# Tag Info

51

Here's a very simple timing side channel attack that you might even see in movies. Suppose you're trying to log in to a computer with a password, and the victim compares your password byte by byte but stops early if there's a mismatch: for (i = 0; i < n; i++) if (password[i] != input[i]) return EFAIL; How do you attack this? Try a password like ...

20

This is an attempt to an Explain to me like I'm five style answer: Assume you have a bank vault with a mechanical combination lock. Your cipher in this case is "combination lock". At first sight it has two channels that the attacker can see and interface to The rotation on the input dial (an input channel) and the open/close status of the vault door (an ...

17

RSA-768 took 2000 years of 2.2Ghz single-core Opteron from the year 2009. DJB et al wrote in 2013 (see page 30) (see also: 29C3: FactHacks (EN); slide 87/112; about 10 minutes) that RSA-1024 would take $2^{70}$ differences with $2^{24}$ per machine per second in 2009, so 2 million years. Hardware improved since then, and GNFS can use GPUs, so maybe better, ...

17

Though quantum computers fit the requirements, I'm not sure they are the best option. A general purpose quantum computer capable of attacking modern encryption (RSA, AES) would have serious ramifications on society. It's not only applicable to this one cipher you are breaking. Does it have to be the superior computing resources which gives the good guys the ...

11

The purpose of Diffie-Hellman is solely to establish a shared key, $K$. Taken from Wikipedia: Traditionally, secure encrypted communication between two parties required that they first exchange keys by some secure physical means, such as paper key lists transported by a trusted courier. The Diffie–Hellman key exchange method allows two parties that have ...

10

Can I modify encrypted data without accessing it? if there is an example appreciate it If access means altering the data without decryption as an attacker then the answer is yes for messages without integrity. Take OTP, execute bit flipping attack, done. Take CTR mode, execute bit flipping attack, done. Take CBC, execute bit flipping attack, done. ...

