63

Is there's a way to make sure that non-open source programs are really using end-to-end encryption? Only by deep reverse-engineering. Which is hard, and might be illegal. Plus the apps are a moving target: they change like weekly. And, using end-to-end encryption is not proof that no interception is possible: this encryption (or its key generation) could be ...


51

Encryption algorithms and hash algorithms both belong to the realm of cryptography but are two different things: Encryption doesn't contain hash functions. As stated on Wikipedia: In cryptography, encryption is the process of encoding a message or information in such a way that only authorized parties can access it and those who are not authorized cannot....


50

Here's a very simple timing side channel attack that you might even see in movies. Suppose you're trying to log in to a computer with a password, and the victim compares your password byte by byte but stops early if there's a mismatch: for (i = 0; i < n; i++) if (password[i] != input[i]) return EFAIL; How do you attack this? Try a password like ...


45

I will go out on a limb here and say that it reeks of snake oil. I have seen the answer by @dirdi, but I am very skeptical. It is clear from the paper that the authors have almost no understanding of cryptography: they refer to algorithms used as DES, AES and RSA, and that quantum computers break them all. We know that quantum computers only have quadratic ...


43

This is expected behavior since 7zip uses Cipher Block Chaining (CBC) mode for encryption. For which you need the Initialization Vector (IV) to be unique and unpredictable. It was using 64-bit IV but fortunately, that was changed to 128; Encryption strength for 7z archives was increased: the size of random initialization vector was increased from 64-bit ...


38

Time-lock puzzles appear to be what you want (see for example this). A basic construction is via "Repeated Squaring in the RSA group". Let $p,q$ be large primes, and let $N = pq$. The goal is, for fixed $t>0$, to compute $2^{2^t}\bmod N$. There are two "obvious" ways to do this, depending on whether you know the factorization of $N$ or don't. If you do ...


33

From the application designer's perspective: Yes, by using an authenticated cipher like AES-GCM or crypto_secretbox_xsalsa20poly1305, which you should do anyway. See the scrypt tool for an example of an application that does just that: encrypts a single file using a key derived from a password using an authenticated cipher—specifically, the tool uses AES-...


27

Somewhat offtopic, but I think you're missing something: The 5$ wrench method. It might take 2 - 8 hours to decrypt a password, but it takes 20seconds to reset a router (sorry if you didnt think of this shortcut, but you probably would've at some point). Most routers have some form of parental controls. You could set them to specific hour so that during ...


25

How are these (magic) numbers chosen? It heavily depends on what algorithm and which of its magic numbers. They seldom are entirely arbitrary. In AES, it is often taken the lowest value such that a certain mathematical property holds, with that property (demonstrably or plausibly) working towards security. In other algorithms, it could be values that pre-...


24

If a computer is doing the selection of PIN numbers, then you would be very lucky indeed to guess a PIN in three times. The entropy - assuming that all numbers are valid - is of course $\log_2{10^8} \approx 26.57$ bits. The chances of guessing the PIN correctly in 3 tries is $$1 - \frac{x-1}{x} \cdot \frac{x - 2}{x-1} \cdot \frac{x-3}{x-2} = 1 - \frac{x-3}{...


22

We're not computers. We'd have to do calculations in our heads while talking about something other. There are quite a few parts of the brain active when we're talking, it would be tricky at best to put something in between. There is the notion of code talkers but those used their own language such as some of the Native American languages to communicate. ...


20

The best solution is out of scope for this website. Just apply an algorithm that converts binary data to human-readable pronounceable text. A simple solution, much like base-64 or diceware, would be to download a dictionary, split binary ciphertext into chunk, and replace each chunk by selecting the nth word in the dictionary. Join the words together using ...


20

Encryption implies that with the appropriate key, it is possible to decrypt and recover the original message. Which (in general) is not possible from a hash. Thus “I will encrypt” is not adequate if one is going to hash. While it is possible to construct hashes from encryption primitives (such as block ciphers), and vice versa, they are different beasts.


20

This is an attempt to an Explain to me like I'm five style answer: Assume you have a bank vault with a mechanical combination lock. Your cipher in this case is "combination lock". At first sight it has two channels that the attacker can see and interface to The rotation on the input dial (an input channel) and the open/close status of the vault door (an ...


19

The decompression of compressed-then-encrypted data is not possible without the decryption key, at least for compression and encryption schemes independent of each other. We can make a theoretical argument for that: compression schemes compress only a small portion of possible plaintexts (that happen to be the ones where compression is used in practice), and ...


