Questions tagged [key-reuse]

Using the same key for more than one purpose, e.g. to encrypt two messages or to encrypt and authenticate a message. Some cryptosystems may be vulnerable to attacks if keys are inappropriately reused.

Filter by
Sorted by
Tagged with
1
vote
1answer
74 views

Public Key generation for Ed25519 vs X25519

It is my understanding that EdDSA uses a slight variant of Curve25519 (typically used for ECDH), called Ed25519. Given the same private key, are the differences between the two algorithms enough to ...
1
vote
1answer
48 views

Is a Diffie-Hellman scheme in which parties always use the same public keys vulnerable?

I have come across a couple of protocols in which the public keys of the parties are static across conversations, even with different users. Something about this makes my hairs stand on end but I can'...
1
vote
1answer
61 views

Encrypting multiple small messages with a single reused symmetric key

What is a good way of doing this? Practical and Secure. This is for a browser environment. For example, let's say there are a few 100 independent messages of about 100 characters each that you want ...
0
votes
1answer
39 views

Using same key and nonce for different field of the same document

I have some fields, similar to NAME, SURNAME, EMAIL, ADDRESS... I'm using NaCl for symmetric encryption. Is bad If I Encrypt every field with the same key and nonce? They are encrypted and stored ...
0
votes
0answers
24 views

AES Stream Cipher Mode Key Reuse With Random IV Per Message [duplicate]

Im using AES OFB mode, which is a stream cipher. It will be used to encrypt many seperate small amounts of data in very short amounts of time. If for every separate piece of data encrypted I use a ...
0
votes
0answers
29 views

Partial key reuse in hash for one time pad cipher

There are 2 computers who are going to exchange lots of small packets of data between each other. To generate a shared secret, an elliptic key exchange takes place. If this key is hashed with the ...
0
votes
2answers
178 views

XOR and key reuse [duplicate]

I've been doing a bit of reading on the use of XOR and the dangers of key reuse. I'm aware that reusing a key can open a door for a frequency analysis attack on my plain text. So far, everything ...
2
votes
1answer
135 views

Is it easier to crack the Vernam Cipher with more than two ciphertexts

I have just started looking into the cracking of the Vernam cipher with two ciphertexts encrypted with the same key by XORing them and then crib dragging and I was wondering if it is made easier if ...
1
vote
1answer
95 views

IV Re-use and Chosen Plaintext against 56bit Blowfish (CBC)

I am looking at a very old protocol which uses Blowfish to encrypt packets with a constant 8-byte IV in CBC mode. Assuming I have: The ability to arbitrary encrypt known plaintexts The IV I know ...
0
votes
1answer
79 views

One-Time Pad Vulnerabilities [duplicate]

Why is it that a one time pad is vulnerable is the key is shorter than the message? I know that if a key is reused across multiple plaintexts, you can XOR two existing ciphertexts to get the pad, but ...
1
vote
1answer
315 views

Decrypting a vigenere cipher with a reused one-time pad

I understand that when a plaintext is encrypted with a key of the same length, it is referred to as a one-time pad. Now when this key is reused to encrypt another plaintext, there is potential for ...
2
votes
0answers
184 views

Sharing RSA private key between SSH and SSL services. How bad is it?

An appliance uses a curious way of obtaining ssh-rsa host keys: There is a single configuration option "management certificate" that sets RSA private keys both for HTTPS and SSH management. ...
0
votes
4answers
1k views

Can the same One-Time-Pad be re-used with some tricks

Let’s say I have a message $m$ of $n$ bits. And a predetermined pad of $k*n$ bits. And for every bit $b$ of this message $m$, I’m creating random sequence $s$ of $k$ bits. I also have a predetermined ...
4
votes
0answers
206 views

AES key reuse between CTR and CBC

The question Given the same plaintext content that is encrypted two times. One time with AES-CTR and the other time with AES-CBC. Both times with the same AES key but with different IVs. What are ...
1
vote
1answer
74 views

How much data does a session/data key typically encrypt?

I believe the masker key, $MK$, of a block cipher might be used for several years and is used only to encrypt $\textit{key encrypting keys}$, which in turn are used only to encrypt $\textit{data keys}$...
2
votes
1answer
104 views

Can tweaking a cipher have the same or similar effect as changing the key?