9

Per the definition of RSA in PKCS#1v2.2 In a valid RSA private key, the RSA modulus $n$ is the product of $u$ distinct odd primes $r_i$, $i=1$, $2$, …, $u$, where $u\ge2$. That makes $n=3\cdot5=15$ the smallest public modulus. and the RSA public exponent $e$ is an integer between $3$ and $n–1$ satisfying $\operatorname{GCD}(e,\lambda(n))=1$, where $\... 8 $$\texttt{NO}$$ In short; $$\text{We are living in a world where that is ruled by Kerckhoffs's principles}$$ The above may not be totally clear as indicated by Maarten in the comments. The We is the Modern Cryptographers, the World is used for the Cryptography,... In other words, and better; $$\text{Modern Cryptography keeps to Kerckhoff's principles}$$ ... 8 I didn't want to delete this question, but it seems like after pondering this for a week I finally understand right when I seek help online. When the ring setting and the rotor position all increase by the same amount, they cancel and so the ring pretty much stays the same. Although the contact points of the ring to the alphabet ring is different, it makes ... 8 If (and ONLY if) it was encrypted with a special "homomorphic" encryption scheme, then you can do the operations allowed by that scheme. Those are almost never used in practice currently (they're very slow, and an area of active research). This demo is quite good. More commonly data is encrypted using an "Authenticated Encryption with ... 7 You wouldn't be a Dave for presenting RSA, but you would be a Dave for following this description to implement anything, and you risk creating Daves with this presentation. I'm not saying you shouldn't do it, but you should emphasize that this is only the mathematical basis of RSA and a lot more is involved in making it do something useful. Your description ... 7 Since when decrypting we always want to get the correct message back, there's no reason why we would want to make this ambiguous. It would have no security advantage (if the adversary can guess with any non-negligible probability, you have already lost, so ambiguous decryption can't make that harder). Thus, unlike probabilistic encryption, which is needed ... 6 No, If we assume that the mythical computer can brute force the multiple AES encryptions and there are many ciphertexts available which are encrypted under the same key and their corresponding plaintext are not random. The brute-force code can keep track of the meaningful plaintexts for each ciphertext and finally can perform an intersection of possible key ... 6 There is no known classical algorithm that can factor a 2048-bit modulus in feasible time. Shor's algorithm could do it in feasible time but this algorithm needs to be run on a large-scale quantum computer and as of now there are too many obstacles to create a large-scale quantum computer. 6 A cryptographic key is a string of bits. For example, AES-128 uses 128 bits, each one of them being either 0 or 1. To be able to encrypt or decrypt, each one of those 128 bits must be set correctly. This key is the input to the encryption algorithm. For AES-128 it has to be exactly 128 bits - not more nor less. For humans, remembering 128 bits (= 16 bytes) ... 6 Regarding your understanding You mostly have things right, but not completely. a password is a (preferably) mnemonic string that is fed into a function that generates a much longer and complex string that nobody knows, the user included. The encryption key is what is actually used to encrypt and decrypt a file. This is true apart from “preferably mnemonic”.... 6 Party B will eventually succeed; still, to keep a modicum of suspense up, it must still be possible for them to fail An approach that will allow party B to succeed nonetheless To me the obvious solution is strategy and HUMINT. With algorithms at the time, say bcrypt and AES-256, plus a high entropy password, party A would spend eternity either attacking ... 6 No, there is generally no time factor when it comes to decryption. However, you should remember that even a single changed bit can cause decryption to fail. This is especially the case if that bit is part of the IV, authentication tag or nonce. So I'd rather worry about storage of keys and data. Disks may get stuck, flash may degrade or loose voltage ... 5 Alice and Bob's keys are used to compute a shared key. Both parties compute the same key, which is used both encryption and decryption. This is a traditional, hybrid encryption system. Using only asymmetric cryptography for encryption would be painfully slow. As a mitigation, the sender can create an ephemeral key pair, deleted right after the message ... 5 This scheme suffers from a classic problem of textbook RSA which is mitigated e.g. by RSA-KEM (as outlined by kelalaka) or RSA-OAEP. When you compute$k^3\bmod N$, you'll experience that $$c=k^3\stackrel{k< 2^{256}}{\leq}\left(2^{256}\right)^3=2^{768}\ll 2^{2000}<N$$ Now remember how$x\bmod N$works: If$x\geq N$, then you recursively compute and ... 5 Well, it's good that you're trying to learn. However, learning from the original seminal papers does have some issues that you need to be aware of. For one, sometimes the original authors did not anticipate some issues that later contributions found (and for which common practice adjusted for). For example, it is now recognized that public key encryption ... 5 It's nice to see SciFi authors consulting professionals for technical viability problems. I've got something on my mind for you to consider. This is what I need: An algorithm such that, if you encrypt a file with it using a high-entropy password, is beyond any brute-force attempts using known methods and tech. There was a joke a while back in the NIST Post-... 4 What you describe is a little away from the RSA-KEM (KEM : Key Encapsulation Mechanism). As pointed out by SEjPM, in the comments, an AES-128 key when encrypted with the public modulus has almost 768 bits and this can be recovered by the cube-root attack. Here is the RSA-KEM; RSA-KEM mitigates the attack that you have. RSA-KEM for a single recipient with ... 4 the answer provided by @thesquaregroot is sufficient. However, I will only add the following: We can achieve something similar to RSA encryption by using Diffie-Hellman construction. This can be done by using ElGamal encryption scheme. Suppose say a server has the secret-public key pair ($s, y=g^s$). To send a message to the server, you proceed as follows: ... 4 Natural language has a nonuniform distribution. If a character$x$appears$N_x$times in a candidate decryption with$N$characters, the sample entropy estimate will be $$\sum_{x \in X} (N_x/N) \log (N/N_x)$$ by Shannon’s formula, where$X$is the set of characters. If the decryption is incorrect (wrong key guess) this value will be high, nearly equal to ... 4 The symmetric encryption algorithms require keys with good entropy. Usually, humans tend to have passwords with bad entropy then they are crackable There are well-known cracker programs like John the Ripper and hashcat, and rainbow tables. Today, we have better password mechanisms like Dicewire so that the entropy of the password can be much longer. In any ... 4 TL;DR: The explanation in the article below is a little bit irritating but it seems to me that it's still possible to decrypt all messages at any time, as it is normal for any symmetric ciphers. You can decrypt the message, provided you have the necessary key. As this article (PythonInformer) explains in section "Decrypting a message": decrypt ... 4 I've seen encipher, encrypt, and encode for encryption. Encode is the worst since we have text encoding. The below definitions from Google dictionary that uses Oxford Languages. encipher: convert (a message or piece of text) into a coded form; encrypt. Merriam Webster gives the date of the first usage of encipher as 1577. encrypt: convert (information or ... 4 You are describing encrypt-then-MAC using AES-CTR for encryption and HMAC for the MAC. This indeed results in authenticated encryption. There may be better choices for the key derivation function, but I'm not very familiar with the options, so I'll let others comment. I don't understand why you salt the KDF when deriving the key. This just means that you ... 3 Since this is an exercise, I'll provide the links of the articles as a hint; The linearity of the messages is first studied when$e=3$Low-Exponent RSA with Related Messages by Don Coppersmith, Matthew Franklin, Jacques Patarin, Michael Reitert, EUROCRYPT 1996: Advances in Cryptology — EUROCRYPT ’96 pp 1-9 A more general case, where$e\$ is not limited to ...

Only top voted, non community-wiki answers of a minimum length are eligible