19

The Wikipedia page on the Rijndael S-box describes how the numbers were chosen (Note: Rijndael was the winner of the competition that produced AES). First, the input is mapped to its multiplicative inverse in GF(28) = GF(2)[x]/(x8 + x4 + x3 + x + 1), Rijndael's finite field. Zero, which has no inverse, is mapped to zero. This transformation is known ...


19

Encrypting the same input multiple times, normally, is supposed to produce different outputs each time. This is so that an eavesdropper not only cannot tell that the input was hello there, but cannot even tell that the two files were produced from the same input. So for example you could send Mary the first file and Bob the second one, and an eavesdropper ...


16

The existence of a family of collision resistant compressing functions does indeed imply the existence of CPA secure, CCA secure and even authenticated encryption. This follows from several classic results in cryptography. A family of collision resistant compressing functions is also a family of one-way functions. By the seminal work of Håstad, Impagliazzo, ...


13

If you are unsure, then always choose Argon2id. Only choose Argon2d if you need maximum security at the expense of side-channel risk, and only choose Argon2i if side-channel attacks are the primary threat. The number of passes just increases resistance to time-memory tradeoff attacks (TMTO). What you are probably remembering is that Argon2i is more ...


13

Since I am not a physicist, I am unable to answer all your questions about the paper, but a few: It is claimed that even facing an attacker with "unlimited" technological power, even if they could access the system and copy the chips, would be unable to break the encryption because it is protected by the second law of thermodynamics and the "...


11

We use more complex encryption algorithms than XOR with a random or pseudo-random keystream for a number of reasons: In order to get a short secret key in symmetric encryption. XOR with a true random stream (One Time Pad) requires storing or/and transfering a secret keystream the size of the data to encipher, which is utterly impractical. Replacing the ...


11

No, there is no bulletproof way, however, there are some ways to achieve this. First, look at the problem; consider $\operatorname{AES}:\{0,1\}^{k} \times \{0,1\}^{128} \to \{0,1\}^{128}$ where the $k$* can be 128,192,and 256 bits. Each key represents (selects) a permutation and decrypting with each possible key will result in all possible texts, ...


11

The article is surely wrong. Nowadays, the sole purpose of client-side private key in SSH is to sign messages (as their algorithms are typically ECDSA EdDSA, etc), the server doesn't encrypt the challenge, it almost certainly verifies it with the public key(s) in the authorized_keys file


10

The one thing no one else has touched on is speed. Any cipher that you have to think about consciously will be too slow to be practical, and too easy to break to be effective. It would also be vulnerable to an eavesdropper writing down on pen and paper, and then cracking it later (not sure if that counts as recording). Ciphers like Rövarspråket and the B-...


10

It is possible with the old Pohlig-Hellman cipher. Here's how it works: The global parameter is a prime $p$ A secret key is a value $k$ which is relatively prime to $p-1$ To encrypt a message $M$, you compute $C = M^k \bmod p$, and that's you To decrypt a ciphertext $C$, you compute $k^{-1} \bmod p-1$, and then compute $M = C^{k^{-1}} \bmod p-1$ With this ...


10

HMAC-based Key Derivation Function (HKDF) rfc5869 is what you are looking for. HMAC security proof uses the fact that the compression function of the underlying hash is itself a PRF. HKDF follows the "extract-then-expand" paradigm, where the KDF logically consists of two modules. The first stage takes the input keying material and "extracts" ...


10

Instead of using a custom cryptographic algorithm and/or implementation, you could use standard ones to generate a random key, but store only part of the key, and discard the rest. To recover the complete key, you would need to brute force the missing part of the key. By discarding more or fewer bits, you can tune how long the brute forcing will take. So ...


9

You say you want to decompress the data coming from A so B can do incremental backups and recovery. Were A's data not encrypted this would make perfect sense. But A's data is encrypted and that changes everything. Let's think this through. Let's say A compresses its data and then encrypts it. And let's say B could somehow decompress the data from A without ...


9

The premise of this question is flawed: There is no such thing as a "non-mathematical" cipher. Every algorithmic procedure admits a mathematical description, hence is inherently mathematical in nature. Besides that: It is not hard to make primitives with massive key spaces, but that doesn't really achieve anything. One can easily construct ciphers with $2^\...


Only top voted, non community-wiki answers of a minimum length are eligible