59

Encrypt your document, and embed a web address (and login details) in the packaging from which a reader can get the decryption key. The website must be trusted. The website logs will tell you when software has requested the key to decrypt it. If you also want to protect confidentiality, encrypt with two keys. One is the usual private key used to protect ...


22

With classical information, there is no way as you correctly surmise: someone could always duplicate the data. However with quantum information there is a no-cloning theorem. With quantum information it is possible to bound the amount of information that has been extracted from a system based on the fidelity of the system. This gives the concept of tamper ...


13

Not with a file, as you say in your question You can always take a bitwise copy of a file. Always. Even if some specific OS makes it inconvenient, you can change to an OS which does let you. This leaves you with two possibilities for confirming opening. The file is encrypted in some way which requires you to access an external website to get the key, and ...


8

Slightly tongue-in-cheek answer, but why not put the document on a usb key, then put the usb key in a box and wrap it with the tamper evident physical seals you pictured. That way the document is secure (inside the box) and people will know if anyone has attempted to read the data (because of the physical seals you have to break to get at the usb key).


7

From the security perspective, they should require 128-security. Why? NIST has a requirement for a minimum security strength of 112 bits for all things cryptographic, at least for the present. You see it everywhere in their documents. For example, in Transitioning the Use of Cryptographic Algorithms and Key Lengths it says For the Federal Government, a ...


5

Single target with bitcoin miners We can approximate the reasoning with Bitcoin miner and hashcat comparisons. Bitcoin miner can reach $\approx 2^{92}$ double SHA256 per year. They are using various computing platform that includes CPUs, GPUs, ASICs. For a rough comparison, assume that the peak is achieved with Nvidia RTX 2080 and KeePass 1 is using AES ...


4

Arnaud asked me to clarify this issue. It is true that one should use an authenticated encryption mode or encrypt-then-MAC, and the paper says that explicitly. Indeed, the explanatory text in the paper following the figure shown above (Section 5.2 of https://webee.technion.ac.il/~hugo/sigma-pdf.pdf) addresses this issue. It says: We stress that the ...


4

I have a solution that may satisfy you Splitting the file into parts and chaining is a solution for you. To prevent the truncation we will use the associated data, that same for the first and last. Assume that you divide the file into $n$ parts each around 16KB ( need adjustments). Encrypt each of them with $\operatorname{AES-GCM}$ with the following ...


4

I believe this is simply a statement of the intention to meet the submission requirements set out by NIST for lightweight ciphers. Note that the paper linked in the question refers to "security goals". As per section 3.1: An AEAD algorithm shall not specify key lengths that are smaller than 128 bits. Cryptanalytic attacks on the AEAD algorithm ...


4

I'll choose a more generic approach which can be applied even to non-digital. Minor note, I can re-tape the package from your photo or reproduce my copy of the seal. It's a matter of how well made it has to be to fool you. The premise here is to have a way to do something (digitally) and preserve a state of it. However, for that to not be tampered with you ...


4

Signatures provide one property that MACs don't: non-repudiation. With only a MAC (or an AEAD) any party with the secret key could have sent the message. So Bob could forge a message and claim Alice sent it. With a signature only the party holding the corresponding private key could have created the signature. MACs authenticate the message, not the sender. ...


3

How would one go about adding key commitment to an AEAD like AES-GCM or ChaCha20-Poly1305? First off, let us start by reviewing how AES-GCM/Poly1305 works internally (and how these key commitment attacks work). Here's a top level overview of how they work (and AES-GCM and Poly1305 work largely the same at this level): first the ciphertext and AAD are ...


3

I went through this decision process in 2018 and ended up going with something very conservative: encrypt-then-MAC with AES-256-CBC and HMAC-SHA-512 truncated to 256 bits. Why SHA-512 over SHA-256? SHA-512 is faster on 64-bit machines. (Though recent AMD processors' SHA-256 instructions yield a 4x speed-up: link). Why AES-256 over AES-128? https://blog....


3

Re-using RSA key pairs for both encryption and signing is catastrophic, since it leaks the private key. So two pairs of keys will be needed. RSAES-OAEP is a system that allows RSA to encrypt short (shorter than the modulus) messages. It's slow, and the length restriction is a big limit, but it does work. RSASSA-PSS is a system for signing messages using RSA. ...


