41

This is expected behavior since 7zip uses Cipher Block Chaining (CBC) mode for encryption. For which you need the Initialization Vector (IV) to be unique and unpredictable. It was using 64-bit IV but fortunately, that was changed to 128; Encryption strength for 7z archives was increased: the size of random initialization vector was increased from 64-bit ...


19

Encrypting the same input multiple times, normally, is supposed to produce different outputs each time. This is so that an eavesdropper not only cannot tell that the input was hello there, but cannot even tell that the two files were produced from the same input. So for example you could send Mary the first file and Bob the second one, and an eavesdropper ...


4

RSA is really very slow compared with symmetric ciphers. You can check this yourself running e.g. openssl benchmark: openssl speed rsa On my machine (and with openssl 1.1.1a) I get Doing 2048 bits public rsa's for 10s: 330640 2048 bits public RSA's in 10.00s so we can do ~33k encryptions per second and the size of the encrypted block is less than the ...


4

Why isn't this construction used instead of XEX? Because XEX takes a block cipher and constructs a tweakable block cipher out of it, whereas this construction, usually called Even-Mansour, takes a permutation and constructs a block cipher out of it. Surely unkeyed permutations should be faster than keyed ones since they do not have a key schedule, is ...


3

AES with $\text{IV}$ created from the data $d$ by $\text{IV}=\operatorname{hash}(d)\bmod m$, where $m$ is the max value for $\text{IV}$ That seriously compromises confidentiality, and does does not provide authentication: The $\text{IV}$ is typically in clear at the beginning of the cryptogram, and that allows someone without the key to test a guess of $d$,...


3

ENC(M) || SignA(ENC(M)) Have confidentiality (from ENC), and authenticity from signature, but no integrity because i have the signature of ENC (so someone can use forgery on my signature) and non-reputation i don't think (but i m not sure). Confidentiality is yes because of ENC, correct. The other's are all linked to each other. They are present if ...


3

Block ciphers, AES is a block cipher, encryption $Enc$ can be formalized as $$Enc:\mathcal{P} \times \mathcal{K} \to \mathcal{C}$$ where $\mathcal{P}$ is the plaintext space, $\mathcal{K}$ is the keyspace, and $\mathcal{C}$ is the ciphertext space. Similarly the decryption; $$Dec :\mathcal{C} \times \mathcal{K} \to \mathcal{P}.$$ For a block cipher the $\...


3

What is the real advantage of option 2 (asymmetric encryption of firmware)? As correctly pointed by the question, not much. All I can think of: It allows to change the symmetric key at each firmware release (actually, the firmware will be encrypted with a random symmetric key, sent asymmetrically encrypted in a header). This advantage is mitigated by the ...


2

I really don't understand what each participant hold and how to recover the secret s in this complicated scenario. Part of the issue you're running into is that the method to implement the original scheme is not uniquely defined, and so what the various parties hold (and how they would recover the secret) would vary based on things not specified in the ...


2

In cut-and-paste one part of ciphertext is replaced by another ciphertext with known (or at least, known legible) plaintext, so the resulting message has a different meaning to the receiver of the encrypted message. It should be avoided by using authenticated encryption. There is probably not a direct copy-and-paste attack on CBC in a similar way as there ...


2

Here is a nice explanation from the efail presentation, credits to Jens and Chris! This is for CBC but it looks pretty much the same for CFB. So here is CBC decryption: Now if you flip a bit in $C_1$ you can flip that same bit in $P_1$: but it will also cause $P_0$ to look like random trash after decryption. But if you know what $P_1$ was in the ...


2

Attacking CBC is much harder than ECB. In many cases there is no viable attack. Properly implemented CBC with a secure underlying block cipher is secure. There have been successful attacks against padding in CBC, though non were anywhere as simple as attacking ECB. Look at: https://en.wikipedia.org/wiki/Padding_oracle_attack https://en.wikipedia.org/wiki/...


2

Deniable encryption should provide what you want. In a deniable encryption scheme, in addition to the usual $(\mathsf{KeyGen},\mathsf{Encrypt},\mathsf{Decrypt})$ algorithm, you have an algorithm $\mathsf{Explain}$ that takes as input a ciphertext $c$ (which can be any ciphertext) and a message $m$, and outputs a random coin $r$ such that the triple $(m,r,c)$ ...


2

It depends on the protocol, there is not one way of handling this. If a symmetric cipher does not provide integrity protection or message authenticity (through a MAC calculation) then it may well be that the decrypted plaintext is not correct. Usually we try and use an authenticated cipher like GCM to avoid such problems. In that case the verification of ...


