13
votes
Accepted
Why is synthetic IV (SIV) mode considered deterministic authenticated encryption (DAE)?
The definition of DAE security, as given in Rogaway and Shrimpton's original paper (which both defines the security notion and proves that SIV mode satisfies it), does effectively require that a DAE ...
- 46.1k
11
votes
Accepted
What is Deterministic Authenticated Encryption?
Deterministic authenticated encryption indeed provides authenticity and it doesn't require a nonce or IV. In that sense it doesn't provide CPA security as identical messages would result in identical ...
- 92.6k
9
votes
Accepted
Are there deterministic private-key encryption schemes that are CPA-secure?
Summarizing fkraiem's comment, a CPA-secure encryption scheme can not be deterministic.
The reason is simple: the attacker is challenged to distinguish between the encryption of $m_0$ and $m_1$, but ...
- 3,952
9
votes
How to Implement Deterministic Encryption Safely in .NET
You can safely use HMAC-SHA256 instead of the SIV mode custom PRF to derive the nonce/authentication tag. There's some caveats:
HMAC-SHA256 gives a 256-bit output; you'll have to truncate it to the ...
- 48.4k
8
votes
Accepted
Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?
When you use textbook RSA, the public key is $(e,N)$ and the ciphertext of a message $m$ is $c = m^e\bmod N$. The encryption process of textbook RSA involves no randomness; this causes the problem.
It ...
- 4,178
8
votes
Accepted
How can a system be non-deterministic?
As a high level concept, nondetermistic encryption is where the encryption function takes three inputs, the key $k$, the plaintext $P$ and a random value $R$, generating a ciphertext $C = E_k(P, R)$; ...
- 147k
6
votes
Accepted
Deterministic Authenticated Encryption with AES-OFB and HMAC
Does this design provide deterministic authenticated encryption?
This provides reasonable security as long as you limit the total volume of data encrypted to well below $2^{64}$ bytes.
Details.
...
- 48.4k
5
votes
Accepted
Deterministic Encryption using AES
Would it help if i passed in the IV (instead of hard coding it) which
would act as a second key?
No. Most attacks on IV-reuse don't need to know the IV and merely exploit the fact that it was reused ...
- 46k
5
votes
Multiple (RSA) public key encryption how to verify others received the same information? Non-deterministic encryption
As long as you are not wedded to RSA, here's a way that completely solves the problem (and scales to more than two targets).
The general idea is that we do EC-ElGamal in a pairing friendly curve (...
- 147k
5
votes
Why does NIST SP 800-90C RBG3 construction require XOR or reseeding a DRBG with a physical entropy source to produce full entropy?
Why does this recommendation require a RBG3 construction based on some physical entropy source to use a DRBG that is XOR'd or re-seeded by the entropy source to produce full entropy?
Remember that ...
- 147k
4
votes
Are there deterministic private-key encryption schemes that are CPA-secure?
As it was already mentioned by @fkraiem and summarized by @Daniel, deterministic encryption scheme cannot be secure under standard definition of CPA-security. But as deterministic encryption can be ...
- 166
4
votes
Why is synthetic IV (SIV) mode considered deterministic authenticated encryption (DAE)?
SIV is considered determanistic authenticated encryption because:
It is deterministic; given a key, a plaintext maps to a specific ciphertext; there is no randomness involved.
It is authenticated ...
- 147k
4
votes
Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?
It is nice that you have tested if from the first hands.
The textbook RSA encryption is deterministic in the sense that given a public key $(e,n)$ and two plaintext $0 \leq m_1,m_2 < n$ if
$$ c_1=\...
- 48.5k
4
votes
Accepted
AES in CTR mode, with a single key, and an IV derived from the plaintext
In the context, the IV is part of the ciphertext (as usual with AES in CTR mode). That part of the ciphertext leaks information about the plaintext including for one who does not know the AES key, ...
- 141k
4
votes
Accepted
Katz/Lindell Problem 2.2
You neglected the most important part, I believe; the encryption map itself may be probabilistic which means we might have $$c \leftarrow \mathrm{Enc}_k(m),$$ instead of $$c =\mathrm{Enc}_k(m),$$ ...
