits in length. I wouldn't recommend coupling the encryption mechanism to an arbitrary attribute controlled by 12,000 random bankers.
Jan
24
comment Fairness in cryptography
By fair, do you mean "cheat proof", where user A might transfer his last bit but not get the final bit in return from user B? Can you edit the question to clarify it?
Jan
11
comment How many bits of entropy would I get from 300 coin tosses?
@user21767, "fair coin" refers to a coin that has an even chance of turning up heads or tails, one that shows no bias over multiple flips. It encompasses the entire process of flipping a coin, including rotations, speed, wind, gravity, whatever; and it is considered fair only if the outcome is statistically unpredictable.
Dec
29
comment I need to know number of encryption/decryption operations?
Oops, sorry, my previous comment should be rewritten as "Meet in the middle attacks take advantage of the small block size used by the primitives."
Oct
19
comment I need to know number of encryption/decryption operations?
2^224 is the brute force answer, but as @Nova posted, certain attacks are possible in certain situations. Those attacks reduce the amount of work needed to recover the key. Meet in the middle attacks take advantage of the small key size used by the primitives. But they require massive amounts of space. An attack requiring 2^112x64 bits of space will need 4.1E22 1TB hard drives to execute. As that's not exactly practical today, attackers still need to trade space for rounds of execution.
Oct
17
comment How do you test randomness?
See @e-sushi 's answer in the duplicate question for several good tests.
Jul
24
comment Vigenère cipher: Security when key length and plaintext length are the same
@owlstead, no, it has to be cryptographically unpredictable. If it's "random to the attacker", just because the attacker can't predict the sequence today doesn't mean he can't discover how to predict it tomorrow.
May
14
comment Special random distribution algorithm
At a brief glance, your problem looks similar to shared secrets. Have you looked at Shamir's Secret Sharing algorithm?
Feb
28
comment Frequency of letters change by the length of the texts?
You can generate your own frequency tables based on samples of related text. If you're decrypting data that came from Alex Corporation, build your sample from their public documents. If you're decoding a Shakespearean code, build your sample from the Bard's plays.
Feb
23
comment Timing Attack on RSA
You can try an attack, but it's certainly not guaranteed to be successful. There are many possible types of attacks. You also don't have to let him repeatedly attack you, you can simply record which servers your system attempts to send the key requests to. Note that this is not a comment on the legality of attacking someone's server - even a criminal's server.
Feb
22
comment Calculating amount of time for brute forcing ciphertext depending on the size of the key
For a fairly handy reference that yields data close to what you need, see keylength.com . It attempts to quantify security in terms of comparisons of key lengths and algorithms.
Dec
13
comment Testing a steganalysis technique on realistic data
This isn't a cryptography question. Perhaps security.stackexchange.com?
Dec
12
comment Certificateless cryptography
@Ravi, if you are simply talking about a two user system, it's possible for the two users to meet and simply exchange public keys; or they could even exchange a secret key and skip all the public key work. In this case, the two parties establish and validate their identities independent of the cryptography; from there, continued possession of the other's key serves as your authentication. In general, public key cryptography looks for ways to avoid establishing individual trust connections, in order to minimize cost or maximize flexibility. But that means all parties must trust a third party.
Dec
12
comment Do test vectors ensure a cipher is free of backdoors?
@TruthSerum, GOST doesn't specify the contents of the S-Boxes, so each implementation can choose their own set. I don't know if it's true that the Soviets deliberately assigned weak S-boxes as pg1989 claimed, but it is known that certain choices for S-boxes can result in a very weak cipher. See en.wikipedia.org/wiki/GOST
Nov
17
comment Can you break a multi language code using Frequency analysis?
Averaging the letter frequencies of each combination of three languages should also yield a series of unique profiles. But to actually make use of them will require a large amount of ciphertext written in the same manner as sources from which the frequency tables were generated. It's not impossible, it will just take 364 times more ciphertext than a single language (number of combinations of 3 of 14 languages).
Nov
12
comment Is there a cryptographic hash function that can be performed with pencil and paper?
You could trust yourself to keep your algorithm secret, so it could safely serve as your "key". But defending it against a couple of colluding web site admins would be harder. Do you consider that a realistic threat model? You could also modify it so you use a different algorithm for high value web site passwords, like banks.
Nov
12
comment How do I cryptanalyze a password field?
I took the liberty of rewriting the question into a more acceptable form, and voted to reopen. @mikeazo would you agree?