2

The only 2 "common" algorithms that I know off the top of my head with 18 rounds are Clefia and Camellia with 128-bit keys. Anubis may also be an option, I believe that with a 320-bit key it uses 18 rounds, I have no idea why that would be used instead of AES. I suppose it is also trivial to add rounds to AES or Twofish in hardware, both the key schedule ...


2

What associated data (or encrypted header in the plaintext message) to use is dependent on the protocol, not on the cryptographic algorithm. Generally, for messages in a transport protocol, you'd use the to avoid replay attacks. The header data may also contain other meta-data that you want to authenticate for the message. Beyond that, there is nothing to ...


2

Say, $X= a\cdot b$, where $(a, b) \in Z_q^*$ and $q$ is a large prime. If $X$ is given, then what is the complexity (or hardness) of finding $a$ and $b$? If the multiplication is done within $Z_q^*$, then it's easy - pick an arbitrary nonzero $a$ and compute $b = a^{-1}X$; you're done. You can compute $a^{-1}$ by either the Extended Euclidean method, or by ...


1

AES with ECB and CBC mode AES-ECB could well directly leak information, especially if it is used over multiple keys. The start of the private values within an encoded key are likely not precisely on a block boundary, so looking for repetition of blocks may for instance indicate that a key contains a smaller private exponent value than other keys. This will ...


1

I solved the problem. So for people who are hunting for the answer, you need to consider what mechs your HSM supports. Every logic I had in the code was correct. The only problem was the mechanism that I used to derive the key was wrong. There are several mechs that are available to derive the key with, which was the hard part to figure out since it did not ...


1

First of all, this idea is based on a misconception: "But most ransomware use the hybrid encryption approach and during that they make mistakes allowing security researchers to build decryptors." This is my opinion is not correct. The first ransomware used just symmetric encryption. Now if that symmetric key is left then it may be possible to retrieve it ...


1

The questions you're getting confused by are, indeed, confusing, but I think I figured out what's going on. Imagine a scenario where: A company want to issue exactly 10,000 numbered coupons; They are concerned that malicious parties will forge coupons. So they can't just naïvely number the coupons from 0 to 9999; instead, they wish to use some numbering ...


1

Not sure if I am correct about this, but let me give it my best. I do get that encoding numbers from 0 to 9999 you get 10000 possible encodings, what I don't get is that how to you get 20 digit encodings? As far as I understand with FPE you always get the same length so if you encode numbers from 0 to 9999 you'd get ciphers between the same values. It ...


1

Guessing: DL -> Discrete Logarithm f -> finite field (of prime order) 3072 -> size of finite field in bits s -> (not sure) SHA? 256 -> size of hash digest or subgroup size (used in DSA the old Digital Signature Algorithm?) m -> don't know honestly. Rijndael -> AES.


1

From how I understand your question, I believe that you might have a few misconceptions about symmetric and asymmetric encryption. Let me try to clear things a little for you. What is the real advantage of option 2? Asymmetric encryption can be used in two ways: Provider encrypts with the public key of the consumer This is the scenario you are ...


1

What's wrong with alphabet? Suppose you have uppercase first and lowercase, then you code $$ A = 0, B = 1, \ldots, Z = 25, a = 26, \ldots, z = 51. $$ Example of encoding Take a word like Hello. It can be written as $$ (7, 30, 37, 37, 40). $$ Finally, to make a single integer out of this list of numbers: $$ \mathbf 7 + \mathbf{30} \times 52 + \mathbf{37} \...


1

The isn't much innovation in that paper at all, and the quality of the paper seems questionable. Basically they take standard ElGamal, combined with it's possibility to do re-encryption (homomorphic multiplication with $E(1)$), and then say this is done by multiple parties. Overall, this doesn't make much sense: Nothing ensures, that all parties are ...


1

One of the issue in sending out the XORed value is to disclose the PSK length This is only an issue if you consider the length of the PSK to be a secret and not just the value. In that case you probably should redesign your system to not depend on the length of the PSK being secret, e.g. by always sending an upper-length PSK and also sending the amount of ...


1

The OTP part of the question is a distraction from the main point: it depends heavily on hypothesis on the plaintext if learning a sub-string of it helps towards finding the rest of the plaintext. For plaintext consisting of independent symbols, no, learning a substring does not help towards guessing the rest. Argument: use of the OTP implies that we can't ...


1

In theory no, there will be no better chance. The key must be at least as long as the original text. The key must have high entropy (simply said, it should be random enough). Then revealing any part of the original text has no effect on the decryption. In practice, if the process is realized improperly, there can be some issues: If the key is shorter that ...


Only top voted, non community-wiki answers of a minimum length are eligible