18

This question can be summarized: the attacker found a $d$ that did not satisfy $e \cdot d \equiv 1 \pmod{ \phi(n) }$, but it works; what's going on. It turns out that $e \cdot d \equiv 1 \pmod{ \phi(n) }$ is not necessary (it is sufficient). The necessary and sufficient conditions are: $$e \cdot d \equiv 1 \pmod{p-1}$$ $$e \cdot d \equiv 1 \pmod{q-1}$$ If ...


16

TLDR: None worth academic interest. All modern encryption techniques intended for digital computers are applicable, and secure, for all kinds of digitized data, including text and image. There is no need for such encryption specialized to image or text. Argument: the modern baseline for encryption security is resisting Chosen Plaintext Attack, and that ...


14

Why don't we use Blowfish if it hasn't been cracked? The reason is well-known, it has 64-bit block size and therefore it is vulnerable to birthday attacks. This is done for HHTPS and for more information see sweet32; $$\text{Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN} $$ Is it safe to use Blowfish to encrypt strings of less than ...


10

RSA private key can be found in two ways with $n = p\cdot q$, $p = 11$ and $q = 13$ if Euler's totient function is used as in RSA paper: $$\varphi(n)= (p-1)(q-1) = 120$$ is used then $d = 67 = e^{-1} \bmod 120$ If Carmichael Function used as requried in FIPS 180.4and allowed in PKCS#1 v2.2 standards: $$\lambda(n) = \text{LCM}(p-1,q-1) = 60$$ is used ...


7

Since when decrypting we always want to get the correct message back, there's no reason why we would want to make this ambiguous. It would have no security advantage (if the adversary can guess with any non-negligible probability, you have already lost, so ambiguous decryption can't make that harder). Thus, unlike probabilistic encryption, which is needed ...


5

Practically, when RSA is used to encrypt strings, what is the $x$ in $x^e\bmod n$? That depends on the variant of RSA. Among the most common: Toy-sized textbook RSA, where the public modulus $n$ is small: it is customary to encrypt letter by letter (or pair of letters, as in the original RSA article's small example) and concatenate the RSA cryptograms. ...


5

Deciding among a or b is a matter of choice of definition of public-key encryption. Clearly a is desirable, and b is a fallback in order to allow some interesting cryptosystems. The definition is chosen according to the cryptosystem studied, as in c. As pointed by poncho in comment, in b as it stands, the meaning is that for all keys and messages, there's ...


5

The biggest problem is the 64-bit block size already mentioned in kelalaka's answer, but Blowfish has a couple of other issues: It can't be implemented using the hardware AES acceleration found in many modern CPUs. While this is obviously unfair, it's a reality of the world right now and it's a factor in many people's choice of AES. The hardware ...


4

Some of us believe that it is possible to create ciphers and hash algorithms that are unbreakable (like when people said that we'd never run into an MD5 collision in the lifetime of the universe), but get broken in a couple of decades time (MD5 collision can be created on a modern PC in minutes). MD5 or any other hash function is not proven to be secure. ...


4

Actually, your numbers seem shockingly high at 2724 cycles for one block - even with the key schedule. Crypto++ uses standard AES-NI for the encryption of blocks and for the key generation they use AESKEYGENASSIST for the SBox (unfortunately). Ideally the expected performance would be (for their implementation, not for one with an optimized on-the-fly key ...


4

What you are talking about is called collision resistance. Base 64 is an encoding technique. It doesn't use a key and therefore it is not a cipher. Encoding techniques commonly have a 1:1 relation with the output of course, so no collisions there. Pseudo-random permutations such as block ciphers have a 100% collision resistance as a permutation always has a ...


3

The attachments are processed as follows (source is the WhatsApp's White Paper); First time of the attachment is sent The sender generates a 32-byte random AES-256 key, $k_1$, and another random 32-byte key $k_2$ for $\operatorname{HMAC-SHA256}$ Encrypts the attachment $a$ with this key $c_a = \operatorname{AES-CBC-256}(k_1,a)$ and append the MAC of the $...


3

A good encryption should produce data that are indistinguishable from a random stream. If you simply replace bytes with other bytes, and each byte has always the same replacement, many statistical characteristics of the original message remain. For instance, if the original message is text, then the frequency of each letter will remain also after applying ...


3

Firstly, I am not sure about how I should narrow down the topic. It is better to ask your advisor to help you for selecting a good research topic. Secondly, which prerequisite knowledge do I need? Also, do you suggest any foundational books on the topic? A roadmap for learning Elliptic Curve Cryptography: Beginner: you can learn the basic of ECC by ...


