Questions tagged [encryption]
Encryption is the process of transforming plaintext using a cipher into ciphertext to make it unreadable to anyone except those possessing the key. Decryption is the process of transforming that ciphertext back into plaintext, using the key.
650
questions with no upvoted or accepted answers
16
votes
0
answers
2k
views
Has Telegram security been significantly improved with MTProto 2.0?
Telegram messenger's original encryption scheme, MTProto 1.0, has been shunned by most cryptographers for a number of reasons, like being vulnerable to IND-CCA attack; being unorthodox in general, ...
- 161
10
votes
0
answers
327
views
Are there any weak nonce-misuse resistant encryption scheme?
Nonce-misuse resistance seems to have two standard notions:
The stronger notion: this reveals nothing unless the exact same nonce is used to encrypt the exact same message twice. In this case, the ...
- 49.3k
10
votes
0
answers
143
views
Offline Group Key Agreement - Cross Device Syncing
I have a specific use case I am interested in. I have spent the better part of the night reading research papers. I am beginning to believe what I want is not possible so I wanted to confirm here.
...
- 201
9
votes
0
answers
1k
views
Key size, performance, and security tradeoffs for AES GCM / CCM
AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
- 255
7
votes
0
answers
361
views
Security proof in (Ciphertext-Policy) Attribute-Based Encryption
I am having hard time understanding the security proof in Attribute-Based Encryption, especially in Ciphertext-Policy Attribute-Based Encryption.
To do reduction in CP-ABE scheme, how do I check that ...
- 71
6
votes
0
answers
137
views
About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?
Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$
with
$$p=(p_1, p_2)$$
$$q=(q_1,q_2)$$
$$p_1,q_1 \in [0,s)$$
$$p_2,q_2 \in [0,s^2)$$
We want to find a path in between ...
- 453
6
votes
0
answers
152
views
Is it possible to derive a homomorphic signature from homomorphic encryption
At the moment I am trying to find a practical way to implement a linearly homomorphic signature.
Background:
"In a homomorphic signature scheme, a user Alice signs some large dataset x using her ...
- 61
6
votes
0
answers
217
views
Is AES resilient to chosen plaintext with access to related keys (key expansion primitives)?
I'm interested in knowing whether a cryptosystem is broken given access to a few primitives.
$\DeclareMathOperator{\KEYEXP}{KEY\_EXP}$
$\DeclareMathOperator{\E}{E}$
Suppose that you have access to an ...
- 61
6
votes
0
answers
314
views
How to make a "zero knowledge" cache/key-value store
I'd like to use a possibly insecure cache for storing expensive-to-calculate sensitive information. My requirements are:
If the cache ever gets compromised it should reveal nothing about its ids or ...
- 500
6
votes
0
answers
254
views
Additive homomorphic encryption scheme without change in operator
I'm looking for an additive homomorphic encryption that the addition operator (+) in its plaintext space be the same as addition operator in its ciphertext space. (Schemes like Paillier do addition in ...
- 61
6
votes
0
answers
581
views
File Encryption (EFS method)
I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kinds of keys: RSA public/private, AES, ...
- 203
5
votes
0
answers
157
views
Resistance to integral attacks by North Korean block cipher Jipsam1
The cipher is a modification to AES and is described on this website:
The only difference between Jipsam1 and AES-256 is the S-box. Whereas in AES the S-box is public and constant, namely
$$
\begin{...
- 15.4k
5
votes
1
answer
651
views
perfectly secret with key chosen uniformly
Prove or refute: Every encryption scheme for which the size of the keyspace equals the size of the message space, and for which the key is chosen uniformly from the keyspace, is perfectly secret.
My ...
- 61
5
votes
0
answers
166
views
Why does chacha20 not use bitwise not?
Right now chacha20 and blake use constants in order to eliminate fixpoints. As far as I know however inserting a bitwise not every $n$ rounds should eliminate this ...
- 113
5
votes
0
answers
353
views
What public-key encryption protocol can use the same key pair as ECDSA?
Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this ...
- 144k
5
votes
0
answers
481
views
Homomorphic system that allows Hamming distance computation?
How can I work out Hamming distance between two binary vectors securely?
I would like to know how I can apply homomorphic techniques here.
- 51
5
votes
0
answers
123
views
search of patterns in key schedules
I am developing a new key schedule, and there is this article (Enhanced Key Expansion for AES-256 by Using Even-Odd Method) where the authors also propose a new algorithm and one of the objectives is ...
- 281
4
votes
0
answers
103
views
TPM - Ecc based encryption / decryption using the public key
Our device comes with a device certificate which was signed with our private registration authority (CA). The private key (type ECC) was generated on the device itself - to be more specific directly ...
