66 votes

Cryptography algorithms that take longer to solve on a GPU than a CPU

This specific situation is a central part of the analysis of password hashing functions. Indeed, for hashing a password, we want a function which is: slow in a tunable way; such that the most cost-...
Thomas Pornin's user avatar
42 votes
Accepted

Are checksums essentially non-secure versions of cryptographic hashes?

Are checksums basically toned-down versions of cryptographic hashes? As in: they are supposed to detect errors that occur naturally/randomly as opposed to being designed to prevent a knowledgeable ...
otus's user avatar
  • 32.1k
38 votes
Accepted

What are recommended, general strategies to start block-cipher design and/or analysis?

In order to design and analyze a cipher, we have to establish what a cipher is supposed to accomplish. Put simply, we would like to be able to transform information in such a way that only those who ...
Ella Rose's user avatar
  • 19.6k
36 votes
Accepted

How are the functions used in cryptographic hash functions chosen?

The functions considered are binary functions of 3 bits to 1 bit (extended to bit vectors, that is bitwise functions). There are $2^{(2^3)}=256$ such functions. All the functions considered are ...
fgrieu's user avatar
  • 141k
35 votes

Why is this not a viable key exchange algorithm?

I've simplified the Alice random bytes to ARB and Bob random bytes to BRB. Then the protocol follows as; Alice knows $key$ and $ARB$ and sends $$C_1 = key \oplus ARB$$ Bob knows $C_1$ and $BRB$ and ...
kelalaka's user avatar
  • 48.5k
34 votes
Accepted

Creating cryptographic algorithms at runtime

This doesn't add new security as much as it just shifts it. Encryption algorithms are carefully studied. Hmm... I didn't make that emphatic enough. Encryption algorithms are C A R E F U L L Y ...
Cort Ammon's user avatar
  • 3,261
33 votes
Accepted

Is it possible for a cryptographic algorithm to limit the number of times a package/ciphertext can be decrypted?

Cryptography itself cannot solve this problem. This problem has long been studied in the field of copyright management to prevent piracy. The main issue is that it is difficult to keep a state in the ...
Changyu Dong's user avatar
  • 4,178
32 votes
Accepted

Do identical strings always have the same SHA-256 value?

Yes, if you hash the same input with the same function, you will always get the same result. This follows from the fact that it is a hash-function. By definition a function is a relation between a ...
Maeher's user avatar
  • 6,818
28 votes

What are recommended, general strategies to start block-cipher design and/or analysis?

There is no such thing as a clearly defined, unambiguous, optimal learning path. However, drawing from my own experience, I would suggest tackling the following in due sequence: Linear cryptanalysis: ...
Thomas Pornin's user avatar
28 votes

If Kerckhoff's Principle holds, why do we need a cipher at all?

...why go through the trouble of creating a cipher in the first place? Why not simply use a ridiculously long key, if you're gonna create a cipher that only takes as long as an exhaustive key search ...
Ella Rose's user avatar
  • 19.6k
26 votes
Accepted

Theoretically, what if I were to change some magic numbers in, say, AES?

How are these (magic) numbers chosen? It heavily depends on what algorithm and which of its magic numbers. They seldom are entirely arbitrary. In AES, it is often taken the lowest value such that a ...
fgrieu's user avatar
  • 141k
23 votes
Accepted

Are there any (asymmetric) cryptographic primitives not relying on arithmetic over prime fields and/or finite fields?

Braid cryptography? Knapsack cryptosystems, like Nasako–Murikami? Lattice-based cryptography tends to work in polynomial rings or modules with coefficients in finite fields, but whose higher-level ...
Squeamish Ossifrage's user avatar
23 votes
Accepted

What can make an implementation of a large integer library unsafe for cryptography

Some large integer libraries can be unsafe to use for writing cryptographic algorithms Yes. Leaving aside plain bugs (buffer overflows, incorrect result in edge cases), there is the issue of side ...
fgrieu's user avatar
  • 141k
22 votes
Accepted

Why is Pearson hash not used as a cryptographic hash?

Observation: An individual 1-byte pearson hash behaves like an 8 bit block cipher, encrypting the initial state using the message as key. This means that given a fixed message, each possible initial ...
CodesInChaos's user avatar
  • 24.9k
22 votes

Why is the permutation in AES (and other ciphers) not random or key-dependent?

