All Questions
4,941
questions
425
votes
13
answers
194k
views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
- 87.7k
79
votes
3
answers
91k
views
How does one attack a two-time pad (i.e. one time pad with key reuse)?
My question might appear the same as the question Taking advantage of one-time pad key reuse?, but actually I did read all the answers and none of them helped me with the details I need.
I am new to ...
- 993
75
votes
1
answer
36k
views
Easy explanation of "IND-" security notions?
There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security.
...
- 46.3k
234
votes
8
answers
112k
views
How much would it cost in U.S. dollars to brute-force a 256-bit key in a year?
I am often told that any key can be broken and that it is only a matter of time and resources for any key to be broken. I know that this is technically true. However, I think that there is probably a ...
- 2,443
44
votes
6
answers
24k
views
Does RSA work for any message M?
I decided to read the original RSA paper A Method for Obtaining Digital Signatures and Public-Key Cryptosystem because of a question I had about RSA (which is not the question I'm about to ask, but ...
- 38.8k
42
votes
4
answers
107k
views
Calculating RSA private exponent when given public exponent and the modulus factors using extended Euclid
When given $p = 5, q = 11, N = 55$ and $e = 17$, I'm trying to compute the RSA private key $d$.
I can calculate $\varphi(N) = 40$, but my lecturer then says to use the extended Euclidean algorithm to ...
- 531
132
votes
7
answers
90k
views
How big an RSA key is considered secure today?
I think 1024 bit RSA keys were considered secure ~5 years ago, but I assume that's not true anymore. Can 2048 or 4096 keys still be relied upon, or have we gained too much computing power in the ...
- 1,587
99
votes
2
answers
31k
views
What is the "Random Oracle Model" and why is it controversial?
What is the "Random Oracle Model"? Is it an "assumption" akin to the hardness of factoring and discrete log? Or something else?
And why do some researchers have a strong distrust of this model?
- 4,228
123
votes
7
answers
122k
views
Taking advantage of one-time pad key reuse?
Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel. Alice and Bob have a shared key $k$; however, both messages are the same length as the ...
- 1,701
152
votes
7
answers
113k
views
Should we sign-then-encrypt, or encrypt-then-sign?
Frequently, we want to send messages that are (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers ...
- 5,694
33
votes
1
answer
11k
views
What do the signature security abbreviations like EUF-CMA mean?
From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes.
The most common ones are the *UF-* ...
- 46.3k
15
votes
2
answers
7k
views
How reassuring is 64-bit (in)security?
In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity....
- 9,672
17
votes
3
answers
25k
views
Has AES-128 been fully broken?
Has AES-128 been broken over the full 10 rounds? If so, by what means? By a commercial entity? By a supercomputer?
If not, why is AES-256 used to replace AES-128 so frequently?
- 293
174
votes
2
answers
187k
views
What is the main difference between a key, an IV and a nonce?
What are the main differences between a nonce, a key and an IV? Without any doubt the key should be kept secret. But what about the nonce and the IV? What's the main difference between them and their ...
- 6,230
56
votes
6
answers
12k
views
Kerckhoffs’ principles – Why should I make my cipher public?
As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that
A cryptosystem should be secure ...
- 2,578
26
votes
1
answer
21k
views
What are the odds of collisions for a hash function with 256-bit output?
There are some related questions on the net but I did not understand their solutions.
I am reading in a textbook about methods of finding a collision. It states to consider a collision for a hash ...
- 407
16
votes
1
answer
3k
views
Representing a function as FHE circuit
I am actually trying to study homomorphic encryption (on lattices) but I'm facing a problem. Every paper that I have read so far talk about writing the function to evaluate on ciphertexts as a circuit,...
- 418
39
votes
3
answers
49k
views
Why is CBC with predictable IV considered insecure against chosen-plaintext attack?
I just learned that using CBC encryption with an IV which is predictable is not secure.
From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can ...
- 491
30
votes
2
answers
23k
views
Which attacks are possible against raw/textbook RSA?
The PKCS#1 standard defines multiple padding schemes for signature generation/verification (EMSA-PSS and EMSA-PKCS1-v1_5), and encryption/decryption (EME-OAEP and the less safe EME-PKCS1-v1_5).
Which ...
26
votes
2
answers
15k
views
Is RSA encryption with a private key the same as signature generation?
It is often said that RSA encryption of a cryptographic hash with a private key is the same as signing (signature generation). And that verification consists of decryption using a public key.
Is RSA ...
- 93.9k
18
votes
1
answer
32k
views
Bit Flipping Attack on CBC Mode
To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
- 321
16
votes
1
answer
8k
views
What are the rules for using AES-GCM correctly?
When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM ...
- 681
7
votes
1
answer
4k
views
Multiple AES Key Derivation from a master key
I need cryptography advice regarding this issue.
Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
89
votes
8
answers
13k
views
Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
- 22.8k
62
votes
3
answers
59k
views
Definition of textbook RSA
What is the definition of textbook or "raw" RSA?
What are some of the properties of textbook RSA?
How does it differ from other schemes based on RSA?
- 1,973
55
votes
2
answers
9k
views
What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?
