# Tag Info

51

Encryption algorithms and hash algorithms both belong to the realm of cryptography but are two different things: Encryption doesn't contain hash functions. As stated on Wikipedia: In cryptography, encryption is the process of encoding a message or information in such a way that only authorized parties can access it and those who are not authorized cannot....

50

Here's a very simple timing side channel attack that you might even see in movies. Suppose you're trying to log in to a computer with a password, and the victim compares your password byte by byte but stops early if there's a mismatch: for (i = 0; i < n; i++) if (password[i] != input[i]) return EFAIL; How do you attack this? Try a password like ...

45

I will go out on a limb here and say that it reeks of snake oil. I have seen the answer by @dirdi, but I am very skeptical. It is clear from the paper that the authors have almost no understanding of cryptography: they refer to algorithms used as DES, AES and RSA, and that quantum computers break them all. We know that quantum computers only have quadratic ...

41

This is expected behavior since 7zip uses Cipher Block Chaining (CBC) mode for encryption. For which you need the Initialization Vector (IV) to be unique and unpredictable. It was using 64-bit IV but fortunately, that was changed to 128; Encryption strength for 7z archives was increased: the size of random initialization vector was increased from 64-bit ...

33

From the application designer's perspective: Yes, by using an authenticated cipher like AES-GCM or crypto_secretbox_xsalsa20poly1305, which you should do anyway. See the scrypt tool for an example of an application that does just that: encrypts a single file using a key derived from a password using an authenticated cipher—specifically, the tool uses AES-...

24

How are these (magic) numbers chosen? It heavily depends on what algorithm and which of its magic numbers. They seldom are entirely arbitrary. In AES, it is often taken the lowest value such that a certain mathematical property holds, with that property (demonstrably or plausibly) working towards security. In other algorithms, it could be values that pre-...

23

Why is it a good practice to use only the first 16 bytes of a hash for encryption? As you noted, it isn't. But, the problem is not with the "16 bytes" part of the statement, or the concern for collisions. The problem is with the "hash" part. 16 bytes As stated in one of the links you shared, AES only uses key sizes of 128, 192, and 256 bits (or 16, 24, ...

23

If a computer is doing the selection of PIN numbers, then you would be very lucky indeed to guess a PIN in three times. The entropy - assuming that all numbers are valid - is of course $\log_2{10^8} \approx 26.57$ bits. The chances of guessing the PIN correctly in 3 tries is 1 - \frac{x-1}{x} \cdot \frac{x - 2}{x-1} \cdot \frac{x-3}{x-2} = 1 - \frac{x-3}{...

22

We're not computers. We'd have to do calculations in our heads while talking about something other. There are quite a few parts of the brain active when we're talking, it would be tricky at best to put something in between. There is the notion of code talkers but those used their own language such as some of the Native American languages to communicate. ...

20

The best solution is out of scope for this website. Just apply an algorithm that converts binary data to human-readable pronounceable text. A simple solution, much like base-64 or diceware, would be to download a dictionary, split binary ciphertext into chunk, and replace each chunk by selecting the nth word in the dictionary. Join the words together using ...

20

Encryption implies that with the appropriate key, it is possible to decrypt and recover the original message. Which (in general) is not possible from a hash. Thus “I will encrypt” is not adequate if one is going to hash. While it is possible to construct hashes from encryption primitives (such as block ciphers), and vice versa, they are different beasts.

19

The decompression of compressed-then-encrypted data is not possible without the decryption key, at least for compression and encryption schemes independent of each other. We can make a theoretical argument for that: compression schemes compress only a small portion of possible plaintexts (that happen to be the ones where compression is used in practice), and ...

19

This is an attempt to an Explain me like I'm five style answer: Assume you have a bank vault with a mechanical combination lock. Your cipher in this case is "combination lock". On first sight it has two channels that the attacker can see and interface to: The rotation on the input dial (an input channel) and the open/close status of the vault door (an ...

19

The Wikipedia page on the Rijndael S-box describes how the numbers were chosen (Note: Rijndael was the winner of the competition that produced AES). First, the input is mapped to its multiplicative inverse in GF(28) = GF(2)[x]/(x8 + x4 + x3 + x + 1), Rijndael's finite field. Zero, which has no inverse, is mapped to zero. This transformation is known ...

19

Encrypting the same input multiple times, normally, is supposed to produce different outputs each time. This is so that an eavesdropper not only cannot tell that the input was hello there, but cannot even tell that the two files were produced from the same input. So for example you could send Mary the first file and Bob the second one, and an eavesdropper ...