If we encrypt a message $m$ with (say) $AES$ and key $k$ we get ciphertext $c$. And if we encrypt the same message $m$ but with $k^*$ we get ciphertext $c^*$: 1) $AES[E_k(m)] = c$ and $AES[E_{k^*}(m)]...
0
votes
4answers
971 views

Can I encrypt data with multiple keys and decrypt with one? [closed]

Can I encrypt data with multiple keys and decrypt with one? To be clear, I am not saying encrypt a file, decrypt it, then encrypt it again with a different key. I want to encrypt it, then encrypt it ...
1
vote
2answers
136 views

Multiple XML files and known-plaintext attack

I have created an app which collects data in sets which may contain up to 20000 XML files of an average size of about 5 KB, and all with the same header and XML structure, so that only the data they ...
0
votes
1answer
433 views

Given a list of ciphertexts, how to identify the ones that used the same key for encryption

I'll start off by saying I am not looking for solutions here, just suggestions on how to proceed. I am given a short list of ciphertexts (20something) and I know that one of the ciphertexts has been ...
2
votes
1answer
113 views

Seeking key stream as way to reuse a key

In order to reduce the amount of key exchanges, I propose to encrypt messages using the same key stream, by selecting subsequent positions in the keystream for the separate messages. I.e., message $...
0
votes
1answer
303 views

How to use CPA on AES128-CBC with constant Key and IV to leak info?

I'm doing a challenge in which I need to login to a server as an admin to capture a flag. I can enter an $id$ and a $password$ only consists of 'a-z', '0-9','-', '_' characters. The flow is as follows:...
1
vote
1answer
260 views

How to attack a two time pad if the plain text is randomized?

As an extension to this quesiton, or this one how would you go about attacking a re used pad if the plaintext was randomized before being encrypted? ...
5
votes
2answers
5k views

Why are ephemeral/session/temporary keys useful?

One reason that communication protocols use ephemeral keys is to help with implementing Perfect Forward Security. They're also used in SSL to go from using RSA to using a faster symmetric encryption. ...
-1
votes
1answer
40 views

How to avoid carrying malicious data hidden in a key

I'm going to ask a question and answer it, then hope someone has a better answer. You are Bob, you have been given a large key by Alice (think 40 gigabytes on DVDs) to take with you to use for ...
1
vote
1answer
113 views

Are there any attacks on the key exchange when the client and the server are using the same private key?

Assume the same key pair is securely installed on a server and a single client and that the private key exists nowhere else. Can someone eavesdropping on a TLS handshake between the client and server ...
0
votes
1answer
185 views

Dependent keys on Encrypt Then MAC

It is generally bad form to reuse the same key for encryption and authentication in an "encrypt then MAC" scheme. For example, in the naive encrypt then MAC scheme, we use a randomized CBC block ...
2
votes
1answer
128 views

Extracting the pad in case of one-time-pad reuse without XORing

I had to decrypt two book passages from different books which had both been encrypted using the same one-time-pad, and automate the process at that. I've found a few explanations of how this could be ...
9
votes
2answers
2k views

Is there a downside to encrypting too much data with the same key?

Is there a downside to encrypting too much data? If so, what? I'm guessing things like too much data encrypted with the same key, possibly leaking information due to a collision encrypting non-...
1
vote
0answers
957 views

ElGamal: Why is reusing the same $k$ not secure?

I have a question on the encryption process of ElGamal: $$ Y = g ^ a \bmod p \\ C = g ^ k \bmod p \quad\text{($k$ is chosen randomly)} \\ D = m \cdot y ^ k \bmod p \\ \text{Decryption:}\...
-1
votes
1answer
61 views

What to do with this specific scenario of a key reuse [duplicate]

I am brand new to the world of cryptogrophy. I am trying to decrypt a many-time-pad. I understand the methodology of using the XOR to get the messages. C1 XOR C2 = M1 XOR M2 Now my question lies in ...
5
votes
3answers
940 views

Is including the key as AAD actually dangerous?

In a recent answer, Maarten mentioned including the key is a bad idea as well. This got my curious. Is there any scientific / cryptographic analysis whether including the key in the ...
0
votes
1answer
1k views

Are block ciphers vulnerable to “key reuse” and/or “bit-flipping” attacks?

I know that almost all stream ciphers are vulnerable to “key reuse” and “bit-flipping” attacks. Because AES also uses $XOR$ in its algorithm, is it possible for block ciphers – like AES – to be ...
2
votes
1answer
322 views

Is it safe to use the same key for different variants of the HMAC-SHA algorithm?