3

As I understand, GCM will also be broken by quantum computing The idea that GCM would be broken is, at best, questionable; it is broken only in the scenario where you allow the attacker to make entangled queries, and is returned entangled answers. That is, for this to be an applicable attack, the implementation under attack must also be a Quantum ...


3

the length of the encrypted text (which is the length field in the record header) is not known until the encryption is done The length of the ciphertext is known as soon as the length of the plaintext is known. This is true for any non-broken encryption mechanism. An adversary can easily observe the length of the ciphertext, and if that allows the adversary ...


2

Digital signature with message recovery does not provide confidentiality. It transmits a message with proof of origin and assurance of integrity, in a more compact way than transmitting the message and its signature separately. It happens that the message is unintelligible without the signer's public key, but since it is public, there's no assurance of ...


2

In cryptographic operation modes that require the initialization vector to be non-repeated rather than random, the initialization vector is called "nonce" (number used once). Do not design the implementation of a mode if you cannot fulfill the requirements of the mode. For example, if a mode depends on a uniqueness of the initialization vector, you ...


2

The documentation is a bit misleading about crypto_secretbox_xsalsa20poly1305 that uses a 16-byte authentication tag of poly1305. The libsodium has more clear explanation on it. From Bernstein' paper's abstract; Poly1305-AES computes a 16-byte authenticator of a variable-length message, using a 16-byte AES key, a 16-byte additional key, and a 16-byte nonce ...


2

All that this part in the introduction is really saying is that identification is important to IoT. Much as we can say that, for electronic banking transactions, privacy is important (because otherwise people could read your financial transactions) but authentication is more important (because otherwise people could actually steal your money, which is worse),...


2

No, it is not!. If you signed a message to someone before then they can use this to send an anonymous message to Bob and Bob may consider that it is coming from Alice. The solution is easy, use crypto_box (Authenticated encryption of the NaCl) to produce a message and send it with crypto_box_seal. $$\text{crypto_box_seal}(\text{crypto_box}(m)).$$ Here we are ...


2

In general, we always assume that the mode of operation is known ahead of time. In practice, this should be bound to the key - if the key is only used for a single mode of operation then the above shouldn't happen. However, if the same key is used for multiple modes of operation, then the mode ID should be made part of the ciphertext and therefore included ...


2

Give each stakeholder a part of the secret key so that no subset of all intereested parties can decrypt the message. They all have to cooperate and share their parts in order to decrypt and they all have control over when they release their part to the others.


2

Short answer: AEAD is completely the wrong tool for the job. You need a MAC, or perhaps a hash. Here are two important facts about cryptography: Details matter. You can't just take a good, secure construction and modify it and expect it to remain secure. Cryptography is not limited to encryption. from my side because i dont need to decrypt the ciphertext ...


2

Although it is not forward secure against client-side compromise (i.e. disclosure of the user agent's long term private key), it is forward secure against server-side compromise (i.e. disclosure of all information available to the server). Thus, for example, if ownership of the application server is transferred from one company to another and the user's ...


2

First, authenticated encryptions based on universal MACs (UMACs) can have their tags computed from blocks of message in random order. This is because UMACs are often based on integer or binary polynomial addition and multiplication, which are associative and commutative operations. Based on this, AES-GCM and ChaCha20-Poly1305 may satisfy your needs. For ...


2

"Straightforward" is a relative term. There are algorithms. The basic outline for one of them is First factor the polynomial into square-free factors using the Square-Free Factorization Algorithm. For each square-free factor found in step 1, factor it into a products or factors of the same degree (Distinct Degree Factorization). Use the Cantor-...


2

It depends on the algorithm. The Kerberos specification states that the encryption and decryption functions must handle integrity checking, but the algorithm specified must define this behavior. The only reasonably secure Kerberos algorithm types that Windows supports are aes128-cts-hmac-sha1-96 and aes256-cts-hmac-sha1-96. Neither of these are great ...


2

CAESAR competition did not result in any standard. I think it is because AES-GCM is already widely adopted (with hardware support, although some CAESAR algorithms also use AES) and CAESAR didn't bring anything significantly new. For example OCB was known before, but it is not widely adopted because it is patented (seems like patents have expired now). I ...


1

The partition oracle attack works if the oracle returns information like the tag is correct or not. Without a response, there is no Oracle at all. The information can also be obtained from side-channels, too. The partition oracle simply speeds up the password attack by grouping the passwords. The passwords are selected from a possible set of password list $\...


Only top voted, non community-wiki answers of a minimum length are eligible