Linked Questions
45 questions linked to/from How reassuring is 64-bit (in)security?
79
votes
1
answer
50k
views
How easy is it in 2022 to find a SHA1 collision?
Most of the answers I can find date to years back where the first collision(s) were found, but hardware mainly GPUs have progressed a lot in the past few years (with for example the new line of 3090s ...
- 799
37
votes
3
answers
8k
views
Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?
Note: I am not advocating anyone continues using SHA1-signed certificates: they are dead as far as security is concerned and should no longer be used. I'm just trying to clarify my understanding of ...
- 473
18
votes
3
answers
26k
views
Has AES-128 been fully broken?
Has AES-128 been broken over the full 10 rounds? If so, by what means? By a commercial entity? By a supercomputer?
If not, why is AES-256 used to replace AES-128 so frequently?
- 303
17
votes
3
answers
14k
views
After Google's collision attack, is RSA-SHA1 signature still safe?
Google succeeded to get a collision in SHA-1 last year in an attack called shattered. Does this fact make certificates based RSA-SHA1 Signature risky for creating fraud certificates?
If RSA-SHA1 ...
- 175
5
votes
5
answers
5k
views
Why is a too fast hash function not secure?
I understand why we need hash functions to be fast enough for processing but slow enough for security. But I do not get why a very fast hash function can cause a collision. My guess is that a very ...
- 85
9
votes
3
answers
19k
views
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.
Can I recover that key?
If, how big does the list of plaintext ...
- 201
18
votes
1
answer
13k
views
In 2020, SHA-1 practically broken in chosen-prefix collision (CP-collision). Can double SHA-1 hashing prevent CP-collision?
In a recent study SHA-1 is a Shambles - First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust by Gaëtan Leurent and Thomas Peyrin. 2020, they showed the first practical chosen-...
- 49.5k
8
votes
2
answers
2k
views
SHA-512 - How difficult is it to find a hash digest beginning with at least twelve zeros?
I know it's possible to find a hash value with multiple zeroes in it, I know of some BitCoin hashes with it, but how difficult is it to find/create a hash digest with 12 or more leading hex zeroes in ...
- 81
8
votes
2
answers
4k
views
Argon2 for both password storage and key derivation
Is using Argon2 for both password storage and key derivation secure? I'm planning on using different salt values, of course.
The basic concept is something like this:
Alice has some secret data ($...
- 83
4
votes
2
answers
4k
views
Is it hypocritical to use AES-256 and RSA 2048 in the same application?
I see a common claim that AES-256 is the gold standard and is good future proofing, often in the same wind as "just use 2048-bit keys for RSA". Security documents seem to recommend both AES-256 and ...
- 237
2
votes
5
answers
3k
views
Is it theoretically possible to create an unbreakable cipher?
I know this question might sound strange, but is it theoretically possible to create an unbreakable cipher if we don't consider bruteforce? Some of us believe that it is possible to create ciphers and ...
- 469
4
votes
1
answer
2k
views
Is Mega.nz encryption vulnerable to brute force cracking by quantum computers?
I am interested in Mega.nz cloud storage.
It is using end-to-end encryption.
It says that it uses AES-128 to encrypt files
And there are more details in their white paper
But I saw that quantum ...
- 43
2
votes
3
answers
2k
views
3DES security when K1=K3
I am mainly looking for security on 2-key $\operatorname{3DES}$ implementation where $K_1=K_3$.
How hard or easy is it to crack $\operatorname{3DES}$ when $K_1=K_3$?
- 670
1
vote
2
answers
4k
views
How weak is using AES with a 128 bit key but 64 bits of the secret key are public constants?
Respected community,
I was wondering how weak would AES-128 be, if we provide only a 64 bit key with the other remaining 64 bits either zero bits or public constants, known to the attacker.
Is it easy ...
- 1,080
2
votes
2
answers
1k
views
80-bit vs 128-bit security in today's world
In today's world of applications, I see a lot of the time a 256-bit encryption key is used, but what about an 80 or 128? What makes 256 the one to use. Is a 80 or 128 easily decrypted?
Are comp ...