3

when the client send something to the server it will be encrypted with the server's public key (so only the server can decrypt it) and vice versa (when server has to send something to the client it will be encrypted with the client's public key) As I understand it, you are suggesting not to bother using symmetric encryption; instead, have both sides ...


2

My assumption: It would seem logical that a cipher that cannot be run in parallel is (in some ways) more secure compared to one which can. Or two ciphers with equal security levels are not truly equal if one of them runs a billion times quicker on a supercomputer. Is my assumption misguided? A cipher with $n$-bit security means that there are $2^n$ keys to ...


2

AES has highly optimized implementations, including additions of special instructions to intel CPUs specifically for AES. but even without it is amazing how much optimization can go into the implementation og an algorithm it's quite an art. I also have doubts in your measurements, the maximum may be only noise from context switches etc. AES can be ...


2

Based on your comments I have a feeling that may be you don't really understand what a huge number of combinations a 256-bit key means. At the first glance 256 bit is "just" 16 bytes. But look at it closer. With 256 bits we can encode $2^{256} = 10^{77}$ numbers. It is 100 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 ...


2

I am wondering if I can remove/reduce any field to save space, is there a way to save overhead in ESP packages? Well, there was an old IETF draft here to address this very problem; however it didn't get enough traction in the IPsecME working group (for the complexity it has, it doesn't save that much space) and thus was abandoned. Sticking to standard IPsec,...


2

All that this part in the introduction is really saying is that identification is important to IoT. Much as we can say that, for electronic banking transactions, privacy is important (because otherwise people could read your financial transactions) but authentication is more important (because otherwise people could actually steal your money, which is worse),...


2

What you describe is very similar to the autokey cipher, first described in 1586 by Blaise de Vigenère. The differences between your scheme and a standard autokey cipher with a single-letter key are that: You're using subtraction to encrypt and addition to decrypt the message, whereas most autokey variants do the opposite. (That said, "inverted" ...


2

This answer is expanding on @mentallurg's comment. One of the important properties of a cipher is that you can decrypt. More precisely that there is an algorithm that takes in the cipher text and the private key and produces the correct plaintext. (Your scheme does not have a key, which is a separate problem with calling it a cipher). So let's take your ...


2

All ideas and suggestions are welcome on how to achieve this. It sounds like commitments should be one way to handle it. A commitment scheme is a method where: Someone (person B) can generate and publish a commitment to a secret value; someone else (person A) looking at the commitment learns nothing about the secret value (we say that this is the 'hiding' ...


1

Take original plain text as " PLEASEEECUSEMYDEARAUNTSALLY", note that I've ignored the 'X', so that rail fence with key(row depth) = 4 cipher text will be "PEMALLEEEYRUALESCSDANSYAUET" now using Caesar cipher with k=4 on this new text. ${C= (P+k)mod26}$ , you will get cipher as $${"TIQEPPIBICVYEPIWGWHERWCEYIX"}$$ Here we take row wise so ...


1

When we look for a source of randomness we want something which is high entropy, and hard to predict or control. Encrypted network traffic only matches the first criteria. An attacker may see the same network data and may control it.As such it is not the best source of a random seed. There are better sources available. Usually we don't want to rely on any ...


1

If you need signatures, use the signatures API. Signing key pairs may or may not be ephemeral, this depends on your use case. You'll need some way to determine that a signing keypair belongs to whoever you think it belongs to, this can't be handled by the library alone. Signing key pairs and key exchange key pairs are different data types (hydro_sign_keypair ...


1

Note: almost nothing in modern cryptography has any concept of "letters". Bits, bitstrings (sequences of bits), bytes (8 bits), bytestrings (sequences of bytes), integers, and polynomials are the most common things to operate on. "ω" is a letter. "א" is a letter. "👨‍👩‍👧‍👦" is an extended grapheme cluster, which is ...


1

From my understanding of your question, what you want is to hide the name of the file, while enable syncing. You don't actually need encryption per se, since the real name of the file could be encrypted together with the entire file (probabilistically). As such, a potential solution is to just HMAC the file name and use that as the value for syncing. No IV ...


1

I am assuming you meant to use a=2, so that if it sends an error message, we know that MCB was 1. Anyway RSA in practice is never used in raw form like this precisely because this malleability allows attacks like you just mentioned. Such malleability also allows an attacker to create fake signatures from an oracle and with good padding, we cannot trick any ...


1

We do not know if there are one way functions. This is related to the P=?NP question you may have heard of. If P=NP we can not have cryptography as we know it as if you can decode something with a key in Polynomial time you will also be able you to decode it without the key in polynomial time provided you can verify correct results. It is also possible that ...


Only top voted, non community-wiki answers of a minimum length are eligible