You have clarified the question as asking about whether replacing ShiftRows with a random byte permutation would strengthen AES against differential attacks. It would not. ShiftRows and MixColumns ...
J.D.'s user avatar
  • 4,445
22 votes
Accepted

How to prove security of a randomized encryption algorithm?

What you want to do is the right way. However it's not an easy one. What you really want to do is to show the following implication: $$ \newcommand{\hard}{\operatorname{hard}} \newcommand{\assumption}...
SEJPM's user avatar
  • 46k
21 votes
Accepted

Why is CRC said to be linear?

In practice, CRC operations are often started with a nonzero state. Because of this, the actual equation is usually of the form: $$crc(a) \oplus crc(b) = crc( a \oplus b ) \oplus c$$ for some ...
poncho's user avatar
  • 147k
21 votes
Accepted

Why does Signal repeatedly hash the secure passphrase?

Cryptographic hashes are designed to be fast and collision resistant. It turns out that when hashing passwords, it is more secure to have a slow hash function. One way to make a fast hash function ...
mikeazo's user avatar
  • 38.6k
20 votes

Is there a standard, or widely accepted convention, for magic constants in crypto software?

If you just need a constant to begin your algorithm, and the value of that constant isn't important, why not have a widely known convention to always use the digits of Pi or Phi or other well known ...
axapaxa's user avatar
  • 2,940
20 votes

Why is SHA-3 a Sponge function?

… SHA3 (Bouncycastle) constrains me … Bouncycastle offers the NIST approved, fixed, and standardized output lengths of the keccak sponge function. See, when talking about SHA-3, you're talking about ...
e-sushi's user avatar
  • 17.9k
19 votes

If Kerckhoff's Principle holds, why do we need a cipher at all?

Edit: I wrote the below on autopilot with the definition in the question. I have since realised an additional mistaken detail: the rule about no attacks better than key exhaustion is not called ...
Josiah's user avatar
  • 1,042
19 votes

Creating cryptographic algorithms at runtime

Suppose you have two cryptosystems $A$ and $B$ with $n$-bit keys. Maybe they're both secure at what they aim to do; maybe they aren't. Say they both take about the same cost to implement. You are ...
Squeamish Ossifrage's user avatar
19 votes

Theoretically, what if I were to change some magic numbers in, say, AES?

The Wikipedia page on the Rijndael S-box describes how the numbers were chosen (Note: Rijndael was the winner of the competition that produced AES). First, the input is mapped to its multiplicative ...
Eugene Styer's user avatar
  • 1,676
18 votes
Accepted

Understanding the wide trail design strategy

Given the importance of the wide-trail strategy in modern symmetric-key cryptography, this question really deserves an answer (and a much better score). Since nobody else has tried, I'll give a brief ...
Aleph's user avatar
  • 1,876
18 votes
Accepted

Are encryption algorithms with fixed-point free permutations inherently flawed?

Are all encryption algorithms with fixed-point free permutations inherently flawed? Yes - when fixed points, or the lack of them, is knowable and detectable. This is a violation of multiple ...
Natanael's user avatar
  • 369
17 votes
Accepted

Where is the key in white-box AES cryptography?

In whitebox cryptography the attacker is supposed to have access to every detail of the computation and the goal of this implementation is to protect the key, to -usually- avoid it is used on a ...
ddddavidee's user avatar
  • 3,324
17 votes
Accepted

DRM simple clone

I heard of DRM but could not get a reliable implementation of DRM There is a good reason for this: DRM is a hard problem, and a solution to it could be leveraged to obtain incredible amounts of money....
Ella Rose's user avatar
  • 19.6k
16 votes
Accepted

HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication

Both algorithms provide plenty of security, near the output size of the hash. So even though HMAC-512 will be stronger, the difference is inconsequential. If this ever breaks it is because the ...
Maarten Bodewes's user avatar
  • 92.6k
16 votes

Are there any (asymmetric) cryptographic primitives not relying on arithmetic over prime fields and/or finite fields?

Cryptography over quasi-fields (which are not field, but where non-invertible elements are hard to find) is very common. This includes many cryptosystems such as RSA, but also Rabin, Goldwasser-Micali,...
Geoffroy Couteau's user avatar
16 votes

Are encryption algorithms with fixed-point free permutations inherently flawed?

Are all encryption algorithms with fixed-point free permutations inherently flawed? No, they are not inherently flawed. Consider the following cipher: Let $k_0$ be a key for AES-256, and let $k_1$...
Squeamish Ossifrage's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible