226

Your question, MikeAzo's comment, and your reply practically could not be a better example of Schneier's Law in practice. Schneier stated: Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break. To answer your reply How can you break it if I send you this "QTCPIGXKUXTGG" ciphertext ...


137

End-to-end encryption over a channel with an eavesdropper, like the WhatsApp server, works by using a mathemagical spell called Diffie–Hellman key agreement. What follows is not actually how WhatsApp works,* but explores some of the high-level ideas to concretely answer the question without getting lost in the full gory details of everything about the ...


125

Leaving aside the WhatsApp aspect fo the question: the effect described can be achieved with hybrid encryption, where the bulk of the data is encrypted under a random secret symmetric key, and the result uploaded once; revealing that data to a recipient is performed by encrypting that symmetric key towards the recipient (e.g. using his/her public key), and ...


114

I actually think this is a really good question. The answer is because cryptography is a skill, and like any skill, it takes time to develop. Additionally, you will be pitting your (in)experience in the skill against the skills of those who would seek to break your algorithm. This is the real reason why: It's not that you just shouldn't do it, period. It's ...


111

The difference between the PKCS#5 and PKCS#7 padding mechanisms is the block size; PKCS#5 padding is defined for 8-byte block sizes, PKCS#7 padding would work for any block size from 1 to 255 bytes. This is the definition of PKCS#5 padding (6.2) as defined in the RFC: The padding string PS shall consist of 8 - (||M|| mod 8) octets all having value 8 - (...


107

If you read about Merkle's experience with bringing the subject to the mainstream, you might be surprised. His professor rejected his initial proposal and show little interest in any further developments: ...We were required to submit two project proposals, one of which we would complete for the course. I submitted a proposal for what would eventually ...


105

When encrypting something with RSA, using PKCS#1 v1.5, the data that is to be encrypted is first padded, then the padded value is converted into an integer, and the RSA modular exponentiation (with the public exponent) is applied. Upon decryption, the modular exponentiation (with the private exponent) is applied, and then the padding is removed. The core of ...


94

Why shouldn't I use ECB encryption? The main reason not to use ECB mode encryption is that it's not semantically secure — that is, merely observing ECB-encrypted ciphertext can leak information about the plaintext (even beyond its length, which all encryption schemes accepting arbitrarily long plaintexts will leak to some extent). Specifically, the ...


82

He told me there are only two encryptions that he knows of that cannot be broken, and AES is not one of them This tells me you asked your professor the wrong question. You asked a cyber security expert if an algorithm could be cracked, to which the answer is always yes, with the exception of a handful of inconvenient algorithms, such as One Time Use Pads ...


74

There are two somewhat orthogonal concepts in backdooring encryption algorithms: The backdoor can be explicit or implicit. An explicit backdoor is one that everybody knows it is there. An implicit backdoor strives at remaining undetected by the algorithm owners. Of course, when there is an explicit backdoor, people tend to avoid the algorithm altogether, so ...


66

This specific situation is a central part of the analysis of password hashing functions. Indeed, for hashing a password, we want a function which is: slow in a tunable way; such that the most cost-effective hardware for evaluating many instances of the function is the hardware that the expected defender will use, i.e. a "normal PC". "Cost" here means ...


64

There’s no difference except for marketing. Neither of the terms has a meaningful technical definition on which a substantial share of experts in the field can agree. Historically there was a difference in permissible key length due to U. S. export restrictions but those stopped a long time ago except for a few countries that are under broader embargo (e. g....


64

Is there's a way to make sure that non-open source programs are really using end-to-end encryption? Only by deep reverse-engineering. Which is hard, and might be illegal. Plus the apps are a moving target: they change like weekly. And, using end-to-end encryption is not proof that no interception is possible: this encryption (or its key generation) could be ...


58

Draft paper linked from efail.de. TL;DR: the vulnerability is in some popular email client software, often combined with an extension simplifying the use of an OpenPGP (e.g. GnuPG) or S/MIME implementation within the said software; e.g. an extension bundled in popular distributions of GnuPG v2, thus common. The issue is that un-validated deciphered ...


55

This is known in the cryptographic literature as "traitor tracing". See, e.g., the following seminal paper: An efficient public key traitor tracing scheme. Dan Boneh and Matt Franklin. CRYPTO 1999. They show a public-key encryption scheme where each possible recipient has their own private decryption key. If an authorized recipient discloses their ...


