67 votes

Cryptography algorithms that take longer to solve on a GPU than a CPU

This specific situation is a central part of the analysis of password hashing functions. Indeed, for hashing a password, we want a function which is: slow in a tunable way; such that the most cost-...
Thomas Pornin's user avatar
46 votes
Accepted

HMAC vs ECDSA for JWT

The distinction is that ECDSA solves a problem that HMAC does not. If you need that problem solved, then you need to do ECDSA rather than HMAC; if you do not, then HMAC works just as well (and is a ...
poncho's user avatar
  • 145k
42 votes
Accepted

Are checksums essentially non-secure versions of cryptographic hashes?

Are checksums basically toned-down versions of cryptographic hashes? As in: they are supposed to detect errors that occur naturally/randomly as opposed to being designed to prevent a knowledgeable ...
otus's user avatar
  • 32k
38 votes

Are there any advantages in using proprietary encryption?

Yes, there are advantages to the attacker. Using a well vetted encryption algorithm provides a better assurance of security. There may be cryptographic algorithm flaws and/or coding mistakes. As ...
zaph's user avatar
  • 917
37 votes
Accepted

What are recommended, general strategies to start block-cipher design and/or analysis?

In order to design and analyze a cipher, we have to establish what a cipher is supposed to accomplish. Put simply, we would like to be able to transform information in such a way that only those who ...
Ella Rose's user avatar
  • 19.5k
36 votes
Accepted

How are the functions used in cryptographic hash functions chosen?

The functions considered are binary functions of 3 bits to 1 bit (extended to bit vectors, that is bitwise functions). There are $2^{(2^3)}=256$ such functions. All the functions considered are ...
fgrieu's user avatar
  • 138k
35 votes

Why is this not a viable key exchange algorithm?

I've simplified the Alice random bytes to ARB and Bob random bytes to BRB. Then the protocol follows as; Alice knows $key$ and $ARB$ and sends $$C_1 = key \oplus ARB$$ Bob knows $C_1$ and $BRB$ and ...
kelalaka's user avatar
  • 47.6k
34 votes
Accepted

Creating cryptographic algorithms at runtime

This doesn't add new security as much as it just shifts it. Encryption algorithms are carefully studied. Hmm... I didn't make that emphatic enough. Encryption algorithms are C A R E F U L L Y ...
Cort Ammon's user avatar
  • 3,231
33 votes
Accepted

Is it possible for a cryptographic algorithm to limit the number of times a package/ciphertext can be decrypted?

Cryptography itself cannot solve this problem. This problem has long been studied in the field of copyright management to prevent piracy. The main issue is that it is difficult to keep a state in the ...
Changyu Dong's user avatar
  • 4,148
32 votes
Accepted

Do identical strings always have the same SHA-256 value?

Yes, if you hash the same input with the same function, you will always get the same result. This follows from the fact that it is a hash-function. By definition a function is a relation between a ...
Maeher's user avatar
  • 6,612
28 votes

What are recommended, general strategies to start block-cipher design and/or analysis?

There is no such thing as a clearly defined, unambiguous, optimal learning path. However, drawing from my own experience, I would suggest tackling the following in due sequence: Linear cryptanalysis: ...
Thomas Pornin's user avatar
28 votes

If Kerckhoff's Principle holds, why do we need a cipher at all?

...why go through the trouble of creating a cipher in the first place? Why not simply use a ridiculously long key, if you're gonna create a cipher that only takes as long as an exhaustive key search ...
Ella Rose's user avatar
  • 19.5k
26 votes
Accepted

Theoretically, what if I were to change some magic numbers in, say, AES?

How are these (magic) numbers chosen? It heavily depends on what algorithm and which of its magic numbers. They seldom are entirely arbitrary. In AES, it is often taken the lowest value such that a ...
fgrieu's user avatar
  • 138k
23 votes
Accepted

Are there any (asymmetric) cryptographic primitives not relying on arithmetic over prime fields and/or finite fields?

Braid cryptography? Knapsack cryptosystems, like Nasako–Murikami? Lattice-based cryptography tends to work in polynomial rings or modules with coefficients in finite fields, but whose higher-level ...
Squeamish Ossifrage's user avatar
23 votes
Accepted

What can make an implementation of a large integer library unsafe for cryptography

Some large integer libraries can be unsafe to use for writing cryptographic algorithms Yes. Leaving aside plain bugs (buffer overflows, incorrect result in edge cases), there is the issue of side ...
fgrieu's user avatar
  • 138k
22 votes

What is the difference between key size and block size (for AES)?

