63

Is there's a way to make sure that non-open source programs are really using end-to-end encryption? Only by deep reverse-engineering. Which is hard, and might be illegal. Plus the apps are a moving target: they change like weekly. And, using end-to-end encryption is not proof that no interception is possible: this encryption (or its key generation) could be ...


51

Encryption algorithms and hash algorithms both belong to the realm of cryptography but are two different things: Encryption doesn't contain hash functions. As stated on Wikipedia: In cryptography, encryption is the process of encoding a message or information in such a way that only authorized parties can access it and those who are not authorized cannot....


51

Here's a very simple timing side channel attack that you might even see in movies. Suppose you're trying to log in to a computer with a password, and the victim compares your password byte by byte but stops early if there's a mismatch: for (i = 0; i < n; i++) if (password[i] != input[i]) return EFAIL; How do you attack this? Try a password like ...


45

I will go out on a limb here and say that it reeks of snake oil. I have seen the answer by @dirdi, but I am very skeptical. It is clear from the paper that the authors have almost no understanding of cryptography: they refer to algorithms used as DES, AES and RSA, and that quantum computers break them all. We know that quantum computers only have quadratic ...


44

This is expected behavior since 7zip uses Cipher Block Chaining (CBC) mode for encryption. For which you need the Initialization Vector (IV) to be unique and unpredictable. It was using 64-bit IV but fortunately, that was changed to 128; Encryption strength for 7z archives was increased: the size of random initialization vector was increased from 64-bit to ...


39

Time-lock puzzles appear to be what you want (see for example this). A basic construction is via "Repeated Squaring in the RSA group". Let $p,q$ be large primes, and let $N = pq$. The goal is, for fixed $t>0$, to compute $2^{2^t}\bmod N$. There are two "obvious" ways to do this, depending on whether you know the factorization of $N$ or don't. If you do ...


35

First problem is you're not specifying at all how many swaps you need to do for a given message length, other than saying it's "several." For an $n$-bit messsage there are $n!$ ways of rearranging its bits, gives a lower bound of $\mathrm{log}_2(n!) = \sum_{i=1}^{n}\mathrm{log}_2(i)$ bits for on how much pseudorandomness you'll need. Rather than analyze a ...


34

From the application designer's perspective: Yes, by using an authenticated cipher like AES-GCM or crypto_secretbox_xsalsa20poly1305, which you should do anyway. See the scrypt tool for an example of an application that does just that: encrypts a single file using a key derived from a password using an authenticated cipher—specifically, the tool uses AES-...


30

Somewhat offtopic, but I think you're missing something: The 5$ wrench method. It might take 2 - 8 hours to decrypt a password, but it takes 20seconds to reset a router (sorry if you didnt think of this shortcut, but you probably would've at some point). Most routers have some form of parental controls. You could set them to specific hour so that during ...


30

No, it is not a good idea to hash phone numbers. There are only a limited number of phone numbers, so it is pretty easy for an adversary to try and hash all of them. Then you can simply compare the hash of each with the stored hash. Generally you don't have to deal with all telephone numbers, only a subsection of phone numbers anyway (for a specific country ...


25

How are these (magic) numbers chosen? It heavily depends on what algorithm and which of its magic numbers. They seldom are entirely arbitrary. In AES, it is often taken the lowest value such that a certain mathematical property holds, with that property (demonstrably or plausibly) working towards security. In other algorithms, it could be values that pre-...


24

If a computer is doing the selection of PIN numbers, then you would be very lucky indeed to guess a PIN in three times. The entropy - assuming that all numbers are valid - is of course $\log_2{10^8} \approx 26.57$ bits. The chances of guessing the PIN correctly in 3 tries is $$1 - \frac{x-1}{x} \cdot \frac{x - 2}{x-1} \cdot \frac{x-3}{x-2} = 1 - \frac{x-3}{...


20

The best solution is out of scope for this website. Just apply an algorithm that converts binary data to human-readable pronounceable text. A simple solution, much like base-64 or diceware, would be to download a dictionary, split binary ciphertext into chunk, and replace each chunk by selecting the nth word in the dictionary. Join the words together using ...


20

Encryption implies that with the appropriate key, it is possible to decrypt and recover the original message. Which (in general) is not possible from a hash. Thus “I will encrypt” is not adequate if one is going to hash. While it is possible to construct hashes from encryption primitives (such as block ciphers), and vice versa, they are different beasts.


