Questions tagged [key-reuse]

Using the same key for more than one purpose, e.g. to encrypt two messages or to encrypt and authenticate a message. Some cryptosystems may be vulnerable to attacks if keys are inappropriately reused.

Filter by
Sorted by
Tagged with
1
vote
1answer
33 views

Is it easier to crack the Vernam Cipher with more than two ciphertexts

I have just started looking into the cracking of the Vernam cipher with two ciphertexts encrypted with the same key by XORing them and then crib dragging and I was wondering if it is made easier if ...
1
vote
1answer
69 views

IV Re-use and Chosen Plaintext against 56bit Blowfish (CBC)

I am looking at a very old protocol which uses Blowfish to encrypt packets with a constant 8-byte IV in CBC mode. Assuming I have: The ability to arbitrary encrypt known plaintexts The IV I know ...
0
votes
1answer
59 views

One-Time Pad Vulnerabilities [duplicate]

Why is it that a one time pad is vulnerable is the key is shorter than the message? I know that if a key is reused across multiple plaintexts, you can XOR two existing ciphertexts to get the pad, but ...
1
vote
1answer
141 views

Decrypting a vigenere cipher with a reused one-time pad

I understand that when a plaintext is encrypted with a key of the same length, it is referred to as a one-time pad. Now when this key is reused to encrypt another plaintext, there is potential for ...
2
votes
0answers
167 views

Sharing RSA private key between SSH and SSL services. How bad is it?

An appliance uses a curious way of obtaining ssh-rsa host keys: There is a single configuration option "management certificate" that sets RSA private keys both for HTTPS and SSH management. ...
0
votes
4answers
1k views

Can the same One-Time-Pad be re-used with some tricks

Let’s say I have a message $m$ of $n$ bits. And a predetermined pad of $k*n$ bits. And for every bit $b$ of this message $m$, I’m creating random sequence $s$ of $k$ bits. I also have a predetermined ...
4
votes
0answers
187 views

AES key reuse between CTR and CBC

The question Given the same plaintext content that is encrypted two times. One time with AES-CTR and the other time with AES-CBC. Both times with the same AES key but with different IVs. What are ...
1
vote
1answer
54 views

How much data does a session/data key typically encrypt?

I believe the masker key, $MK$, of a block cipher might be used for several years and is used only to encrypt $\textit{key encrypting keys}$, which in turn are used only to encrypt $\textit{data keys}$...
2
votes
1answer
97 views

Can tweaking a cipher have the same or similar effect as changing the key?

If we encrypt a message $m$ with (say) $AES$ and key $k$ we get ciphertext $c$. And if we encrypt the same message $m$ but with $k^*$ we get ciphertext $c^*$: 1) $AES[E_k(m)] = c$ and $AES[E_{k^*}(m)]...
0
votes
4answers
851 views

Can I encrypt data with multiple keys and decrypt with one? [closed]

Can I encrypt data with multiple keys and decrypt with one? To be clear, I am not saying encrypt a file, decrypt it, then encrypt it again with a different key. I want to encrypt it, then encrypt it ...
1
vote
2answers
122 views

Multiple XML files and known-plaintext attack

I have created an app which collects data in sets which may contain up to 20000 XML files of an average size of about 5 KB, and all with the same header and XML structure, so that only the data they ...
0
votes
1answer
404 views

Given a list of ciphertexts, how to identify the ones that used the same key for encryption

I'll start off by saying I am not looking for solutions here, just suggestions on how to proceed. I am given a short list of ciphertexts (20something) and I know that one of the ciphertexts has been ...
2
votes
1answer
108 views

Seeking key stream as way to reuse a key

In order to reduce the amount of key exchanges, I propose to encrypt messages using the same key stream, by selecting subsequent positions in the keystream for the separate messages. I.e., message $...
0
votes
1answer
285 views

How to use CPA on AES128-CBC with constant Key and IV to leak info?

I'm doing a challenge in which I need to login to a server as an admin to capture a flag. I can enter an $id$ and a $password$ only consists of 'a-z', '0-9','-', '_' characters. The flow is as follows:...
1
vote
1answer
234 views

How to attack a two time pad if the plain text is randomized?

As an extension to this quesiton, or this one how would you go about attacking a re used pad if the plaintext was randomized before being encrypted? ...
5
votes
2answers
4k views

Why are ephemeral/session/temporary keys useful?