In RSA, some security authorities and/or standards allow the public exponent $e=3$, others require or recommend $e>2^{16}$ (or perhaps some other minimum). I gathered the following:
PKCS#1 allows $...
- 144k
24
votes
4
answers
6k
views
Is it feasible to build a stream cipher from a cryptographic hash function?
A few years ago I devised a symmetric-key system that worked like so:
...
- 1,505
62
votes
6
answers
58k
views
Why is AES resistant to known-plaintext attacks?
At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
- 825
6
votes
2
answers
4k
views
Discrete Logarithm: What does it mean to find the discrete logarithm of $a$ to base $g$ modulo $p$?
My understanding is that $a=g^x\bmod p$ is the discrete logarithm problem. Given the question is worded this way, are we trying to find $x=\log_g a\bmod p$ ?
For instance, if we are trying to compute ...
78
votes
1
answer
63k
views
Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?
I've studied that the Bleichenbacher's CCA attack on PKCS#1 v1.5. is a base to many versions of attacks in the area.
I'm trying to understand that attack, but every explanation I saw starts with the ...
- 2,150
26
votes
2
answers
24k
views
How bad it is using the same IV twice with AES/GCM?
I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP ...
- 1,437
18
votes
2
answers
29k
views
Is it possible to obtain AES-128 key from a known ciphertext-plaintext pair?
I have a file, which was encrypted with AES-128 in ECB mode. I know the format of the original file and know that all files in this format have the same headers. So, I have an encrypted block and the ...
- 183
12
votes
2
answers
4k
views
What is a multi-target attack?
What exactly is a multi-target attack? How does the attack work on different cryptographic schemes (block ciphers, hash functions, elliptic curves)? How can it be avoided?
- 6,514
91
votes
4
answers
106k
views
What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?
AES has several different variants:
AES-128
AES-192
AES-256
But why would someone prefer use one over another?
- 3,246
70
votes
3
answers
118k
views
Why shouldn't I use ECB encryption?
I'm using Java to generate encrypted strings, and I get this warning at build time:
ECB encryption mode should not be used
So I'm wondering why I shouldn't use ECB and what I can use instead?
- 826
61
votes
2
answers
21k
views
What makes a hash function good for password hashing?
Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the ...
- 713
47
votes
4
answers
36k
views
Security strength of RSA in relation with the modulus size
NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits:
...
26
votes
2
answers
16k
views
Purpose of DES parity bits
DES has a 64-bit key size, but only 56 of those are used during encryption. The other 8 are "parity bits".
What was the intended purpose of the party bits, and why are they no longer used in modern ...
user9070
191
votes
23
answers
30k
views
Time Capsule cryptography?
Does there exist any cryptographic algorithm which encrypts data in such a way that it can only be decrypted after a certain period of time?
The only idea that I can think of, is something like this: ...
Jake
62
votes
2
answers
19k
views
Why is $H(k\mathbin\Vert x)$ not a secure MAC construction?
If $H(m)$ is a secure hash function, can't we implement a MAC using $H(k\mathbin\Vert m)$?
However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash ...
- 723
22
votes
5
answers
9k
views
Using CBC with a fixed IV and a random first plaintext block
What if, instead of using CBC mode in the normal way with a random IV, I used this approach:
Use a fixed IV (like a block of 0's).
Before encrypting, generate a random block and prepend it to the ...
- 415
19
votes
4
answers
6k
views
Is SHA-256 secure as a CTR block cipher?
Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x.
We represent numbers in simple binary instead of a counting function. <...
- 585
37
votes
4
answers
10k
views
Why is plain-hash-then-encrypt not a secure MAC?
It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why?
Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
- 1,101
15
votes
2
answers
3k
views
The effect of truncated hash on entropy
Suppose I have a 128-bit random binary string (128 bits of entropy), then I hash it using SHA-256, then I take the first 128 bits of the output hash. Does the taken bit string still have (almost) 128 ...
- 517
14
votes
4
answers
10k
views
Disadvantages of AES-CTR?
On paper, it sounds *very* good to me:
secure
fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
- 567
32
votes
3
answers
6k
views
Are common cryptographic hashes bijective when hashing a single block of the same size as the output?
It's been said that CRC-64 is bijective for a 64-bit block.
It the corresponding statement true for typical cryptographic hashes, like MD5, SHA-1, SHA-2 or SHA-3?
For example, would SHA-512 be ...
- 1,907
72
votes
4
answers
41k
views
How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?
RSA is not designed to be used on long blocks of plaintext like a block cipher, but I need to use it to send a large (encrypted) message.
How can I do this?
- 3,246
26
votes
4
answers
8k
views
What makes Quantum Cryptography secure?
This is my current understanding of how Quantum Cryptography works: (The first bit is Quantum Key Distribution)
Alice sends a beam of photons to Bob through a quantum channel such as an optical fiber. ...
- 373
26
votes
4
answers
6k
views
Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?
Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
- 144k
9
votes
1
answer
4k
views
Security levels in NIST Post-quantum project: e.g. AES-128 vs SHA-256
In an article about NIST Post-quantum Standardization project I read about the security criteria of the proposed schemes and there was this table (Level I lowest security, level V highest):
Level I: ...
- 167