54

AES-256 - the block cipher - as far as we know hasn't been broken. It has not even been close to broken. On the other hand, we cannot prove that it is secure. That means that an algorithm that is able to crack AES may be found. Most ciphers cannot be proven to be secure. Only a handful algorithms such as the one-time-pad are secure in the information-...


52

That's also a problem with encrypted emails. If you have an email with a 5MB attachment, and the public keys of 1,000 recipients, how do you send it to all of them? You create a key pair for encryption / decryption. You encrypt the email with this key. The message consists of the encrypted email (5 MB), plus the decryption key encrypted with each of your ...


52

Encryption algorithms and hash algorithms both belong to the realm of cryptography but are two different things: Encryption doesn't contain hash functions. As stated on Wikipedia: In cryptography, encryption is the process of encoding a message or information in such a way that only authorized parties can access it and those who are not authorized cannot....


51

Here's a very simple timing side channel attack that you might even see in movies. Suppose you're trying to log in to a computer with a password, and the victim compares your password byte by byte but stops early if there's a mismatch: for (i = 0; i < n; i++) if (password[i] != input[i]) return EFAIL; How do you attack this? Try a password like ...


50

ECDSA is a digital signature algorithm ECIES is an Integrated Encryption scheme ECDH is a key secure key exchange algorithm First you should understand the purpose of these algorithms. Digital signature algorithms are used to authenticate a digital content. A valid digital signature gives a recipient reason to believe that the message was created by a ...


50

Before answering your questions: GCM is an authenticated encryption mode of operation, it is composed of two separate functions: one for encryption (AES-CTR) and one for authentication (GMAC). It receives as input: a Key a unique IV Data to be processed only with authentication (associated data) Data to be processed by encryption and authentication It ...


50

There are a few parts to the EFAIL attacks. Some parts are the fault of the mailer authors for exposing unnecessary attack surface via arbitrary incoming email. Some parts are the fault of the OpenPGP and S/MIME designers for failing to heed modern cryptography engineering principles—in particular, failing to provide NM-CPA public-key encryption. For ...


48

I will go out on a limb here and say that it reeks of snake oil. I have seen the answer by @dirdi, but I am very skeptical. It is clear from the paper that the authors have almost no understanding of cryptography: they refer to algorithms used as DES, AES and RSA, and that quantum computers break them all. We know that quantum computers only have quadratic ...


45

This is expected behavior since 7zip uses Cipher Block Chaining (CBC) mode for encryption. For which you need the Initialization Vector (IV) to be unique and unpredictable. It was using 64-bit IV but fortunately, that was changed to 128; Encryption strength for 7z archives was increased: the size of random initialization vector was increased from 64-bit to ...


44

Although there are already many answers here, I wanted to strongly advocate AGAINST MAC-then-encrypt. I fully agree with Thomas' first half of the answer, but completely disagree with the second half. The ciphertext is the ENTIRE ciphertext (including IV etc.), and this is what must be MACed. This is granted. However, if you MAC-then-encrypt in the ...


43

No, because these new insights only affect the discovery and patterns regarding finding new prime numbers. In order to break existing encryption algorithms that rely on primes such as RSA, you'd have to have a breakthrough in discovering how to factor integers into primes. Primes are used in encryption keys as the basis of their generation: two large ...


39

Time-lock puzzles appear to be what you want (see for example this). A basic construction is via "Repeated Squaring in the RSA group". Let $p,q$ be large primes, and let $N = pq$. The goal is, for fixed $t>0$, to compute $2^{2^t}\bmod N$. There are two "obvious" ways to do this, depending on whether you know the factorization of $N$ or don't. If you do ...


38

I wanted to help break down exactly what you're seeing. If you take your base64 string: MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqGKukO1De7zhZj6+H0qtjTkVxwTCpvKe4eCZ0FPqri0cb2JZfXJ/DgYSF6vUpwmJG8wVQZKjeGcjDOL5UlsuusFncCzWBQ7RKNUSesmQRMSGkVb1/3j+skZ6UtW+5u09lHNsj6tQ51s1SPrCBkedbNf0Tp0GbMJDyR4e9T04ZZwIDAQAB You then decode it into hex: 30 81 9F 30 0D 06 ...


37

The answer is in the source, file sshrsag.c, line 9: #define RSA_EXPONENT 37 /* we like this prime */ This value $e=37$ matches the conditions for a reasonable fixed RSA public exponent: $e$ is odd, $e$ is at least $3$, $e$ is reasonably small. The later condition is good for speed of operations involving the public key (encryption, and ...


Only top voted, non community-wiki answers of a minimum length are eligible