One reason that communication protocols use ephemeral keys is to help with implementing Perfect Forward Security. They're also used in SSL to go from using RSA to using a faster symmetric encryption. ...
-1
votes
1answer
40 views

How to avoid carrying malicious data hidden in a key

I'm going to ask a question and answer it, then hope someone has a better answer. You are Bob, you have been given a large key by Alice (think 40 gigabytes on DVDs) to take with you to use for ...
1
vote
1answer
105 views

Are there any attacks on the key exchange when the client and the server are using the same private key?

Assume the same key pair is securely installed on a server and a single client and that the private key exists nowhere else. Can someone eavesdropping on a TLS handshake between the client and server ...
0
votes
1answer
173 views

Dependent keys on Encrypt Then MAC

It is generally bad form to reuse the same key for encryption and authentication in an "encrypt then MAC" scheme. For example, in the naive encrypt then MAC scheme, we use a randomized CBC block ...
2
votes
1answer
121 views

Extracting the pad in case of one-time-pad reuse without XORing

I had to decrypt two book passages from different books which had both been encrypted using the same one-time-pad, and automate the process at that. I've found a few explanations of how this could be ...
9
votes
2answers
2k views

Is there a downside to encrypting too much data with the same key?

Is there a downside to encrypting too much data? If so, what? I'm guessing things like too much data encrypted with the same key, possibly leaking information due to a collision encrypting non-...
1
vote
0answers
809 views

ElGamal: Why is reusing the same $k$ not secure?

I have a question on the encryption process of ElGamal: $$ Y = g ^ a \bmod p \\ C = g ^ k \bmod p \quad\text{($k$ is chosen randomly)} \\ D = m \cdot y ^ k \bmod p \\ \text{Decryption:}\...
-1
votes
1answer
60 views

What to do with this specific scenario of a key reuse [duplicate]

I am brand new to the world of cryptogrophy. I am trying to decrypt a many-time-pad. I understand the methodology of using the XOR to get the messages. C1 XOR C2 = M1 XOR M2 Now my question lies in ...
5
votes
3answers
931 views

Is including the key as AAD actually dangerous?

In a recent answer, Maarten mentioned including the key is a bad idea as well. This got my curious. Is there any scientific / cryptographic analysis whether including the key in the ...
0
votes
1answer
1k views

Are block ciphers vulnerable to “key reuse” and/or “bit-flipping” attacks?

I know that almost all stream ciphers are vulnerable to “key reuse” and “bit-flipping” attacks. Because AES also uses $XOR$ in its algorithm, is it possible for block ciphers – like AES – to be ...
1
vote
1answer
283 views

Is it safe to use the same key for different variants of the HMAC-SHA algorithm?

I need to apply HMAC-SHA hashes in my application. Depending on the context I'll use either HMAC-SHA512, HMAC-SHA256 or HMAC-SHA1. Is it safe to use the same key for all of these algorithms, or do I ...
1
vote
1answer
246 views

How can I determine key length for message encrypted by many-time-pad?

For message $ m $ and key $ k $ I get encrypted message $ c $ ($ m \oplus k = c $) where $ length(k) < length(m) $. Additionally I know that message $ m $ is English text. Instead of using pure ...
4
votes
0answers
140 views

Does length prepending fix the key reuse problems with CBC and CBC-MAC?

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea. Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
2
votes
1answer
443 views

Reuse of TLS client key/certificate in challenge-response protocol

The situation: We have a custom PKI with clients communicating with the server over standard SSL/TLS encrypted channel. PKI uses ECC, server certificate supports ECDHE_ECDSA key exchange mechanism and ...
2
votes
2answers
170 views

Is “reused one time pad” safe to encrypt a message like “random number + mod”?

I want to encrypt a message that contains a fixed length random number and a long mod. i.e. 1234564284 (created like this 123456 + (123456 mod 9931)) I assume that reusing the same key is not a ...
8
votes
3answers
5k views

AES key reuse and guessing the key

Bit of a noob question and a fair bit of Googling didn't help. I understand that the current encryption standard is AES256. A few questions Is the point of this (and other encryption techniques) to ...
1
vote
1answer
8k views

Many time pad attack (XOR) [duplicate]

The question is quite similar to Many time pad attack and I was trying to rely on the top answer, but still am a bit confused, so any explanation and help will be much appreciated. Assume I have a ...
0
votes
1answer
803 views

Decrypting messages crypted with one time pad (used more than once)

I have a stream cipher with a key (that is unknown to me) that is used more than once. Messages are ciphered in this way: ciphered_message = message XOR key Let'...
1
vote
0answers
351 views

DES_cblock and Key Recovery [closed]

I'm trying to get my hands on the key that OpenSSL uses for a DES encryption. The key is based off a random number generator with a seed taken as parameter. The code used is below, provided as part ...
0
votes
1answer
94 views

Considerations on using a single long-term key for file encryption

I'm thinking about designing my own container file format that allows me to store a file in it along with, say, a thumbnail or other metadata. Some of these files are confidential and therefore must ...
5
votes
2answers
913 views

Is reusing keys for CBC and CBC-MAC secure when using encrypt-then-MAC?