- 21
1
vote
2
answers
1k
views
Recovery Passphrase Collission for BIP-39 and BIP-44
Referring to the standards of [BIP-39] and [BIP-44]: a 'master password' consisting of 12 words uniformly selected from a 2048-word dictionary corresponds to 128 bits of entropy, that is then used as ...
- 357
7
votes
4
answers
585
views
Can I replace SHA-1 with SHA-512/160 to address Shambles?
The destination is software (within a remote trust boundary) that expects SHA-1 results. Would it be safer for the source (that's within my own trust boundary) to replace my SHA-1 computation at my ...
- 81
2
votes
1
answer
6k
views
How long would it take to brute force a 32 or 16 bit integer and which type of processor would brute force this in the shortest period of time
I was actually wondering... How long would it take to crack/brute force a 32 bit key/encryption and a 16 bit key/encryptions respectively on a 4GHZ and a 2GHZ PC. I know that a 32 bit integer has 4,...
- 35
1
vote
1
answer
2k
views
80-bit security and attack time
Many designer claimed that their cryptography scheme has 80-bit security. So how to calculate the time of attcking this 80-bit security cryptography scheme, such as 80-bit security RSA using a kind of ...
- 341
4
votes
1
answer
2k
views
Worth taking performance hit of HMAC to gain additional security?
It seems like SHA-512 truncated to 256 bits is usable as a MAC [1]. The advantage is that it's ~50% faster than HMAC-SHA-256 on 64-bit CPUs and ~50% faster than HMAC-SHA-512 on short inputs. (My use ...
- 351
1
vote
4
answers
2k
views
How long would it take all of the supercomputers or cloud computing on Earth to bruteforce a significantly long password?
I was arguing with a colleague who thinks that SHA256 (password + 64 character static salt) is "insecure." My argument is that nothing in cryptography is "secure," it's all a ...
2
votes
1
answer
1k
views
SHA-256 security for initial 32 bits
I have concerns regarding truncated SHA-256 hashes in an application I am building at the moment:
Nomenclature
secret - the full 256-bit SHA-256 result of hashing ...
1
vote
1
answer
639
views
Given partial key exposure and encryption oracle, can we recover full AES key?
Suppose I have an encryption oracle for AES with some key $k$ (16 bytes) and that I know $n$ bytes of it. Is it possible to recover the rest ($16 - n$) in complexity less than $256^{16-n}$?
- 133
1
vote
1
answer
2k
views
How to calculate time needed for decryption of 64-bit key
I am having trouble figuring out how long it takes to decrypt a 64-bit key, given that a computer can do 1 billion trials per second. I know that there are $2^{64} = 1.844 \times 10^{19}$ possible ...
0
votes
1
answer
924
views
Show that if a fixed key MAC is not collision resistant then the MAC function is not computation resistant for every key K
I'm really having some trouble with this one.
Let $H$ be a MAC function. For every key $K$ we can create an unkeyed hash function (i.e.an MDC) by using $H$ to hash messages with the fixed key $K$. ...
- 61
4
votes
1
answer
845
views
Partial known message pre-image attack on SHA-1
If the last $448$ bits of a SHA-1 block input are known and only the first $64$ bits are unknown, is it possible to do a preimage attack using SAT solvers or something else? Or do I have to brute ...
- 41
1
vote
2
answers
822
views
Hash collisions in sha512 hash of secp256k1 public keys
For a sha512 hash of a secp256k1 public key, how many other public keys could generate that hash? I would assume zero since the key size is equal to the hash length (secp256k1 public keys are 64 bytes,...
- 15
2
votes
1
answer
838
views
Which passphrase length is good so it's hard to break bitcoin's PBKDF2 key?
According to https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#From_mnemonic_to_seed
To create a binary seed from the mnemonic, we use the PBKDF2 function
with a mnemonic sentence (in ...
1
vote
2
answers
429
views
DES - encrypt 3 times - DES(DES(DES, k), k'), k) - stronger than 2DES with 2 different keys?
What if were to use DES in the following way:
For a given plaintext x and key k we will perform: ...
