Hot answers tagged

107

If you read about Merkle's experience with bringing the subject to the mainstream, you might be surprised. His professor rejected his initial proposal and show little interest in any further developments: ...We were required to submit two project proposals, one of which we would complete for the course. I submitted a proposal for what would eventually ...


70

The SSH protocol has a complicated record format with an encrypted message length, variable padding, encrypt-and-MAC, etc. This complicated system, which was designed without any formal analysis relating the security of the system to the security of the building blocks, turned out to be vulnerable to an attack (paywall-free) exploiting the MAC verification ...


34

What methods would they use? Since WW2, we know the security of Enigma machines was weakened by the reflector, resulting in two problems: No difference between en- and decryption, which means that if K ↦ T, then T ↦ K. No letter can be encrypted by itself because electricity can not travel the same way back, which results in a reduction of encryption ...


33

This question is quite broad by specifying a sudden fall to cryptanalysis and therefore my answer might not be as complete as you wish it to be. If by "become practically attackable, or close enough that use is strongly discouraged" you imply not an academic breach but assume a weaker attacker such as a single ciphertext attack, then there are quite a few ...


33

You could be thinking about the Merkle-Hellman knapsack cryptosystem. It was invented in 1978 and everything seemed well and good until it was completely broken six years later in 1984 by Shamir - it was a complete and total break, i.e. the cryptosystem became unusable overnight. That said I don't know if the knapsack cryptosystem was ever "popular" in the ...


33

I guess the discovery of public key crypto was not earlier due to three combined factors: before (digital) computers, public key cryptography was impossible difficult to implement, and things that can't be implemented are rarely discovered, much less get any traction; before the 1970's, serious crypto was a military thing, and entrenched habits change ...


25

I sent an email to Ron Rivest and got an answer back. The digits of $\pi$ are used as a sort of random number generator that is used in the Durstenfeld shuffle (see also Knuth vol 3, sec 3.4.2). Below is some pseudocode adapted from the description and code he sent me. S = [0, 1, ..., 255] digits_Pi = [3, 1, 4, 1, 5, 9, ...] # the digits of pi def rand(n)...


25

Exact motives will remain unknown, since we only have Herodotus's word for the whole story, and he doesn't say. However, we can imagine a plausible reason: the whole ordeal provides some level of authentication. Indeed, Histiaeus's slave could hardly have made himself the tattoo, and certainly not without Histiaeus noticing. Since hair growing is slow (and ...


20

Knuth, TAOCP, Vol. 3, 6.4 states (on non cryptographic hashing): "The idea of hashing appears to have been originated by H. P. Luhn, who wrote an internal IBM memorandum in January 1953 that suggested the use of chaining; in fact, his suggestion was one of the rst applications of linked linear lists." Konheim has a recent book, "Hashing in Computer ...


19

This is a shot in the dark, but could you be thinking of the Needham-Schroeder protocol? It was published in 1978 [1], and an attack was published as much as 18 years later, in 1996 [2]. It is not an encryption method, though, but a protocol. In fact, the original paper does not even specify an encryption method to be used, but uses encryption symbolically. ...


18

DES has not been mentioned in the previous two answers. Although it was known to be quite weak from very early on it was widely used for a couple of decades at least, until newer algorithms (3DES, AES, but also e.g. RC4) displaced it. Nowadays it can be broken in hours with dedicated hardware or with at most a few thousand dollars of cloud computing time. ...


18

When choosing curves for use in elliptic curve cryptography, some have suggested using various classes of curves which avoid certain "bad" properties which would make the system vulnerable to attack. The MOV attack breaks the ECDSA on a class called supersingular curves. To avoid this, some suggested using curves from another class called anomalous curves, ...


16

I find the introduction to Hellman's 1979 Scientific American article titled "The Mathematics of Public-Key Cryptography" to be illuminating. According to the very authoritative Hellman, public key cryptography became really interesting when demand for cryptography arose outside of governments and the military. Particularly, asymmetric cryptography ...


15

Plenty of ciphers come out of the USA from government research or selection competitions. AES and DES are examples. Indeed, the US is known from some crypto-related competitions that were/are open to anyone and they surely will do ample of government research related to cryptology, but you need to be sure that you differ between “they selected it” and “they ...


15

Parity of DES key bytes was introduced on request of US authorities during the design of DES in the late 1970s: it mitigates the risk of accidental key alteration; in particular, any all-zeros or all-ones byte of the key is rejected by the mandatory odd parity check, and any one-bit alteration is caught, which are advantages from a functionality perspective;...