I know reusing keys is a bad idea, especially for CBC and CBC-MAC, but the example for why on Wikipedia seemed to use encrypt-and-MAC. It seems obvious that the last block of encryption will be equal ...
2
votes
1answer
104 views

Does key renewal increase complexity of MAC forgery?

Suppose I have encrypted messages sent to a device authenticated with a MAC keyed with a strong shared cryptographic key. This device can only process so many messages per unit of time. This ...
5
votes
1answer
2k views

What happens if a nonce is reused in ChaCha20-Poly1305?

In ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair. However, is security affected for those messages encrypted ...
3
votes
1answer
1k views

Is it bad design to reuse an AES key?

The company I work for needs to develop a simple system where, for each client, we encrypt a token on our server, which is then transmitted to the client. The decryption is performed by the server ...
9
votes
1answer
284 views

Is there any reason not to use Single-Key EM with AES and a constant key?

I've read recently the paper "Minimalism in Cryptography: The Even-Mansour Scheme Revisited" by Dunkelman, Keller and Shamir where it is claimed that the following construction (Single-Key EM) is ...
1
vote
0answers
57 views

Hiding the identity of a party within the Kerberos authentication scheme

In the Kerberos authentication protocol, as described here: would it be safer to replace step (1) with: $$ A \rightarrow T : A, E_{K_A{_{T}}}(B, N_A) $$ so that a passive adversary does not know ...
3
votes
1answer
167 views

Attacks on WinRAR volumes reusing same password?

I have quite a few WinRAR volumes that are all encrypted with the same password. The password is long and unbruteforceable, but I recently read that WinRAR uses PBDKF2 as its key-derivation function ...
2
votes
0answers
401 views

Limit the number of private key uses for RSASSA-PKCS1-v1_5 with SHA-256 signature?

Assuming all messages and their signatures are available to the attacker, is it secure to use the same RSA private key to sign many messages (roughly $10^{6}$) via PKCS#11 ...
5
votes
1answer
3k views

Envelope Encryption with asymmetric keys vs KMS

In Envelope encryption a symmetric secret key is used to sign the data and then another key is used to encrypt the secret to produce an encrypted secret key. The encrypted messages is packaged with ...
3
votes
2answers
344 views

Perfect secrecy with n-time key

How can you encrypt $n$ messages with the same key, and have the same theoretical security you'd have encrypting a single message with a one time pad? For example, how can you encrypt two messages ...
3
votes
1answer
637 views

Can I use an ECDH Shared Secret from the same Private / Public Key Pair?

I'd like to know if using the ECDH shared secret of a static EC Private Key with it's own corresponding static EC Public Key causes a problem / weakness. (edit) not asking if it's ok to re-use the ...
1
vote
1answer
503 views

Deriving 2 shared secrets from one private key and 2 different public keys

I have a key pair, say $(d, Q)$. I send my public key $Q$ to 2 different people. I also get their public keys $Q_1$ and $Q_2$. Now I can derive 2 shared secrets, $d*Q_1$ and $d*Q_2$. The 2 other ...
1
vote
1answer
385 views

How to decrypt unusual Many Time Pad

How does one decrypt the many time pad: ($R$ is a random string, $C$ is ciphertext, $P$ is plaintext) $R_0 \oplus R_1 = C_0$ $R_2 \oplus R_1 = C_1$ $P_0 \oplus R_1 = C_2$ assuming that $R_n$ are ...
1
vote
1answer
2k views

What do I use as the encryption key and initialization vector in AES cfb128

I'm writing a program that can encrypt a file using AES cfb128 (using Openssl and C++). The scenario of the program is this: Person A visits computer, encrypts a file they make, takes away a key (on ...
-1
votes
1answer
678 views

credit card number encryption using aes-ctr mode

I want to encrypt credit card numbers. I want to apply AES-CTR mode. Is it suitable for that? How can I store nonce and counter values for an individual credit card number? How can I send the ...