I need to apply HMAC-SHA hashes in my application. Depending on the context I'll use either HMAC-SHA512, HMAC-SHA256 or HMAC-SHA1. Is it safe to use the same key for all of these algorithms, or do I ...
1
vote
1answer
272 views

How can I determine key length for message encrypted by many-time-pad?

For message $ m $ and key $ k $ I get encrypted message $ c $ ($ m \oplus k = c $) where $ length(k) < length(m) $. Additionally I know that message $ m $ is English text. Instead of using pure ...
4
votes
0answers
145 views

Does length prepending fix the key reuse problems with CBC and CBC-MAC?

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea. Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
2
votes
1answer
489 views

Reuse of TLS client key/certificate in challenge-response protocol

The situation: We have a custom PKI with clients communicating with the server over standard SSL/TLS encrypted channel. PKI uses ECC, server certificate supports ECDHE_ECDSA key exchange mechanism and ...
2
votes
2answers
175 views

Is “reused one time pad” safe to encrypt a message like “random number + mod”?

I want to encrypt a message that contains a fixed length random number and a long mod. i.e. 1234564284 (created like this 123456 + (123456 mod 9931)) I assume that reusing the same key is not a ...
9
votes
3answers
6k views

AES key reuse and guessing the key

Bit of a noob question and a fair bit of Googling didn't help. I understand that the current encryption standard is AES256. A few questions Is the point of this (and other encryption techniques) to ...
1
vote
1answer
9k views

Many time pad attack (XOR) [duplicate]

The question is quite similar to Many time pad attack and I was trying to rely on the top answer, but still am a bit confused, so any explanation and help will be much appreciated. Assume I have a ...
0
votes
1answer
942 views

Decrypting messages crypted with one time pad (used more than once)

I have a stream cipher with a key (that is unknown to me) that is used more than once. Messages are ciphered in this way: ciphered_message = message XOR key Let'...
1
vote
0answers
377 views

DES_cblock and Key Recovery [closed]

I'm trying to get my hands on the key that OpenSSL uses for a DES encryption. The key is based off a random number generator with a seed taken as parameter. The code used is below, provided as part ...
0
votes
1answer
99 views

Considerations on using a single long-term key for file encryption

I'm thinking about designing my own container file format that allows me to store a file in it along with, say, a thumbnail or other metadata. Some of these files are confidential and therefore must ...
5
votes
2answers
1k views

Is reusing keys for CBC and CBC-MAC secure when using encrypt-then-MAC?

I know reusing keys is a bad idea, especially for CBC and CBC-MAC, but the example for why on Wikipedia seemed to use encrypt-and-MAC. It seems obvious that the last block of encryption will be equal ...
2
votes
1answer
104 views

Does key renewal increase complexity of MAC forgery?

Suppose I have encrypted messages sent to a device authenticated with a MAC keyed with a strong shared cryptographic key. This device can only process so many messages per unit of time. This ...
5
votes
1answer
2k views

What happens if a nonce is reused in ChaCha20-Poly1305?

In ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair. However, is security affected for those messages encrypted ...
4
votes
1answer
2k views

Is it bad design to reuse an AES key?

The company I work for needs to develop a simple system where, for each client, we encrypt a token on our server, which is then transmitted to the client. The decryption is performed by the server ...
9
votes
1answer
299 views

Is there any reason not to use Single-Key EM with AES and a constant key?

I've read recently the paper "Minimalism in Cryptography: The Even-Mansour Scheme Revisited" by Dunkelman, Keller and Shamir where it is claimed that the following construction (Single-Key EM) is ...
1
vote
0answers
58 views

Hiding the identity of a party within the Kerberos authentication scheme

In the Kerberos authentication protocol, as described here: would it be safer to replace step (1) with: $$ A \rightarrow T : A, E_{K_A{_{T}}}(B, N_A) $$ so that a passive adversary does not know ...
3
votes
1answer
178 views

Attacks on WinRAR volumes reusing same password?

I have quite a few WinRAR volumes that are all encrypted with the same password. The password is long and unbruteforceable, but I recently read that WinRAR uses PBDKF2 as its key-derivation function ...
2
votes
0answers
425 views

Limit the number of private key uses for RSASSA-PKCS1-v1_5 with SHA-256 signature?

Assuming all messages and their signatures are available to the attacker, is it secure to use the same RSA private key to sign many messages (roughly $10^{6}$) via PKCS#11 ...