- 223
1
vote
1
answer
307
views
How to make my hash more robust to the brute force?
I'm using PBKDF2 SHA 256 with 100 000 iterations to generate a secret.
I want to increase the cost of brute forcing the passphrase I use to generate the secret.
I'm thinking of using scrypt after ...
3
votes
1
answer
435
views
Do ciphers with a key size of 64 bits still have use under very limited attack models?
If we have a very performance critical interactive session, like a video game, running on a trusted platform (video game console).
If our goal is to prevent exfiltration of up to date information (...
- 140
1
vote
1
answer
446
views
KEY using AES-128, If P is less than 128 bits, padded with 0 and create 128 bits, any problem if average pw length is 6
For communication between the client and the website, use password (P) as the key using AES-128. If P is less than 128 bits, it is padded with 0 to create a 128 bits key. is there any problem with ...
- 11
0
votes
1
answer
456
views
Finding and matching SHA512 Unsalted Hash
We are given a list of possible strings, there are $32^{16}$ ($=2^{80}$) to be exact.
We also have the unsalted SHA512 of the original target string.
How long would it take to go through those ...
- 1
1
vote
1
answer
317
views
Supercomputer to crash hash
For NVIDIA TESLA V100 I know a hashcat performance for SHA1: it is about 17000 MH/s. Performance index for V100 is FP32 5120, FP64 2560.
But what about supercomputers? For example Summit ...
- 197
0
votes
1
answer
267
views
Brute force strategy
I am a beginner in this field, and I was thinking about brute force strategies to break symmetric key encryption.
Let's say we have a block cipher in CTR mode and the key is 56 bits in size. What ...
- 1
1
vote
2
answers
315
views
AES-128 with doubled 8Byte key
Assuming I encrypt data with AES-128 and a random 8-byte key x in the following way:
...
- 51
1
vote
1
answer
189
views
MD5 hash: retrieve an element of a source string
Suppose you have a string, precisely an MD5 hash string, which basically it is computed in the following way:
"element1:element2:element3"
So, in order to get ...
- 21
1
vote
1
answer
228
views
Algorithm/encryption technique which outputs a set number of numerical digits e.g. 20 digits from a given input
What the name of the algorithm/encryption technique which outputs a set number of numerical digits e.g. 20 digits based on some input.
You can input some data e.g. text or numbers but the output is ...
1
vote
1
answer
110
views
Good pre-image resistance value for hash visualization
I want to do "hash visualization", i.e. derive a human-meaningful information from a hash, like a phrase or an avatar. But the current techniques usually don't use many bits, for example tripphrases ...
- 241
1
vote
2
answers
158
views
What is meant by encrypting/decrypting a known plaintext/ciphertext with every possible key in meet-in-the-middle?
I am working on the Meet-in-the-middle attack on 2DES and I have got some questions I am not sure about. I read several websites/articles about it so I have got an idea of what it is and how it works. ...
- 113
1
vote
0
answers
115
views
How reassuring is 64-qubit security?
After we've concluded that 64-bit is an insecurity for classical computers, I think many would like to know, how secure in a perspective view, is 64 quantum bits security.
As we know, the Grover's ...
- 9,795
0
votes
1
answer
87
views
Calculating DES key knowing message before and after encryption [duplicate]
I've 8 bytes before encryption (for example: 01 02 03 04 05 06 07 08) and 8 bytes after DES encryption: ...
- 101
0
votes
0
answers
123
views
Finding the cleartext password given its MD5
Given powerful GPU and PC hardware, is it realistic to recover a password in a few hours given a cleartext's MD5? Max chars are 95, and the maximum length of the password is 15 characters.
- 1
1
vote
1
answer
106
views
Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto
Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto
According to wikipedia AES page, AES is a symmetric-key algorithm.
The algorithm described by AES is a ...
- 111
1
vote
0
answers
63
views
Can Trivium ciphertext be decrypted by an adversary if the key is known, but the IV is not?
Suppose that the adversary is able to recover the key of Trivium cipher. But the associated IV is unknown to him. Will he be able to decrypt the ciphertexts without any complexity?
- 73