14

I won't answer your question up to every detail, as I would have to write a book to answer the pretty broad question to full length. But I'll give you some hints as it would be wrong to let you think that non-military cryptography has appeared in 50's and 60's only thanks to leaks from the NSA! Before the 30's… One of the earliest descriptions of ...


14

They are there to check if the key was indeed correctly retrieved. It could for instance be that the key is a result of key decryption or key agreement. In that case, or simply during transmission, wrong keys are used. According to NIST FIPS 46-3: The 8 error detecting bits..." Or even better, Wikipedia states ANSI INCITS 92-1981), section 3.5: One ...


12

The answer is yes, non-US ciphers exist and are in fact very popular. Actually, some who are looking for alternatives, opt for non-NSA/NIST ciphers, for instance Salsa/ChaCha from DJB (who is US citizen). A lot of ciphers have been developed in EU and Japan. China definitely has developed ciphers for its own use, just like many other countries. But long ...


12

The reference on SHA(-0) is FIPS 180 (archived scan) of 1993 May 11. The standard itself is referenced on the NIST website, but that links to another scan lacking page 1 and the one before, thus foreword, abstract, explanation... There's also this text draft of 1992 January 22 (also here with less indication on origin). The Proposal for Change of that ...


12

In 2004, Xiaoyun Wang's team first publicly reported collisions in MD5, and in 2007, Marc Stevens, Arjen Lenstra, and Benne de Weger reported a chosen-prefix collision attack on MD5. Around the same time, the governments of the United States and Israel developed the the Flame malware to sabotage Iran's nuclear program. Part of the scheme involved forging a ...


11

Wrapping up my comment as an answer: Imagine you’re a Japanese cryptanalyst in the year 1944. There is no such thing yet called “television”, and you’re still decades away from a wordwide network feeding you with all the knowledge you could wish for. In that case there’s only a minimal chance you’ve ever heard or seen a Navajo. So, you’ll be wondering ...


11

Was RSA inspired by Diffe-Hellman, published the year before in 1976 Update I met Ron Rivest at MIT's LCS35 time capsule unveiling and asked him this question for you. The answer is yes. Original Answer In "The first ten years of public-key cryptography", the following social relationships are mentioned: Ron Rivest had been a graduate student in ...


11

One can still access the challenge rules from the archive.org Each contest is based on a specified cipher. A brief piece of printable ASCII text (containing byte values in hexadecimal notation from 0x20 to 0x7e) will be appended to the fixed 24-character string "The unknown message is:". The result will be padded and then encrypted with the associated ...


11

What I wonder is, what motivated the creation of RSA? Was it because they wanted to create something more secure than Diffie-Hellman? And if so, why is it more secure? The New Directions In Cryptography paper introduced the idea of public-key cryptography (though it had been proposed by Merkle before), and public-key cryptography was intended to solve two ...


11

Coprocessors are designed for improved performance in a certain case, and in the case of fixed-width mathematics, I do not believe you would see a performance increase. I am quite sure that 80-bits is simply because it is 10, 8-bit words, and not that it is targeting the 80-bit registers in a FPU. Primarily, it would be inconvenient to use an FPU for this ...


10

Prompted by Paŭlo's comment, I took a look at the original requirements set out for the AES candidates. A useful page for that turns out to be AES - The Early Years (1997-98) on the NIST web site (and surprisingly hard to find there; the internal links are broken and Google doesn't find it either). The AES key lengths were specified in the original Request ...


9

As an Iranian Cryptology student in one of the most well-known Iranian Universities called Sharif University of Technology, I want to add this to the answers. There doesn't seem to be any National Standard Cipher here in Iran. But It doesn't mean that there shouldn't be any classified cipher being used by the military or the revolutionary guards. As I am ...


9

Your interesting questions deserve to be answered more thoroughly, but here goes: According to a highly classified document that was written in 1947 and finally declassified in 2013, the Germans started using a one-time pad system for diplomatic traffic in 1925. This system (GEE) used a one-time pad of digits to encrypt codes by modulo addition. To be clear,...


9

Sadly I'd like to know an answer for your first question as well. For your second question, you just need to see the difference between the description of a protocol and an actual instantiation of it (meaning, a cryptographic scheme). Diffie-Hellman is a cryptographic protocol, describing a way for two parties to exchange a common element in fixed ambient ...


9

The original SHA-1 and Skipjack specifications did not provide a justification for using a 80-bit key size, so we can only speculate about the reasons. However, it is important to understand that from a historical basis, an 80-bit key was considered adequate (barely) to be secure against exhaustive search for a few decades. It was clear that a 64-bit key ...


Only top voted, non community-wiki answers of a minimum length are eligible