All Questions

Filter by
Sorted by
Tagged with
423 votes
13 answers
188k views

Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
Thomas Pornin's user avatar
77 votes
3 answers
89k views

How does one attack a two-time pad (i.e. one time pad with key reuse)?

My question might appear the same as the question Taking advantage of one-time pad key reuse?, but actually I did read all the answers and none of them helped me with the details I need. I am new to ...
Samer Makary's user avatar
68 votes
1 answer
34k views

Easy explanation of "IND-" security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
SEJPM's user avatar
  • 45.9k
230 votes
8 answers
110k views

How much would it cost in U.S. dollars to brute-force a 256-bit key in a year?

I am often told that any key can be broken and that it is only a matter of time and resources for any key to be broken. I know that this is technically true. However, I think that there is probably a ...
John Fischer's user avatar
  • 2,403
44 votes
6 answers
23k views

Does RSA work for any message M?

I decided to read the original RSA paper A Method for Obtaining Digital Signatures and Public-Key Cryptosystem because of a question I had about RSA (which is not the question I'm about to ask, but ...
mikeazo's user avatar
  • 38.5k
40 votes
4 answers
104k views

Calculating RSA private exponent when given public exponent and the modulus factors using extended Euclid

When given $p = 5, q = 11, N = 55$ and $e = 17$, I'm trying to compute the RSA private key $d$. I can calculate $\varphi(N) = 40$, but my lecturer then says to use the extended Euclidean algorithm to ...
DougalMaguire's user avatar
132 votes
7 answers
88k views

How big an RSA key is considered secure today?

I think 1024 bit RSA keys were considered secure ~5 years ago, but I assume that's not true anymore. Can 2048 or 4096 keys still be relied upon, or have we gained too much computing power in the ...
Inaimathi's user avatar
  • 1,587
150 votes
7 answers
109k views

Should we sign-then-encrypt, or encrypt-then-sign?

Frequently, we want to send messages that are (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers ...
David Cary's user avatar
  • 5,644
97 votes
2 answers
29k views

What is the "Random Oracle Model" and why is it controversial?

What is the "Random Oracle Model"? Is it an "assumption" akin to the hardness of factoring and discrete log? Or something else? And why do some researchers have a strong distrust of this model?
Fixee's user avatar
  • 4,158
121 votes
7 answers
120k views

Taking advantage of one-time pad key reuse?

Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel. Alice and Bob have a shared key $k$; however, both messages are the same length as the ...
Elliott's user avatar
  • 1,671
15 votes
2 answers
6k views

How reassuring is 64-bit (in)security?

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity....
DannyNiu's user avatar
  • 9,080
32 votes
1 answer
9k views

What do the signature security abbreviations like EUF-CMA mean?

From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes. The most common ones are the *UF-* ...
SEJPM's user avatar
  • 45.9k
16 votes
3 answers
22k views

Has AES-128 been fully broken?

Has AES-128 been broken over the full 10 rounds? If so, by what means? By a commercial entity? By a supercomputer? If not, why is AES-256 used to replace AES-128 so frequently?
Offir's user avatar
  • 283
172 votes
2 answers
182k views

What is the main difference between a key, an IV and a nonce?

What are the main differences between a nonce, a key and an IV? Without any doubt the key should be kept secret. But what about the nonce and the IV? What's the main difference between them and their ...
curious's user avatar
  • 6,150
54 votes
6 answers
12k views

Kerckhoffs’ principles – Why should I make my cipher public?

As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that A cryptosystem should be secure ...
rath's user avatar
  • 2,548
25 votes
1 answer
20k views

What are the odds of collisions for a hash function with 256-bit output?

There are some related questions on the net but I did not understand their solutions. I am reading in a textbook about methods of finding a collision. It states to consider a collision for a hash ...
Max's user avatar
  • 397
39 votes
3 answers
47k views

Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

I just learned that using CBC encryption with an IV which is predictable is not secure. From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can ...
asudhak's user avatar
  • 491
30 votes
2 answers
22k views

Which attacks are possible against raw/textbook RSA?

The PKCS#1 standard defines multiple padding schemes for signature generation/verification (EMSA-PSS and EMSA-PKCS1-v1_5), and encryption/decryption (EME-OAEP and the less safe EME-PKCS1-v1_5). Which ...
15 votes
1 answer
3k views

Representing a function as FHE circuit

I am actually trying to study homomorphic encryption (on lattices) but I'm facing a problem. Every paper that I have read so far talk about writing the function to evaluate on ciphertexts as a circuit,...
Binou's user avatar
  • 408
25 votes
2 answers
15k views

Is RSA encryption with a private key the same as signature generation?

It is often said that RSA encryption of a cryptographic hash with a private key is the same as signing (signature generation). And that verification consists of decryption using a public key. Is RSA ...
Maarten Bodewes's user avatar
  • 92.3k
7 votes
1 answer
3k views

Multiple AES Key Derivation from a master key

I need cryptography advice regarding this issue. Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
Omer Levi Hevroni's user avatar
89 votes
8 answers
13k views

Guarding against cryptanalytic breakthroughs: combining multiple hash functions

Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
Paŭlo Ebermann's user avatar
61 votes
3 answers
57k views

Definition of textbook RSA

What is the definition of textbook or "raw" RSA? What are some of the properties of textbook RSA? How does it differ from other schemes based on RSA?
Bobby S's user avatar
  • 1,943
17 votes
1 answer
28k views

Bit Flipping Attack on CBC Mode

To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
CXB's user avatar
  • 311
55 votes
2 answers
9k views

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

In RSA, some security authorities and/or standards allow the public exponent $e=3$, others require or recommend $e>2^{16}$ (or perhaps some other minimum). I gathered the following: PKCS#1 allows $...
fgrieu's user avatar
  • 140k
24 votes
4 answers
6k views

Is it feasible to build a stream cipher from a cryptographic hash function?

