Linked Questions

32
votes
5answers
4k views

What security do Cryptographic Sponges offer against generic quantum attacks?

In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides: Collision resistance up to $2^{256}$ operations Preimage resistance up to $2^{256}$ operations Second ...
17
votes
4answers
9k views

Creating cryptographic algorithms at runtime

Would it be possible to create a program with which to create a cryptographic algorithm (i.e. encryption or hash) using well-known elements of other algorithms in the same way that algorithms "reuse" ...
11
votes
3answers
9k views

Has AES-128 been fully broken?

Has AES-128 been broken over the full 10 rounds? If so, by what means? By a commercial entity? By a supercomputer? If not, why is AES-256 used to replace AES-128 so frequently?
7
votes
3answers
2k views

Will cryptanalysis always stay a relevant topic?

I hope this doesn't look like a silly question. In an age where our current cryptography is often impossible to crack when properly implemented and used, would we be able to decipher anything, for ...
3
votes
1answer
5k views

Why GCM operation mode with AES-128 is recomended and can we use AES-192 and AES-256 with GCM?

It happens that on the internet I often find that AES encryption should use a 128-bit key only if it is used in conjunction with the GCM mode of operation. Why only with 128-bit keys? What happens ...
7
votes
4answers
371 views

Can I replace SHA-1 with SHA-512/160 to address Shambles?

The destination is software (within a remote trust boundary) that expects SHA-1 results. Would it be safer for the source (that's within my own trust boundary) to replace my SHA-1 computation at my ...
8
votes
1answer
448 views

NewHope and NIST's Post-quantum standardization

Where can I find NIST's reasoning to eliminate NewHope from the 3rd round of the post-quantum competition? I see all the lattice KEMs finalists are based on modules. Is being a ring-based KEM ...
1
vote
5answers
410 views

Is it theoretically possible to create an unbreakable cipher?

I know this question might sound strange, but is it theoretically possible to create an unbreakable cipher if we don't consider bruteforce? Some of us believe that it is possible to create ciphers and ...
2
votes
1answer
399 views

Is using AES-256 with a key of less than 256 bits of entropy still quantum-resistant?

Encrypting with AES-256 is widely claimed to be post-quantum secure. But let's take a case where you use an initial key that has less than 256 bits of real entropy. In this example, let's work with a ...
1
vote
2answers
396 views

Scrypt KDF cipher (scrypt CLI) - known vulnerabilities and cryptanalysis?

There is a scrypt cipher that is used for example by some cryptos like LItecoin for their mining algorithm. I never heard of scrypt. I know eg SHA-256 which is well analyzed and considered as secure ...
0
votes
1answer
255 views

Using SHA384 as an asymmetric cipher?

SHA384 is a hash function that can be (and is) used to verify data by checking it. Can it also be used as the background for a public-key crypto system? Here is what I mean: A 48-byte string is ...
2
votes
1answer
122 views

Post quantum security of the BLAKE family

Is there any proof that BLAKE (including 2 and 3) is post-quantum secure? We know that as Merkle–Damgård (with proper padding) preserves collapse sha2 is post-quantum secure. I know that the sponge-...