New answers tagged

0

This answer is specifically about your statement "….the RSA-algorithm aka how things are encrypted/deciffered." RSA usually isn't used for encryption, and when it is it's never just the RSA algorithm. AES isn't used alone for encryption either! AES is a symmetric key algorithm, specifically a block cipher. It takes a key and an input block, and ...


1

Cryptographic algorithms are divided into two major groups: symmetric and asymmetric. Algorithms from the first group use one key, that must be kept secret. Algorithms from the second group use two different keys^ one of them must be kept secret too, but the second one is public. AES is a symmetric cipher, i.e. it uses one single key for encryption and ...


2

AES is a symmetric key algorithm, which means there is just one key, used both to encrypt and decrypt. This is different from RSA, where you have two keys - a private one and a public one, related in a specific way. AES keys are simply random bytes. For example, AES-128 uses 128-bit (16 byte) keys. So any random 128 bits can be used as an AES-128 key. There ...


3

We know Grover's algorithm speedup brute-force attacks two times faster in block ciphers (e.g brute-forcing 128-bit keys take 264 operations, not $2^{128}$). This is the advertisement of the Lov K. Grover's algorithm. Yes, it reduces the key search into $\mathcal{O}(\sqrt{2^n})$ instead of the $\mathcal{O}(2^n)$. What is generally not mentioned is the ...


0

For CTR, the requirement is that the counter value does not repeat (for a given key). The biggest gotcha with counter mode is that it is not enough for the IV (the initial counter value) not to repeat. It doesn't matter whether the counter value is predictable. If you can arrange for the counter to start at 0 and to increase by 1 for each message block, that'...


1

Here we made a distinction. $nonce \mathbin\|counterpart$ constitutes the $IV$ Is it a problem that the next IV is predictable? No, it is not a problem in the CTR mode, read more in [1]. The $IV= (nonce\mathbin\|counterpart)$ is encrypted and the ciphertext is x-ored with plaintext. $$C_i = \operatorname{AES-CTR}(nonce\mathbin\|encode(i)) \oplus P_i$$ As ...


1

The advantage of AES key wrap is that it verifies the integrity of the data. When decrypting, the resulting IV must be checked, and if it's not the initial value, the data has been tampered with. Using CFB is not a good mode of operation because it provides no integrity checking. If you want to use it, use it in the standard way, which is to provide a ...


2

AES stick guide is a nice introduction starting from low level to higher level. Also, I suggest reading the Rijndael book after that. The Design of Rijndael: The Advanced Encryption Standard (AES) 2nd edition This is the second edition after almost 20 years of the first edition. There is a great deal of everything from math to why did they choose the simple ...


0

Actually, even if the IV is fixed (say, to the all-zero value), then it is still possible to find a second message that has the same CBC-MAC, even if you don't know the key. Suppose you have a message $M$ with a CBC-MAC of $T$ (where the CBC-MAC processing used the IV $IV$); we'll also assume that $M$ is at least one block long. Then, the message $Pad(M) || ...


2

There are no theoretical or practical advantages when it comes to security, as the XOR with $R$ is easily reversed. Since the key is fully randomized and only dependent on the password, the security isn't degraded either. The XOR with a known value doesn't give any information to the attacker as both input and output are unknown - presuming your cipher / key ...


1

Your scheme has no forward secrecy. If an attacker obtains the server private key someday, all past sessions can be decrypted: Session keys can be decrypted and thus the corresponding sessions can be decrypted. See details here. You scheme is prone to replay attack. If the attacker intercepts the traffic and knows the meaning of particular part of the ...


1

There is a good reason to use zero-IV in CBC-MAC; if there is fixed no-Zero IV then an attacker can modify the $IV$ and $P_1$ so that the first block of the plaintext can become the advantage of the attacker. The first step of the CBC-MAC tag calculation is performed as $$C_1 = E_k(IV \oplus P_1)$$ Now let $P_1'$ be the target first block that the attacker ...


5

Contrary to Diffie-Hellman, this does not resist passive eavesdropping. An adversary capturing the network traffic will get the "freshly-generated keys" that "both peers send" in step 1, and can apply the algorithm of steps 2/3/4 to find the shared key that ultimately encrypts the traffic that follows.


2

Your scheme will be strong. AES ECB is resistant to preimage attacks. If somebody knows the plain text (in your scheme it is the name of the bank or the name of the web site) and knows the encrypted text, it is not possible to recover your password. See answers here: Finding key of AES in ECB mode Is it possible to guess an AES key from a series of messages ...


2

The SageMath has a great S-Box package that is heavily used by S-Box designers. If you are going to learn/play with S-Boxes you may benefit from this package. With Sbox Package (Try online) from sage.crypto.sbox import SBox #must be power of two otherwise error p = Permutations(range(16)).random_element() S = SBox(p); print("The permutation &...


2

SecureRandom.getInstanceStrong() will ensure that a strong algorithm (securerandom.strongAlgorithms) will is used. It is available since Java version 8. Check your version before starting to use. If no such algorithm is available in running VM, it will throw NoSuchAlgorithmException. This failure is a better practice instead of defaulting into weak ...


Top 50 recent answers are included