- 786
4
votes
1
answer
436
views
Understanding RLWE Encryption
LWE Encryption Scheme by Regev is inefficient due to its public key sizes in $O(n^2)$. This led to the variant problem RLWE, defined in this paper :
Let $n$ be a power of two, and q a prime ...
- 51
4
votes
1
answer
283
views
Security of using key size larger than the message digest size in HMAC, with one time pads
I would like to know the security of using key size that is larger than the message digest (output) of a HMAC in one time pad encryption.
One time pads for the message and the key of HMAC are ...
4
votes
0
answers
146
views
Zero Knowledge Proofs for Microsoft SEAL (Homomorphic Encryption)
I am working on a system involving multiple parties performing homomorphic cryptographic operations using Microsoft SEAL (BFV). Because of the nature of the system, it would be preferable for the ...
4
votes
0
answers
155
views
Why Block Ciphers
I fail to understand what block ciphers can do that stream ciphers cannot.
Also aren't they construct able from one another.
prg(stream cipher) -> prf -> prp(block cipher)
Any practical example ...
- 41
4
votes
0
answers
124
views
What is "entropic security"?
I've come across a form of cryptographic security that I've never heard of: entropic security. I've read the Russel et al abstract and that doesn't seem to bear much relation to the wiki article.
...
- 15.7k
4
votes
0
answers
260
views
Decrypt the same ciphertext to multiple messages of my choice if I can use any key I want to decrypt
In a modern secure encryption scheme, is it possible (both theoretically and practically) to encrypt a message using a key to get the following ciphertext $c = Enc(M_1,k_1)$ and later find another key ...
- 87
4
votes
0
answers
169
views
Can RSA re-encrypt a message without decrypting it?
The goal of this question is to allow a server/proxy to forward an encrypted message without being able to read it with this procedure being transparent to the original sender and receiver.
Assume we ...
- 293
4
votes
1
answer
2k
views
openssl encryption salt length
when i was reading the latest source code of openssl, i found openssl enc has
an 8-byte (64-bit) salt length; because the same ...
- 739
4
votes
0
answers
159
views
How sensitive is Tiny Encryption Algorithm (TEA) to the magic numbers?
If I needed to implement an encryption algorithm from memory, chances are I would try to implement: TEA
https://en.wikipedia.org/wiki/Tiny_Encryption_Algorithm
How sensitive is it to the magic ...
- 11.9k
4
votes
0
answers
299
views
Why is this Trivium implementation working bytewise instead of bitwise?
I am currently looking into a Trivium implementation available in the FELICS framework.
Parameters of the Trivium stream cipher:
Key size: 80 bit
IV size: 80 bit
State size: 288 bit
The Trivium ...
- 41
4
votes
0
answers
235
views
Why are matrices so common in symmetric encryption?
Matrices have been used in symmetric ciphers since the Hill Cipher (before?) all the way up to modern ciphers such as Twofish and AES.
I understand matrices can be invertible, therefore making them ...
- 1,025
4
votes
0
answers
357
views
Encrypt using ECDH with two different EC public keys, minimizing payload size
Let's say Alice has the private EC keys $a$ and $b$, with a base point of prime order $G$. Alice computes the corresponding public keys $A = aG$ and $B = bG$, and sends them to Bob.
Bob now wants to ...
- 141
4
votes
0
answers
452
views
Alternative way to provision secret in Intel SGX enclave
I have a case where I have multiple clients (non SGX, assumed safe) and server(SGX based), talking over a network. I wanted to provision a shared (per client) key which is used to encrypt and decrypt ...
4
votes
0
answers
105
views
Implications of TLS-SRP client with improper N validation?
During development of a client side application of TLS-SRP, i noticed a bug that allows an attacker spoofing as the server to send custom, but non-arbitrary $N$ values, with the client accepting them. ...
4
votes
0
answers
147
views
How to overcome issues with big ciphers? E.g. with small vs. big Vigenére Ciphers
I understand that bigger ciphers show more recurring patterns and therefore should be easier (or at least faster) to decrypt as you'll have a better statistical analysis, being
However, if we use an ...
- 93
3
votes
0
answers
64
views
improved impossible differential crpytanalysis of 6-round rijndael
I'm studying the paper: "Improved Impossible Differential Cryptanalysis of Rijndael and Crypton".
I've got two questions:
Please explain the calculation performed for step 5?
Step 4 ...
- 41
3
votes
0
answers
52
views
Does the following variant of functional encryption exist?
