9

I read the question as: Why is it that often, iterating RSA encryption just a few times cycles back to the original value, when the public modulus is $N$ is small? With $N$ square-free and $\gcd(e,\varphi(n))=1$, textbook RSA encryption $$\begin{align}E: [0,N)&\to[0,N)\\ x&\mapsto x^e\bmod N\end{align}$$ is a bijection, equivalently a permutation ...


7

The HMAC calculation is used as a KDF here. So 3 keys are derived. Let's start with the statement "In practice, if you know one, you'll know the other.". This is incorrect. The KDF construction uses a one way function so that you cannot get to the input keying material (or seed) s. This means that if an adversary gets hold of the symmetric key c that you ...


7

Personally I keep to what I do during development: the variable that is most static is to the left, the more dynamic ones to the right. So I use key, IV and input in that particular order. A cipher is a keyed permutation, often written as $\text{E}_K$, so in my opinion $\text{E}(K, M)$ is closest to $\text{E}_K(M)$. Writing the parameters in a different ...


5

What is meant by "$r$ may be chosen in a way dependent on $z$"? An hypothetical algorithm $\mathcal A_2$ breaking the strong RSA assumption has input¹ $(n,z)$ with $n$ generated by the RSA key generation procedure, and outputs² $(r,y)$ such that $y^r\equiv z\pmod n$, with the only other constraint on $r$ that $r>1$. Contrast with an hypothetical ...


4

Sure you can, it's even pretty common, as long as it's clear in your writeup and there is no possible confusion.


4

Yes, the hash will be unique every time - if the input string is unique every time. This follows trivially from SHA-256's collision resistance: If your input strings are different but the outputs are the same it's a collision in SHA-256 which would be a huge surprise to find for everyone and a publication-worthy result. Now the more interesting question is ...


3

As usual in password-based cryptography, we'll consider that the password was chosen from a relatively small set, small enough that password enumeration by an adversary can generate the password of a user with fair probability, but large enough that additionally computing the password hash for each password thus generated is too costly for the attacker. ...


3

I notice that AES-CBC encryption is faster than the description, is my result is correct? It is plausible for a software-only implementation if single-threaded or if CPU time is cumulated across the multiple threads. For an implementation using AES instructions, the difference in speed can be barely noticeable or in either direction. For a competently made ...


2

Given your reason for the required delay, might I suggest perhaps an easier analogue method? Purchase a timed kitchen lock (usually used to stop people from snacking on cookies or from smoking, etc.). Although most are outrageously expensive, you can find reasonably-priced ones if you look around. Generate and use a random password that's too long to ...


2

For textbook RSA, we have Key-Gen The modulus $n$ must be a product of two distinct random large primes due to the security, $n = p \cdot q$ in your case $n=143 = 11\cdot 13$ For finding the primes, the probabilistic Miller–Rabin primality test, it should be enough. Note that the Miller–Rabin primality test is probabilistic; composite output is always ...


2

A cryptographic MAC is always symmetric By Definition. For those interested in its security properties, one may want to know Does data authenticity always, implicitly, provide data integrity? The tool that provides authenticity asymmetrically is known as Digital Signature. Digital Signatures are asymmetric By Definition; they guarantees the integrity, ...


2

(Disclaimer: I am not qualified to speak authoritatively on cryptography - I didn't even take any undergraduate classes on cryptography as a student either) The first part (the analogy for public-key encryption) is valid (analogising a public-key as a padlock works, but disregards the fact that a public-key (padlock) can be used to decrypt data encrypted ...


2

A few words on SCP03 As you said, SCP03 is based on the shared knowledge of some symmetric keys (refereed as static keys). This can be seen as a weakness more than a vulnerability since deriving multiple keys from common materials does not break the security guarantees offered by the protocol. For each sessions, new keys are derived based on: The shared ...


2

mentallurg already spoke about the possible length differences. I want to note that if you can intercept several texts you maybe be able to look at some distribution properties. Encrypted texts will frequently be from a particular subspace, say a group and while they may be randomly distributed in that subspace, they may not look randomly distributed in $\{0,...


2

Hash is very short, e.g. 8 bytes, 32 bytes, 64 bytes, no matter how long the original text is. Where as encrypted text is actually unlimited. If the encrypted text is relatively long, you can calculate some statistical values. Where as hash is short and is no sufficient for any statistics. E.g. how will you speak about some frequency if you only have 32 ...


1

Roughly speaking, in order to achieve $k$ bits of security, encryption and decryption for Elgamal, RSA, and ECC, require $O(k^3)$ operations, while encryption and decryption for lattice-based systems require only $O(k^2)$ operations. That quote uses "$k$ bits of security" where there should be "a security parameters of $k$ bits" or "key size of $k$ bits". ...


1

AES has 128, 192, and 256 bits key sizes and always 128-bit block size. They are usually written as AES128, AES192, and AES256. The block size is implicit since it is always 128. The basic function xor_128 is used to support x-or operation of CBC-MAC for the message block, ciphertext blocks, and keys. The block size is always 128 regardless of the key size. ...


1

When you use Diffie-Hellman key agreement protocol, both sides reach the equal keys. Then, you can use it with private key encryption methods, not public ones (like AES or one-time-pad). One philosophy of public key encryptions is for avoiding key exchanges or key agreements. They are also called asymmetric encryption methods, because the sender and the ...


1

If given only the a sequence of bits, I do not think you can distinguish between the two, that's the reason both these mechanisms can be effectively used as PRNGs if implemented correctly. You would need some more information about this sequence generating blackbox in order to figure out what you are dealing with. For example, let's say you are able to ...


1

Oh, that one is simple: any key size is possible. The key size for RSA is set to the size of the modulus. The modulus in turn is the multiplication of two (or more) large primes. Of course, multiplication means that all prime sizes are added together (give or take a bit). However, not every implementation will allow any key size. Since computers are byte ...


1

Recovering an arbitrary function $f:M \rightarrow N$ from samples $x_i, f(x_i)$ is clearly impossible without additional information unless the given $x_i$ cover $M$ or unless $N$ is of size one, since an arbitrary continuation can be chosen on the remaining inputs. By the same token, it is trivial to find some function that reproduces the input-output ...


1

You can use a password-storing program like Keepass. When you create the database of stored password you can specify the number of iterations of the algorithm used to encrypt the database. For example, Keepass can auto-calculate the numbers needed for a 1 second delay every time you open or save the database on your pc. You can multiply those numbers by 10....


Only top voted, non community-wiki answers of a minimum length are eligible