67
votes
Cryptography algorithms that take longer to solve on a GPU than a CPU
This specific situation is a central part of the analysis of password hashing functions. Indeed, for hashing a password, we want a function which is:
slow in a tunable way;
such that the most cost-...
- 86.6k
46
votes
Accepted
HMAC vs ECDSA for JWT
The distinction is that ECDSA solves a problem that HMAC does not. If you need that problem solved, then you need to do ECDSA rather than HMAC; if you do not, then HMAC works just as well (and is a ...
- 145k
42
votes
Accepted
Are checksums essentially non-secure versions of cryptographic hashes?
Are checksums basically toned-down versions of cryptographic hashes? As in: they are supposed to detect errors that occur naturally/randomly as opposed to being designed to prevent a knowledgeable ...
- 32k
38
votes
Are there any advantages in using proprietary encryption?
Yes, there are advantages to the attacker.
Using a well vetted encryption algorithm provides a better assurance of security. There may be cryptographic algorithm flaws and/or coding mistakes.
As ...
- 917
37
votes
Accepted
What are recommended, general strategies to start block-cipher design and/or analysis?
In order to design and analyze a cipher, we have to establish what a cipher is supposed to accomplish. Put simply, we would like to be able to transform information in such a way that only those who ...
- 19.5k
36
votes
Accepted
How are the functions used in cryptographic hash functions chosen?
The functions considered are binary functions of 3 bits to 1 bit (extended to bit vectors, that is bitwise functions). There are $2^{(2^3)}=256$ such functions.
All the functions considered are ...
- 138k
35
votes
Why is this not a viable key exchange algorithm?
I've simplified the Alice random bytes to ARB and Bob random bytes to BRB. Then the protocol follows as;
Alice knows $key$ and $ARB$ and sends $$C_1 = key \oplus ARB$$
Bob knows $C_1$ and $BRB$ and ...
- 47.6k
34
votes
Accepted
Creating cryptographic algorithms at runtime
This doesn't add new security as much as it just shifts it.
Encryption algorithms are carefully studied. Hmm... I didn't make that emphatic enough. Encryption algorithms are C A R E F U L L Y ...
- 3,231
33
votes
Accepted
Is it possible for a cryptographic algorithm to limit the number of times a package/ciphertext can be decrypted?
Cryptography itself cannot solve this problem. This problem has long been studied in the field of copyright management to prevent piracy.
The main issue is that it is difficult to keep a state in the ...
- 4,148
32
votes
Accepted
Do identical strings always have the same SHA-256 value?
Yes, if you hash the same input with the same function, you will always get the same result.
This follows from the fact that it is a hash-function. By definition a function is a relation between a ...
- 6,612
28
votes
What are recommended, general strategies to start block-cipher design and/or analysis?
There is no such thing as a clearly defined, unambiguous, optimal learning path. However, drawing from my own experience, I would suggest tackling the following in due sequence:
Linear cryptanalysis: ...
- 86.6k
28
votes
If Kerckhoff's Principle holds, why do we need a cipher at all?
...why go through the trouble of creating a cipher in the first place? Why not simply use a ridiculously long key, if you're gonna create a cipher that only takes as long as an exhaustive key search ...
- 19.5k
26
votes
Accepted
Theoretically, what if I were to change some magic numbers in, say, AES?
How are these (magic) numbers chosen?
It heavily depends on what algorithm and which of its magic numbers. They seldom are entirely arbitrary. In AES, it is often taken the lowest value such that a ...
- 138k
23
votes
Accepted
Are there any (asymmetric) cryptographic primitives not relying on arithmetic over prime fields and/or finite fields?
Braid cryptography? Knapsack cryptosystems, like Nasako–Murikami?
Lattice-based cryptography tends to work in polynomial rings or modules with coefficients in finite fields, but whose higher-level ...
23
votes
Accepted
What can make an implementation of a large integer library unsafe for cryptography
Some large integer libraries can be unsafe to use for writing cryptographic algorithms
Yes. Leaving aside plain bugs (buffer overflows, incorrect result in edge cases), there is the issue of side ...
