All Questions
29,521
questions
420
votes
13
answers
181k
views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
- 86.4k
243
votes
2
answers
136k
views
What are the differences between a digital signature, a MAC and a hash?
A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind.
Which assurances does each primitive provide to the recipient?
What kind of keys are needed?
- 2,738
226
votes
8
answers
108k
views
How much would it cost in U.S. dollars to brute-force a 256-bit key in a year?
I am often told that any key can be broken and that it is only a matter of time and resources for any key to be broken. I know that this is technically true. However, I think that there is probably a ...
- 2,363
188
votes
22
answers
29k
views
Time Capsule cryptography?
Does there exist any cryptographic algorithm which encrypts data in such a way that it can only be decrypted after a certain period of time?
The only idea that I can think of, is something like this: ...
Jake
177
votes
4
answers
125k
views
Why is elliptic curve cryptography not widely used, compared to RSA?
I recently ran across elliptic curve crypto-systems:
An Introduction to the Theory of Elliptic Curves (Brown University)
Elliptic Curve Cryptography (Wikipedia)
Performance analysis of identity ...
- 1,975
173
votes
6
answers
129k
views
Why can't we reverse hashes?
First off, I know hashes are 1 way. There are an infinite number of inputs that can result in the same hash output. Why can't we take a hash and convert it to an equivalent string that can be hashed ...
- 1,847
172
votes
2
answers
177k
views
What is the main difference between a key, an IV and a nonce?
What are the main differences between a nonce, a key and an IV? Without any doubt the key should be kept secret. But what about the nonce and the IV? What's the main difference between them and their ...
- 6,120
164
votes
10
answers
45k
views
Why is writing your own encryption discouraged?
Say I want to write an encryption algorithm to communicate between me and my friend for this private use. How is that bad?
E.g. I can take the word Hello and ...
- 1,537
160
votes
4
answers
53k
views
Should we trust the NIST-recommended ECC parameters?
Recent articles in the media, based upon Snowden documents, have suggested that the NSA has actively tried to enable surveillance by embedding weaknesses in commercially-deployed technology -- ...
- 36.1k
148
votes
5
answers
128k
views
What is a cryptographic "salt"?
I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it.
Can I get a ...
- 1,611
147
votes
1
answer
50k
views
Why does my SSH private key still work after changing some bytes in the file?
I (for a test) just randomly altered a private RSA key by opening it up in Vim and changing a few bytes. It is the private part of an SSH key pair used for logging in on a remote system. Puzzlingly, ...
- 1,093
146
votes
7
answers
106k
views
Should we sign-then-encrypt, or encrypt-then-sign?
Frequently, we want to send messages that are (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers ...
- 5,544
145
votes
1
answer
225k
views
What are the differences between .pem, .csr, .key, .crt and other such file extensions?
I'm new to SSL / TLS, and I want to work with the OpenSSL toolkit.
What do .pem and .csr stand for?
I do know that ...
- 4,355
130
votes
7
answers
86k
views
How big an RSA key is considered secure today?
I think 1024 bit RSA keys were considered secure ~5 years ago, but I assume that's not true anymore. Can 2048 or 4096 keys still be relied upon, or have we gained too much computing power in the ...
- 1,567
127
votes
7
answers
223k
views
Are there two known strings which have the same MD5 hash value?
Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?
Adban
120
votes
7
answers
116k
views
Taking advantage of one-time pad key reuse?
Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel. Alice and Bob have a shared key $k$; however, both messages are the same length as the ...
- 1,661
117
votes
4
answers
77k
views
How should I calculate the entropy of a password?
If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
- 1,957
104
votes
3
answers
23k
views
If WhatsApp cannot read our message, how can the media forwarding happen in an instant?
WhatsApp says even the photos shared on its platform are end-to-end encrypted. When WhatsApp says encrypted I assume the data is encrypted in my device and then sent across to the recipient.
When we ...
- 973
104
votes
2
answers
20k
views
What is the new attack on SHA-1 "SHAttered" and how does it work?
There's a new recent Attack on SHA-1 named "SHAttered" by Google and some researchers. I understand that it uses some fancy new techniques, but not the details.
My question is: How?
How does the ...
- 45.6k
99
votes
3
answers
116k
views
Why haven't any SHA-256 collisions been found yet?
I've been thinking about this for a few days, a SHA-256 algorithm outputs 64 characters which can either be a lowercase letter or a number from 0-9. Which should mean that there are 64^36 distinct SHA-...
- 1,133
98
votes
1
answer
162k
views
What is the difference between PKCS#5 padding and PKCS#7 padding
One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
- 91.1k
97
votes
6
answers
96k
views
How can I generate large prime numbers for RSA?
What is the currently industry-standard algorithm used to generate large prime numbers to be used in RSA encryption?
I'm aware that I can find any number of articles on the Internet that explain how ...
- 1,377
96
votes
2
answers
35k
views
Why doesn't SSH use TLS?
Most cryptographically protected protocols use TLS these days. This applies to mail protocols, HTTP and many others. The newly designed QUIC has also adopted TLS as its cryptography layer.
However, ...
- 1,247
95
votes
2
answers
27k
views
What is the "Random Oracle Model" and why is it controversial?
What is the "Random Oracle Model"? Is it an "assumption" akin to the hardness of factoring and discrete log? Or something else?
And why do some researchers have a strong distrust of this model?
- 4,098
95
votes
4
answers
45k
views
Does Schnorr's 2021 factoring method show that the RSA cryptosystem is not secure?
Claus Peter Schnorr recently posted a 12-page factoring method by SVP algorithms. Is it correct?
It says that the algorithm factors integers $N \approx 2^{400}$ and $N \approx 2^{800}$ by $4.2 \cdot ...
- 1,582
94
votes
8
answers
27k
views
How is CipherCloud doing homomorphic encryption?
Much of the literature and latest papers suggest that homomorphic encryption is still not practical yet.
How is CipherCloud able to achieve this? Does anyone have an idea? Their website does not ...
- 6,124
94
votes
4
answers
24k
views
Has SHA256 been broken by Treadwell Stanton DuPont?
In a recent press release issued by Treadwell Stanton DuPont, the claim is made that their research laboratories have successfully broken all 64 rounds of the SHA256 hashing algorithm. They further ...
- 853
91
votes
3
answers
173k
views
How does RSA signature verification work?
I understand how the RSA algorithm works for encryption and decryption purposes but I don't get how signing is done.
Here's what I (think) I know and is common practice:
If I have a message that I ...
- 1,125
91
votes
2
answers
169k
views
What is the difference between CBC and GCM mode?
I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets ...
- 1,273
90
votes
5
answers
40k
views
Is AES-256 weaker than 192 and 128 bit versions?
From a paper via Schneier on Security's Another AES Attack (emphasis mine):
In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. However, ...
- 1,011
89
votes
8
answers
13k
views
Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
- 22.5k
88
votes
4
answers
103k
views
What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?
AES has several different variants:
AES-128
AES-192
AES-256
But why would someone prefer use one over another?
- 3,216
88
votes
10
answers
18k
views
In end-to-end encryption, doesn't the server need to be trusted?
Applications like WhatsApp use end to end encryption. WhatsApp says that only the users share a specific key and no third party can view the messages. But I do not understand how the two users agree ...
- 999
88
votes
3
answers
55k
views
What is the difference between a digest and a hash function?
I was wondering about the difference between these two terms...
What is the difference between a digest and a hash function?
- 991
87
votes
11
answers
11k
views
Is modern encryption needlessly complicated?
RSA, DES, AES, etc., all use (relatively) complicated mathematics to encrypt some message with some key. For each of these methods, there have been several documented vulnerabilities found over the ...
- 979
87
votes
5
answers
277k
views
How secure is AES-256?
The cipher AES-256 is used among other places in SSL/TLS across the Internet. It's considered among the top ciphers.
In theory it's not crackable since the combinations of keys are massive.
Although ...
- 1,065
83
votes
9
answers
136k
views
Should I use ECB or CBC encryption mode for my block cipher?
Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
- 1,151
78
votes
8
answers
24k
views
How do I explain zero knowledge proof to my 7 year old cousin? [duplicate]
How do I explain zero knowledge proof to my 7 year old cousin?
- 2,237
78
votes
12
answers
16k
views
Who is responsible for ensuring the trustworthiness of certificate authorities?
Background
I am a novice in the field of cryptography and cyber-security, and while studying asymmetric-key encryption, I learned about the potential of a man-in-the-middle attack.
To mitigate this ...
- 1,305
78
votes
5
answers
38k
views
How are primes generated for RSA?
As I understand it, the RSA algorithm is based on finding two large primes (p and q) and multiplying them. The security aspect is based on the fact that it's difficult to factor it back into p and q. ...
- 1,095
77
votes
8
answers
9k
views
Layman's explanation of encryption backdoors
In the media, I sometimes read about "backdoors" in encryption algorithms. I'd like to understand what such a backdoor actually consists of. Is it:
a) a hidden weakness in the math formulas ...
forthrin
77
votes
2
answers
170k
views
What is safer: ZipCrypto or AES-256?
Like in title: which one of these encryption methods (ZipCrypto, AES-256) is more secure and why? I am asking about it because I'd like to know which should be preferred when compressing files with ...
- 881
76
votes
4
answers
11k
views
How come Public key cryptography wasn't discovered earlier?
I became interested in crypto lately and read about symmetric and public key crypto algorithms. I understand how crucial the discoveries of the 1970s like RSA, DES and DH were in advancing the ...
- 919
76
votes
3
answers
86k
views
How does one attack a two-time pad (i.e. one time pad with key reuse)?
My question might appear the same as the question Taking advantage of one-time pad key reuse?, but actually I did read all the answers and none of them helped me with the details I need.
I am new to ...
- 963
76
votes
1
answer
58k
views
Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?
I've studied that the Bleichenbacher's CCA attack on PKCS#1 v1.5. is a base to many versions of attacks in the area.
I'm trying to understand that attack, but every explanation I saw starts with the ...
- 2,120
76
votes
3
answers
56k
views
Impacts of not using RSA exponent of 65537
This RFC says the RSA Exponent should be 65537. Why is that number recommended and what are the theoretical and practical impacts & risks of making that number higher or lower?
What are the ...
- 2,581
75
votes
1
answer
45k
views
How easy is it in 2022 to find a SHA1 collision?
Most of the answers I can find date to years back where the first collision(s) were found, but hardware mainly GPUs have progressed a lot in the past few years (with for example the new line of 3090s ...
- 739
73
votes
3
answers
24k
views
Signal vs Telegram in terms of protocols?
Some time ago, the question was asked in chat, why MTProto (Telegram's protocol) is supposedly worse than Axolotl (Signal's protocol) as both protocols have been the inventions of their respective ...
- 45.6k
72
votes
4
answers
40k
views
How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?
RSA is not designed to be used on long blocks of plaintext like a block cipher, but I need to use it to send a large (encrypted) message.
How can I do this?
- 3,216
71
votes
6
answers
61k
views
SHA-512 faster than SHA-256?
I'm getting this strange result that SHA-512 is around 50% faster than SHA-256. I'm using .net's SHA512Managed and SHA256Managed ...
- 1,965