51

Here's a very simple timing side channel attack that you might even see in movies. Suppose you're trying to log in to a computer with a password, and the victim compares your password byte by byte but stops early if there's a mismatch: for (i = 0; i < n; i++) if (password[i] != input[i]) return EFAIL; How do you attack this? Try a password like ...


20

This is an attempt to an Explain to me like I'm five style answer: Assume you have a bank vault with a mechanical combination lock. Your cipher in this case is "combination lock". At first sight it has two channels that the attacker can see and interface to The rotation on the input dial (an input channel) and the open/close status of the vault door (an ...


17

RSA-768 took 2000 years of 2.2Ghz single-core Opteron from the year 2009. DJB et al wrote in 2013 (see page 30) (see also: 29C3: FactHacks (EN); slide 87/112; about 10 minutes) that RSA-1024 would take $2^{70}$ differences with $2^{24}$ per machine per second in 2009, so 2 million years. Hardware improved since then, and GNFS can use GPUs, so maybe better, ...


17

Though quantum computers fit the requirements, I'm not sure they are the best option. A general purpose quantum computer capable of attacking modern encryption (RSA, AES) would have serious ramifications on society. It's not only applicable to this one cipher you are breaking. Does it have to be the superior computing resources which gives the good guys the ...


11

The purpose of Diffie-Hellman is solely to establish a shared key, $K$. Taken from Wikipedia: Traditionally, secure encrypted communication between two parties required that they first exchange keys by some secure physical means, such as paper key lists transported by a trusted courier. The Diffie–Hellman key exchange method allows two parties that have ...


9

Per the definition of RSA in PKCS#1v2.2 In a valid RSA private key, the RSA modulus $n$ is the product of $u$ distinct odd primes $r_i$, $i=1$, $2$, …, $u$, where $u\ge2$. That makes $n=3\cdot5=15$ the smallest public modulus. and the RSA public exponent $e$ is an integer between $3$ and $n–1$ satisfying $\operatorname{GCD}(e,\lambda(n))=1$, where $\...


8

$$\texttt{NO}$$ In short; $$\text{We are living in a world where that is ruled by Kerckhoffs's principles}$$ The above may not be totally clear as indicated by Maarten in the comments. The We is the Modern Cryptographers, the World is used for the Cryptography,... In other words, and better; $$\text{Modern Cryptography keeps to Kerckhoff's principles}$$ ...


8

I didn't want to delete this question, but it seems like after pondering this for a week I finally understand right when I seek help online. When the ring setting and the rotor position all increase by the same amount, they cancel and so the ring pretty much stays the same. Although the contact points of the ring to the alphabet ring is different, it makes ...


7

You wouldn't be a Dave for presenting RSA, but you would be a Dave for following this description to implement anything, and you risk creating Daves with this presentation. I'm not saying you shouldn't do it, but you should emphasize that this is only the mathematical basis of RSA and a lot more is involved in making it do something useful. Your description ...


6

No, If we assume that the mythical computer can brute force the multiple AES encryptions and there are many ciphertexts available which are encrypted under the same key and their corresponding plaintext are not random. The brute-force code can keep track of the meaningful plaintexts for each ciphertext and finally can perform an intersection of possible key ...


6

There is no known classical algorithm that can factor a 2048-bit modulus in feasible time. Shor's algorithm could do it in feasible time but this algorithm needs to be run on a large-scale quantum computer and as of now there are too many obstacles to create a large-scale quantum computer.


6

A cryptographic key is a string of bits. For example, AES-128 uses 128 bits, each one of them being either 0 or 1. To be able to encrypt or decrypt, each one of those 128 bits must be set correctly. This key is the input to the encryption algorithm. For AES-128 it has to be exactly 128 bits - not more nor less. For humans, remembering 128 bits (= 16 bytes) ...


6

Regarding your understanding You mostly have things right, but not completely. a password is a (preferably) mnemonic string that is fed into a function that generates a much longer and complex string that nobody knows, the user included. The encryption key is what is actually used to encrypt and decrypt a file. This is true apart from “preferably mnemonic”....


6

Party B will eventually succeed; still, to keep a modicum of suspense up, it must still be possible for them to fail An approach that will allow party B to succeed nonetheless To me the obvious solution is strategy and HUMINT. With algorithms at the time, say bcrypt and AES-256, plus a high entropy password, party A would spend eternity either attacking ...


6

No, there is generally no time factor when it comes to decryption. However, you should remember that even a single changed bit can cause decryption to fail. This is especially the case if that bit is part of the IV, authentication tag or nonce. So I'd rather worry about storage of keys and data. Disks may get stuck, flash may degrade or loose voltage ...


5

This scheme suffers from a classic problem of textbook RSA which is mitigated e.g. by RSA-KEM (as outlined by kelalaka) or RSA-OAEP. When you compute $k^3\bmod N$, you'll experience that $$c=k^3\stackrel{k< 2^{256}}{\leq}\left(2^{256}\right)^3=2^{768}\ll 2^{2000}<N$$ Now remember how $x\bmod N$ works: If $x\geq N$, then you recursively compute and ...