20

This is an attempt to an Explain to me like I'm five style answer: Assume you have a bank vault with a mechanical combination lock. Your cipher in this case is "combination lock". At first sight it has two channels that the attacker can see and interface to The rotation on the input dial (an input channel) and the open/close status of the vault door (an ...


20

Encrypting the same input multiple times, normally, is supposed to produce different outputs each time. This is so that an eavesdropper not only cannot tell that the input was hello there, but cannot even tell that the two files were produced from the same input. So for example you could send Mary the first file and Bob the second one, and an eavesdropper ...


19

The Wikipedia page on the Rijndael S-box describes how the numbers were chosen (Note: Rijndael was the winner of the competition that produced AES). First, the input is mapped to its multiplicative inverse in GF(28) = GF(2)[x]/(x8 + x4 + x3 + x + 1), Rijndael's finite field. Zero, which has no inverse, is mapped to zero. This transformation is known ...


18

Let's assume I need to encrypt data only for one minute, after that time the data is useless. Couldn't I still use ECC2K-130 as it would require 525600 times more PlayStations to crack it in a single minute instead of a year? !!! NO !!! Decryption by an unauthorized party could occur within a fraction of a second following the release of the ciphertext. In ...


17

When there is no known weakness in the hash function we talk about their generic1 resistances Pre-image resistant: given a hash value $h$ find a message $m$ such that $h=Hash(m)$. E.g., consider storing the hashes of passwords on the server. An attacker will try to find a valid password to your account. Second Pre-image resistant: given a message $m_1$ is ...


16

The existence of a family of collision resistant compressing functions does indeed imply the existence of CPA secure, CCA secure and even authenticated encryption. This follows from several classic results in cryptography. A family of collision resistant compressing functions is also a family of one-way functions. By the seminal work of Håstad, Impagliazzo, ...


13

Since I am not a physicist, I am unable to answer all your questions about the paper, but a few: It is claimed that even facing an attacker with "unlimited" technological power, even if they could access the system and copy the chips, would be unable to break the encryption because it is protected by the second law of thermodynamics and the "...


13

Ericson's white paper lists them as The strong and well-proven security algorithms from the 4G system are reused. These are encryption algorithms based on SNOW 3G, AES-CTR, and ZUC; and integrity algorithms based on SNOW 3G, AES-CMAC, and ZUC. The main key derivation function is based on the secure HMAC-SHA-256. Notably, all of them are stream ciphers ...


12

Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password? As usual in password-based cryptography, we'll consider that the password was chosen from a relatively small set, small enough that password enumeration by an adversary can generate passwords including the one of a target user with fair probability, ...


12

It is always a bad idea to hash data that has a limited set of length or characters. A phone number in Germany for example has normally no more than 12 digits. The first digit is always a 0 and the vast majority of numbers is longer as 3 digits, as those are normally reserved for emergency services. This effectively leaves us with 10^11-10^3 possible ...


11

We use more complex encryption algorithms than XOR with a random or pseudo-random keystream for a number of reasons: In order to get a short secret key in symmetric encryption. XOR with a true random stream (One Time Pad) requires storing or/and transfering a secret keystream the size of the data to encipher, which is utterly impractical. Replacing the ...


11

No, there is no bulletproof way, however, there are some ways to achieve this. First, look at the problem; consider $\operatorname{AES}:\{0,1\}^{k} \times \{0,1\}^{128} \to \{0,1\}^{128}$ where the $k$* can be 128,192,and 256 bits. Each key represents (selects) a permutation and decrypting with each possible key will result in all possible texts, ...


11

The article is surely wrong. Nowadays, the sole purpose of client-side private key in SSH is to sign messages (as their algorithms are typically ECDSA EdDSA, etc), the server doesn't encrypt the challenge, it almost certainly verifies it with the public key(s) in the authorized_keys file


11

Instead of using a custom cryptographic algorithm and/or implementation, you could use standard ones to generate a random key, but store only part of the key, and discard the rest. To recover the complete key, you would need to brute force the missing part of the key. By discarding more or fewer bits, you can tune how long the brute forcing will take. So ...


11

The purpose of Diffie-Hellman is solely to establish a shared key, $K$. Taken from Wikipedia: Traditionally, secure encrypted communication between two parties required that they first exchange keys by some secure physical means, such as paper key lists transported by a trusted courier. The Diffie–Hellman key exchange method allows two parties that have ...


Only top voted, non community-wiki answers of a minimum length are eligible