- 138k
22
votes
What is the difference between key size and block size (for AES)?
The key size is simply the amount of bits in the key. With AES, like most modern block ciphers, the key size directly relates to the strength of the key / algorithm. The higher the stronger. Since all ...
- 91.9k
22
votes
Accepted
Why is Pearson hash not used as a cryptographic hash?
Observation:
An individual 1-byte pearson hash behaves like an 8 bit block cipher, encrypting the initial state using the message as key. This means that given a fixed message, each possible initial ...
- 24.8k
22
votes
Why is the permutation in AES (and other ciphers) not random or key-dependent?
You have clarified the question as asking about whether replacing ShiftRows with a random byte permutation would strengthen AES against differential attacks. It would not.
ShiftRows and MixColumns ...
- 4,405
22
votes
Accepted
How to prove security of a randomized encryption algorithm?
What you want to do is the right way. However it's not an easy one.
What you really want to do is to show the following implication:
$$
\newcommand{\hard}{\operatorname{hard}}
\newcommand{\assumption}...
- 45.7k
21
votes
HMAC vs ECDSA for JWT
To add to poncho's answer (since they beat me to it!), there are several advantages to choosing HMAC over ECDSA (or RSA) if you can get away with it:
Insanely better performance: signing and ...
- 2,824
21
votes
Accepted
Why is CRC said to be linear?
In practice, CRC operations are often started with a nonzero state. Because of this, the actual equation is usually of the form:
$$crc(a) \oplus crc(b) = crc( a \oplus b ) \oplus c$$
for some ...
- 145k
21
votes
Accepted
Why does Signal repeatedly hash the secure passphrase?
Cryptographic hashes are designed to be fast and collision resistant. It turns out that when hashing passwords, it is more secure to have a slow hash function. One way to make a fast hash function ...
- 38.5k
20
votes
Is there a standard, or widely accepted convention, for magic constants in crypto software?
If you just need a constant to begin your algorithm, and the value of that constant isn't important, why not have a widely known convention to always use the digits of Pi or Phi or other well known ...
- 2,930
20
votes
Why is SHA-3 a Sponge function?
… SHA3 (Bouncycastle) constrains me …
Bouncycastle offers the NIST approved, fixed, and standardized output lengths of the keccak sponge function.
See, when talking about SHA-3, you're talking about ...
- 17.8k
19
votes
If Kerckhoff's Principle holds, why do we need a cipher at all?
Edit: I wrote the below on autopilot with the definition in the question. I have since realised an additional mistaken detail: the rule about no attacks better than key exhaustion is not called ...
- 1,032
19
votes
Creating cryptographic algorithms at runtime
Suppose you have two cryptosystems $A$ and $B$ with $n$-bit keys. Maybe they're both secure at what they aim to do; maybe they aren't. Say they both take about the same cost to implement.
You are ...
19
votes
Theoretically, what if I were to change some magic numbers in, say, AES?
The Wikipedia page on the Rijndael S-box describes how the numbers were chosen (Note: Rijndael was the winner of the competition that produced AES).
First, the input is mapped to its multiplicative ...
- 1,621
18
votes
Accepted
Are encryption algorithms with fixed-point free permutations inherently flawed?
Are all encryption algorithms with fixed-point free permutations inherently flawed?
Yes - when fixed points, or the lack of them, is knowable and detectable.
This is a violation of multiple ...
- 369
17
votes
Accepted
Where is the key in white-box AES cryptography?
In whitebox cryptography the attacker is supposed to have access to every detail of the computation and the goal of this implementation is to protect the key, to -usually- avoid it is used on a ...
- 3,294
17
votes
Accepted
DRM simple clone
I heard of DRM but could not get a reliable implementation of DRM
There is a good reason for this: DRM is a hard problem, and a solution to it could be leveraged to obtain incredible amounts of money....
- 19.5k
Only top scored, non community-wiki answers of a minimum length are eligible