A few years ago I devised a symmetric-key system that worked like so: ...
John Gietzen's user avatar
  • 1,505
60 votes
6 answers
55k views

Why is AES resistant to known-plaintext attacks?

At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
Jeff Ferland's user avatar
14 votes
1 answer
6k views

What are the rules for using AES-GCM correctly?

When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM ...
ams's user avatar
  • 631
18 votes
2 answers
28k views

Is it possible to obtain AES-128 key from a known ciphertext-plaintext pair?

I have a file, which was encrypted with AES-128 in ECB mode. I know the format of the original file and know that all files in this format have the same headers. So, I have an encrypted block and the ...
Denis Bezrukov's user avatar
9 votes
2 answers
3k views

What is a multi-target attack?

What exactly is a multi-target attack? How does the attack work on different cryptographic schemes (block ciphers, hash functions, elliptic curves)? How can it be avoided?
Conrado's user avatar
  • 6,414
90 votes
4 answers
104k views

What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?

AES has several different variants: AES-128 AES-192 AES-256 But why would someone prefer use one over another?
samoz's user avatar
  • 3,236
77 votes
1 answer
60k views

Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?

I've studied that the Bleichenbacher's CCA attack on PKCS#1 v1.5. is a base to many versions of attacks in the area. I'm trying to understand that attack, but every explanation I saw starts with the ...
Bush's user avatar
  • 2,130
70 votes
3 answers
115k views

Why shouldn't I use ECB encryption?

I'm using Java to generate encrypted strings, and I get this warning at build time: ECB encryption mode should not be used So I'm wondering why I shouldn't use ECB and what I can use instead?
Rogue's user avatar
  • 826
60 votes
2 answers
20k views

What makes a hash function good for password hashing?

Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the ...
You's user avatar
  • 703
5 votes
2 answers
3k views

Discrete Logarithm: What does it mean to find the discrete logarithm of $a$ to base $g$ modulo $p$?

My understanding is that $a=g^x\bmod p$ is the discrete logarithm problem. Given the question is worded this way, are we trying to find $x=\log_g a\bmod p$ ? For instance, if we are trying to compute ...
Dennis Cheryshevv's user avatar
189 votes
23 answers
29k views

Time Capsule cryptography?

Does there exist any cryptographic algorithm which encrypts data in such a way that it can only be decrypted after a certain period of time? The only idea that I can think of, is something like this: ...
user avatar
25 votes
2 answers
22k views

How bad it is using the same IV twice with AES/GCM?

I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP ...
Matteo Monti's user avatar
  • 1,407
22 votes
5 answers
9k views

Using CBC with a fixed IV and a random first plaintext block

What if, instead of using CBC mode in the normal way with a random IV, I used this approach: Use a fixed IV (like a block of 0's). Before encrypting, generate a random block and prepend it to the ...
danieltorres's user avatar
19 votes
4 answers
5k views

Is SHA-256 secure as a CTR block cipher?

Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x. We represent numbers in simple binary instead of a counting function. <...
Jordan's user avatar
  • 575
61 votes
2 answers
19k views

Why is $H(k\mathbin\Vert x)$ not a secure MAC construction?

If $H(m)$ is a secure hash function, can't we implement a MAC using $H(k\mathbin\Vert m)$? However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash ...
Anne Nonimus's user avatar
47 votes
4 answers
34k views

Security strength of RSA in relation with the modulus size

NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits: ...
Gilles 'SO- stop being evil''s user avatar
37 votes
4 answers
10k views

Why is plain-hash-then-encrypt not a secure MAC?

It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why? Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
ithisa's user avatar
  • 1,101
24 votes
2 answers
15k views

Purpose of DES parity bits

DES has a 64-bit key size, but only 56 of those are used during encryption. The other 8 are "parity bits". What was the intended purpose of the party bits, and why are they no longer used in modern ...
user avatar
15 votes
2 answers
3k views

The effect of truncated hash on entropy

Suppose I have a 128-bit random binary string (128 bits of entropy), then I hash it using SHA-256, then I take the first 128 bits of the output hash. Does the taken bit string still have (almost) 128 ...
user40602's user avatar
  • 517
13 votes
4 answers
8k views

Disadvantages of AES-CTR?

On paper, it sounds *very* good to me: secure fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
hanshenrik's user avatar
32 votes
3 answers
6k views

Are common cryptographic hashes bijective when hashing a single block of the same size as the output?

It's been said that CRC-64 is bijective for a 64-bit block. It the corresponding statement true for typical cryptographic hashes, like MD5, SHA-1, SHA-2 or SHA-3? For example, would SHA-512 be ...
SDL's user avatar
  • 1,867
72 votes
4 answers
41k views

How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?

RSA is not designed to be used on long blocks of plaintext like a block cipher, but I need to use it to send a large (encrypted) message. How can I do this?
samoz's user avatar
  • 3,236
26 votes
4 answers
6k views

Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?

Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
fgrieu's user avatar
  • 140k
26 votes
4 answers
8k views

What makes Quantum Cryptography secure?

This is my current understanding of how Quantum Cryptography works: (The first bit is Quantum Key Distribution) Alice sends a beam of photons to Bob through a quantum channel such as an optical fiber. ...
lal lal's user avatar
  • 373
5 votes
3 answers
4k views

What is the point at infinity on secp256k1 and how to calculate it?

I hear that there should be a point at infinity on secp256k1. I wounder how to calculate it and what does it even mean. I tried to calculate it as $P_{inf}=P+(-P)$ but this gives different results for ...
PouJa's user avatar
  • 194

15 30 50 per page
1
2 3 4 5
98