- 22.5k
4
votes
Accepted
Is there a deterministic one-way collision-free crypto algorithm?
At SEJPM indicated, MD5 and SHA-1 probably are resistant enough for you never to get a collision. However, that doesn't mean that either of them is secure. Neither is SHA-2 or SHA-3. That is, given ...
- 92.6k
4
votes
Deterministic Encryption using AES
First, you should specify:
what you need to be able to do in your database to get your job done;
what capabilities an adversary may have; and
what you want to ensure the adversary can't do.
Here's ...
- 48.4k
3
votes
Accepted
Deterministic symmetric indistinguishable encryption
Yes, the most common / secure deterministic encryption is SIV mode, which stands for synthetical IV mode. Here the IV that is used to randomize each message is replaced by an authentication tag (MAC) ...
- 92.6k
3
votes
Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?
The padding used for RSA is not the PKCS #5/#7 padding (as you seem to suggest in your own answer), but the Wikipedia entry seems to refer to PKCS #1 v1.5 (RFC2313)) which uses a padding
...
- 3,842
3
votes
Accepted
Pseudonymization hashing using public key
What you seem to be asking for is some type of public-key convergent encryption, for which various schemes do exist.
However, all such schemes are unavoidably vulnerable to brute force guessing ...
- 46.1k
3
votes
Accepted
A HRNG that is NIST 800-90 compliant is not suitable for use for OTP generation right?
Is my understanding correct?
Not quite.
For an RBG1 or an RBG2 (either flavor), it is correct (unless the RBG2 was reseeded extremely often, that is, effectively turning it into an RBG3(RS); see ...
- 147k
2
votes
Accepted
Does SIV mode work for asymmetric encryption?
Taking the hash of the message as IV would not be secure, since, like Ricky Demer mentioned in comments, it would make the hash public and allow guessing. However, that is not what SIV mode does – it ...
- 32.1k
2
votes
Accepted
How to recover small messages from textbook RSA?
Disclaimer: I did not come up originally with this attack, but rather it was first described in "Why Textbook ElGamal and RSA Encryption
Are Insecure" by Boneh, Joux and Nguyen (PDF).
This answer ...
2
votes
request for data to test deterministic ecdsa signature algorithm for secp256k1
Here are 20 test vectors for SECP256k1 (RFC6979): (Source).
The format is (private key, message, DER signature).
Its not in the format you needed but the final signature should validate all the ...
- 1,659
2
votes
Accepted
Are there any deterministic multi-block encryption constructions that have an avalanche effect going both ways?
I suspect that what you are looking for is either convergent encryption or the SIV mode (pdf).
Convergent encryption is essentially:
Hash the message.
Encrypt using the hash as key.
Encrypt the hash ...
- 32.1k
2
votes
Are there any deterministic multi-block encryption constructions that have an avalanche effect going both ways?
I know no classical deterministic multi-blocks encryption construction with the desired avalanche property. And a serious problem is that any such construction, simply because it is deterministic, won'...
- 141k
2
votes
How can a system be non-deterministic?
The other answers might be skipping a useful step for beginners, non-deterministic encryption is named Probabilistic encryption, which is opposed to deterministic encryption which always produces the ...
- 912
2
votes
How can a system be non-deterministic?
I'll assume that you have already picked your private key $d$ along with your public key $d,n$ and that you know the basics of RSA.
My answer now consists of two parts: The first part describes a very ...
- 46k
2
votes
Accepted
Deterministic Encryption with AES GCM - how to choose the IV (nonce)
Your proposed solution will work, mostly. The only thing that you have to change is, to use a different key in your calculation of $C1$ and $C2$. Both keys may be derived from a common master key but ...
- 2,518
2
votes
Security of key bits under indistinguishability for randomized encryption
If you could guess the key, you could decrypt the challenge ciphertexts and figure out which plaintext is which.
Conversely, if the cryptosystem has ciphertext indistinguishability in this attack ...
- 48.4k
Only top scored, non community-wiki answers of a minimum length are eligible