5

Well, it's good that you're trying to learn. However, learning from the original seminal papers does have some issues that you need to be aware of. For one, sometimes the original authors did not anticipate some issues that later contributions found (and for which common practice adjusted for). For example, it is now recognized that public key encryption ...


5

It's nice to see SciFi authors consulting professionals for technical viability problems. I've got something on my mind for you to consider. This is what I need: An algorithm such that, if you encrypt a file with it using a high-entropy password, is beyond any brute-force attempts using known methods and tech. There was a joke a while back in the NIST Post-...


4

What you describe is a little away from the RSA-KEM (KEM : Key Encapsulation Mechanism). As pointed out by SEjPM, in the comments, an AES-128 key when encrypted with the public modulus has almost 768 bits and this can be recovered by the cube-root attack. Here is the RSA-KEM; RSA-KEM mitigates the attack that you have. RSA-KEM for a single recipient with ...


4

Alice and Bob's keys are used to compute a shared key. Both parties compute the same key, which is used both encryption and decryption. This is a traditional, hybrid encryption system. Using only asymmetric cryptography for encryption would be painfully slow. As a mitigation, the sender can create an ephemeral key pair, deleted right after the message ...


4

the answer provided by @thesquaregroot is sufficient. However, I will only add the following: We can achieve something similar to RSA encryption by using Diffie-Hellman construction. This can be done by using ElGamal encryption scheme. Suppose say a server has the secret-public key pair ($s, y=g^s$). To send a message to the server, you proceed as follows: ...


4

Natural language has a nonuniform distribution. If a character $x$ appears $N_x$ times in a candidate decryption with $N$ characters, the sample entropy estimate will be $$ \sum_{x \in X} (N_x/N) \log (N/N_x) $$ by Shannon’s formula, where $X$ is the set of characters. If the decryption is incorrect (wrong key guess) this value will be high, nearly equal to ...


4

The symmetric encryption algorithms require keys with good entropy. Usually, humans tend to have passwords with bad entropy then they are crackable There are well-known cracker programs like John the Ripper and hashcat, and rainbow tables. Today, we have better password mechanisms like Dicewire so that the entropy of the password can be much longer. In any ...


4

TL;DR: The explanation in the article below is a little bit irritating but it seems to me that it's still possible to decrypt all messages at any time, as it is normal for any symmetric ciphers. You can decrypt the message, provided you have the necessary key. As this article (PythonInformer) explains in section "Decrypting a message": decrypt ...


3

In OpenSSL there is an -nopad option. If you don't want the OpenSSL removing the padding bytes, add the -nopad option. openssl enc -d -nopad -aes-128-ecb -in encrypted.txt -K 0123456789 -v -out decrypted.txt Note that you cannot see as C because the OpenSSL doesn't print in hex. To see in hex you can use xxd command xxd -r decrypted.txt 00000000: ...


3

Since this is an exercise, I'll provide the links of the articles as a hint; The linearity of the messages is first studied when $e=3$ Low-Exponent RSA with Related Messages by Don Coppersmith, Matthew Franklin, Jacques Patarin, Michael Reitert, EUROCRYPT 1996: Advances in Cryptology — EUROCRYPT ’96 pp 1-9 A more general case, where $e$ is not limited to ...


3

When you cascade two ciphers with independent keys, $E_{k_1,k_2}\colon x \mapsto \operatorname{AES}_{k_2}(\operatorname{AES}_{k_1}(x))$, the intelligent adversary will use a parallel collision search for a meet-in-the-middle attack at far less than $2^{128}$ or $2^{256}$ times the cost of a search for $k_1$ or $k_2$ alone. So this technique doesn't improve ...


3

Are there any big problems with the above? Does it present the idea of RSA correctly? What gotchas should I mention, if any? Alice says out loud: "Very well, the public key is (n=391, e=75)!" In general, the public key needs to be transmitted by an authenticated channel. Otherwise, Eve can simply say "I'm Alice, here's my public key". This would leave ...


3

RSA is based on some mathematical theorems. The first theorem that you need to learn is the Euler's Theorem; if $n$ and $a$ are coprime positive integers, then $$a^{{\varphi (n)}}\equiv 1\bmod n.$$ when $n$ is a prime it is the Little Fermat Theorem. This theorem tell us that in the power we use modulo $\varphi(n)$, i,e, $$a^{x} \equiv a^{x \bmod\varphi(n)...


3

How is asymmetric cryptography safe under these conditions? Well, you sort of outlined (but see kelalaka's corrections) how you would use asymmetric crypto to do authentication; that is, to make sure that the message was actually sent from $A$. You ask "how does that provide privacy?". The answer, of course, is "if that's all you do, it doesn't". If we ...


Only top voted, non community-wiki answers of a minimum length are eligible