The key size is simply the amount of bits in the key. With AES, like most modern block ciphers, the key size directly relates to the strength of the key / algorithm. The higher the stronger. Since all ...
Maarten Bodewes's user avatar
  • 91.9k
22 votes
Accepted

Why is Pearson hash not used as a cryptographic hash?

Observation: An individual 1-byte pearson hash behaves like an 8 bit block cipher, encrypting the initial state using the message as key. This means that given a fixed message, each possible initial ...
CodesInChaos's user avatar
  • 24.8k
22 votes

Why is the permutation in AES (and other ciphers) not random or key-dependent?

You have clarified the question as asking about whether replacing ShiftRows with a random byte permutation would strengthen AES against differential attacks. It would not. ShiftRows and MixColumns ...
J.D.'s user avatar
  • 4,405
22 votes
Accepted

How to prove security of a randomized encryption algorithm?

What you want to do is the right way. However it's not an easy one. What you really want to do is to show the following implication: $$ \newcommand{\hard}{\operatorname{hard}} \newcommand{\assumption}...
SEJPM's user avatar
  • 45.7k
21 votes

HMAC vs ECDSA for JWT

To add to poncho's answer (since they beat me to it!), there are several advantages to choosing HMAC over ECDSA (or RSA) if you can get away with it: Insanely better performance: signing and ...
Tim McLean's user avatar
  • 2,824
21 votes
Accepted

Why is CRC said to be linear?

In practice, CRC operations are often started with a nonzero state. Because of this, the actual equation is usually of the form: $$crc(a) \oplus crc(b) = crc( a \oplus b ) \oplus c$$ for some ...
poncho's user avatar
  • 145k
21 votes
Accepted

Why does Signal repeatedly hash the secure passphrase?

Cryptographic hashes are designed to be fast and collision resistant. It turns out that when hashing passwords, it is more secure to have a slow hash function. One way to make a fast hash function ...
mikeazo's user avatar
  • 38.5k
20 votes

Is there a standard, or widely accepted convention, for magic constants in crypto software?

If you just need a constant to begin your algorithm, and the value of that constant isn't important, why not have a widely known convention to always use the digits of Pi or Phi or other well known ...
axapaxa's user avatar
  • 2,930
20 votes

Why is SHA-3 a Sponge function?

… SHA3 (Bouncycastle) constrains me … Bouncycastle offers the NIST approved, fixed, and standardized output lengths of the keccak sponge function. See, when talking about SHA-3, you're talking about ...
e-sushi's user avatar
  • 17.8k
19 votes

If Kerckhoff's Principle holds, why do we need a cipher at all?

Edit: I wrote the below on autopilot with the definition in the question. I have since realised an additional mistaken detail: the rule about no attacks better than key exhaustion is not called ...
Josiah's user avatar
  • 1,032
19 votes

Creating cryptographic algorithms at runtime

Suppose you have two cryptosystems $A$ and $B$ with $n$-bit keys. Maybe they're both secure at what they aim to do; maybe they aren't. Say they both take about the same cost to implement. You are ...
Squeamish Ossifrage's user avatar
19 votes

Theoretically, what if I were to change some magic numbers in, say, AES?

The Wikipedia page on the Rijndael S-box describes how the numbers were chosen (Note: Rijndael was the winner of the competition that produced AES). First, the input is mapped to its multiplicative ...
Eugene Styer's user avatar
  • 1,621
18 votes
Accepted

Are encryption algorithms with fixed-point free permutations inherently flawed?

Are all encryption algorithms with fixed-point free permutations inherently flawed? Yes - when fixed points, or the lack of them, is knowable and detectable. This is a violation of multiple ...
Natanael's user avatar
  • 369
17 votes
Accepted

Where is the key in white-box AES cryptography?

In whitebox cryptography the attacker is supposed to have access to every detail of the computation and the goal of this implementation is to protect the key, to -usually- avoid it is used on a ...
ddddavidee's user avatar
  • 3,294
17 votes
Accepted

DRM simple clone

I heard of DRM but could not get a reliable implementation of DRM There is a good reason for this: DRM is a hard problem, and a solution to it could be leveraged to obtain incredible amounts of money....
Ella Rose's user avatar
  • 19.5k

Only top scored, non community-wiki answers of a minimum length are eligible