16

But advices received from partners and relatives encouraged me to experiment with the idea. I know that some schemes were patented in their beginning: DH, RSA, DES, NTRU, some schemes on ECC. Note that there is considerable reluctance in significant parts of the community to use any algorithm with any intellectual property claims. If you patent your ...

16

The existence of a family of collision resistant compressing functions does indeed imply the existence of CPA secure, CCA secure and even authenticated encryption. This follows from several classic results in cryptography. A family of collision resistant compressing functions is also a family of one-way functions. By the seminal work of Håstad, Impagliazzo, ...

13

RC2 RC2 is a 64-bit source-heavy unbalanced Feistel cipher with an 8 to 1024-bit key size, in steps of 8. The default key size is 64 bits. It was designed in 1987. It has a heterogenous round structure with a total of 18 rounds (16 "MIXING" rounds and 2 "MASHING" rounds). It is a complex cipher using secret indices to select key material. It performs ...

13

If you are unsure, then always choose Argon2id. Only choose Argon2d if you need maximum security at the expense of side-channel risk, and only choose Argon2i if side-channel attacks are the primary threat. The number of passes just increases resistance to time-memory tradeoff attacks (TMTO). What you are probably remembering is that Argon2i is more ...

13

Since I am not a physicist, I am unable to answer all your questions about the paper, but a few: It is claimed that even facing an attacker with "unlimited" technological power, even if they could access the system and copy the chips, would be unable to break the encryption because it is protected by the second law of thermodynamics and the "...

12

And in which case would it be more interesting to use one or another? So SHA3-$n$ offers $n$ bits of security against preimage and second-preimage attacks and $n/2$ bits of security against collision attacks. On the other side SHAKE-$n$ offers at $n$ bits of security against preimage and second-preimage attacks and also $n$ bits of security against ...

11

We use more complex encryption algorithms than XOR with a random or pseudo-random keystream for a number of reasons: In order to get a short secret key in symmetric encryption. XOR with a true random stream (One Time Pad) requires storing or/and transfering a secret keystream the size of the data to encipher, which is utterly impractical. Replacing the ...

11

No, there is no bulletproof way, however, there are some ways to achieve this. First, look at the problem; consider $\operatorname{AES}:\{0,1\}^{k} \times \{0,1\}^{128} \to \{0,1\}^{128}$ where the $k$* can be 128,192,and 256 bits. Each key represents (selects) a permutation and decrypting with each possible key will result in all possible texts, ...

11

The article is surely wrong. Nowadays, the sole purpose of client-side private key in SSH is to sign messages (as their algorithms are typically ECDSA EdDSA, etc), the server doesn't encrypt the challenge, it almost certainly verifies it with the public key(s) in the authorized_keys file

10

We can't make satisfactory Electronic Voting Machines. Their design face conflicting goals that are impossible to reconcile, even in the simplest conceivable use case: a yes/no vote, a single machine. Count votes (or at least: determine if there was more yes than no) with the result public. Limit voting to one per registered voter. Keep individual votes ...

10

xoring the output of the cipher with the plaintext message Xoring the message into the ciphertext removes the ability to decrypt the ciphertext. If all you have is $k, c = E_k(m) \oplus m$, then you need to know $m$ in order to strip the external $m$ off of $E_k(m)$ before you can apply $m = D_k(E_k(m))$; Basically, you would need to know the message in ...

10

Let's take AES-CBC for example—a typical cryptosystem that requires a randomized IV. Suppose I can predict the IV in advance. Then I can start by asking for the encryption of $\mathit{iv}_0$, which is $\operatorname{AES}_k(\mathit{iv}_0 \oplus \mathit{iv}_0) = \operatorname{AES}_k(0)$, and proceed by asking to be challenged on the messages $m_0 = \mathit{... 10 The one thing no one else has touched on is speed. Any cipher that you have to think about consciously will be too slow to be practical, and too easy to break to be effective. It would also be vulnerable to an eavesdropper writing down on pen and paper, and then cracking it later (not sure if that counts as recording). Ciphers like Rövarspråket and the B-... 10 It is possible with the old Pohlig-Hellman cipher. Here's how it works: The global parameter is a prime$p$A secret key is a value$k$which is relatively prime to$p-1$To encrypt a message$M$, you compute$C = M^k \bmod p$, and that's you To decrypt a ciphertext$C$, you compute$k^{-1} \bmod p-1$, and then compute$M = C^{k^{-1}} \bmod p-1\$ With this ...

Only top voted, non community-wiki answers of a minimum length are eligible