For a (possibly complicated) function $f: X \rightarrow Y$, can we design a set of encryption scheme $Enc, Func\_Enc$ such that, for $\forall x \in X$,
$$Func\_Enc(f) = g \text{ where } g \text{ is ...
- 41
3
votes
0
answers
37
views
Why Pr[C = 1∣M = a] = 1 ≠ 0 = Pr[C = 1∣M = b]?
The statement is false. We show this by providing a counter-example.
Define
M = {a, b},
K = {k1, k2},
C = {0, 1}.
Let Enc(k, a) = 0 and Enc(k, b) = 1 for k = k1, k2.
Dec algorithm will return an on ...
- 31
3
votes
0
answers
57
views
CX vs padding fix for AEAD key commitment
The padding fix by Albertini et al. for AEAD key commitment (pp. 3292 and 3301-3302) involves prepending a block or two of zeros to the plaintext before encrypting. After decryption, these bytes are ...
- 2,060
3
votes
0
answers
25
views
Anonymized Spatial Conflict Assessment - Suggested Approaches?
Scenario:
There are 3 people: PERSON1, PERSON2, and PERSON3
PERSON1 and PERSON2 each have a 2-dimensional polygon on an x,y
plane
It is PERSON3's job to assess whether the polygons overlap
However, ...
- 31
3
votes
0
answers
148
views
AES subkey calculation not working for subkeys beyond 0 and 1
How should I generate the remaining keys when performing subkey generation in AES encryption? I generated keys 0 and 1 first, but the other keys I generated later were wrongly generated, so what steps ...
3
votes
0
answers
61
views
How to create an encryption such that we need two keys to decrypt, while one key is derivable from the other if I have the secret
Suppose I have some plaintext $M$, and I want to have some process $f$ to make ciphertext $M':=f(M,s)$, where $s$ is some secret. The ciphertext $M'$ can be decrypted by using some decryption process $...
- 31
3
votes
0
answers
882
views
Algorithm used to generate a BitLocker recovery key
I know exactly how a generated BitLocker recovery key works and I can write a code to brute-force it.
How is the recovery key generated though?
I could think of some answers:
it is generated using an ...
- 175
3
votes
0
answers
48
views
Can initialization of the Spritz cipher state by a randomly chosen permutation securely act as a key?
The Spritz cipher is a "sponge-like" construction that the authors show can be used as a hash, MAC, stream cipher, re-seedable pseudo random number generator, and/or an authenticated cipher.
...
- 339
3
votes
0
answers
339
views
Encrypt/Cipher and Decrypt/Decipher a string with a secret
In developing an app I have a simple use case in where I want to encrypt/cipher a string (it could also be a couple of bytes because it's essentially just an IP-Address). On the output I think it ...
- 131
3
votes
0
answers
78
views
Can the hash of the ciphertext be derived from the hash of the plaintext
Let $C$ be a symmetric cipher $H$ a hash function.
Alice uses $C$ with a key $k$ to encrypt plaintext message $m$ yielding ciphertext $c$. She then calculates the hash of the message $h_m = H(m)$ and ...
- 131
3
votes
0
answers
225
views
Does varying ChaCha rounds add any security?
This paper introduces 'Freestyle' a randomized, and variable round version of the ChaCha cipher. It uses the concept of hash based halting condition, where a decryption attempt with an incorrect key ...
- 1,463
3
votes
0
answers
633
views
Identifying correct cipher
I am trying to decrypt a text(~900 characters) and I started with the assumption that its a Vigenère cipher as the one of the identifier tool identified it as Vigenère cipher and also the Index of ...
- 33
3
votes
0
answers
103
views
Is it possible to verify attributes of encrypted content?
Let's say that Alice has this information about her,
{ "name": "Alice", "age": 25, "eyes": "brown" }
which she encrypts with a key pair so that no one access ...
- 31
3
votes
0
answers
62
views
Does Openssl 1.1.1 library supports sending multiple identities as part of PSK?
Does Openssl 1.1.1 supports sending multiple ticket identities as part of PSK? i have gone through the openssl code and i don't see that openssl supports it. could someone please confirm it if i ...
3
votes
0
answers
163
views
Is there a partially homomorphic cryptosystem without an inverse (addition without subtraction, multiplication without division)?
I am learning about partially homomorphic cryptography, and was interested to see if there was a system such that one operation was homomorphic, but its inverse was not.
For example, if I have two ...
- 153
3
votes
0
answers
767
views
Where shoul I store private/public keys and how should I share it?
I'm new in terms of encryption and I have to encrypt the data between two Java Spring applications, one have serves as MVC framework and other as Web Service, I'm implementing an asymmetric encryption ...
