# Tag Info

39

TL;DR     The answer is classical cryptography. Besides a quantum link, secure data communication with Quantum Cryptography (more precisely, Quantum Key Distribution) uses classical links, mathematically provable classical cryptography, and a setup procedure using initially trusted material just as in classical cryptography. To perform the same, classical ...

10

@fgrieu already wrote a little book, so I'll restrict my answer to a minimum to avoid repetitions. Think of this as an extended comment (which indeed wouldn't have fit the comment size limits). What makes Quantum Cryptography secure? … what makes it more secure than the classical version? In classical crypto, things like three party key distribution ...

7

If you perform the distribution digitally (using networks) then you have a problem. Unless you use another one time pad you lose the perfect confidentiality as the distribution itself won't deliver perfect security. But using another one time pad is pointless: you would lose exactly as many key bits as you are distributing, while you are only protecting the ...

7

My turn! In classical cryptography between two peers over a channel such as the internet, an eavesdropper on the channel learns a transcript of information from which secrets could theoretically be derived. For example, the eavesdropper learns Diffie–Hellman public keys $g^a$ and $g^b$, which with unbounded computation could be used to recover the peer's ...

6

The answer is both yes and no, as I explain below. 1. No, BBM92 is better (or at least, we initially thought so) E91 was the initial idea which led to the more rigorous BBM92. In the E91 paper, there is not actual security proof, ant the attack is not really specified: if the CHSH inequality is violated by only a few percents (say $S=2.05$), how many secret ...

5

In order to achieve very high security for privacy, would it be cryptographically secure to use one time pad ciphers in emails? OTP offers perfect secrecy, so if it's feasible to use it, it is secure. However, OTP alone offers no authentication and leaves the message malleable. If Alice sends a message Y to Bob, standing for 'yes', Mallory can guess this ...

5

Key Distribution. Key distribution is, well, the process of distributing (cryptographic) keys to different parties. Usually this involves mechanisms which are considered "out-of-band", i.e. mechanisms that don't use the later communication channel for the transport of keys. Alternatively key distribution can be done by relying the distribution of new keys ...

5

There is some confusion regarding QKD. The confusion revolves around the underlying principle and it's nuts & bolts implementation in the physical world. The two are conflated, which I believe is unfair as QKD is an emerging technology so shouldn't be so harshly compared with centuries year old cipher principles. So in this quantum version, what makes ...

5

For an OTP to provide perfect secrecy it is required that the key stream is indeed purely random. A pure OTP is largely a theoretical construct because it is almost impossible to generate a key stream that is provably random. Any kind of information on the key stream may leak information on the plaintext, which means it is not perfectly secure. Practical OTP'...

5

How Alice and Bob agree on which of the two beam splitters bases (Horizontal-Vertical and Right-Left) correspond to which of the classical bits (1 and 0) ? How do Alice and Bob agree on when actual transmission starts, when it is time to send/receive a photon taking note of event ? Alice and Bob operate according to an agreed-upon protocol, which can define ...

4

Unfortunately, most of the reasons that e-voting is not popular have nothing to do with the integrity of the underlying mathematics. This makes the question slight moot on a cryptography forum, but the following un-cryptographic answer still entirely relevant. Unless you solve the following (non exhaustive) problems:- It's a requirement of law ...

4

Ed25519 is a typical elliptic-curve signature scheme, in a group of large prime order $\ell \approx 2^{252}$ on a curve over the field $\mathbb F_p$ for $p = 2^{255} - 19$. A secret key is a uniform random 32-byte string; a signature is a 64-byte string encoding a point $R$ on the curve generated by the standard base point, and encoding a scalar $s \in \... 3 I think the difference between key exchange and key distribution can be very subtle, but it probably comes down to the former being an active way of "dealing" keys, while the latter is something that can be more passive. I think a few examples may make this more clear. Key exchange Alice and Bob want to communicate over a private channel. They both know ... 3 OpenPGP supports an approximation to what you seek, albeit with at best weak privacy guarantees: To transmit the message$m$, Alice picks a session key$k$and sends $$E_{f_1}(k) \mathbin\| E_{f_2}(k) \mathbin\| \cdots E_{f_n}(k) \mathbin\| \operatorname{AES-CFB'}_k(m),$$ more or less. Here$\operatorname{AES-CFB'}$is OpenPGP's bespoke variant of CFB mode. ... 3 The sender receives the public key through some other (secure) channel. The whole security of public key encryption relies on precisely this "small detail": there must be a way for the sender to obtain the receiver's public key through some other, secure channel. The definition of "channel" is actually very broad here, and denotes simply a means of ... 3 For the purposes of a bloom filter you need a number of hash functions. Cryptographic hash functions are designed so that changing a single bit in the input should change many (around 1/2) of the output bits. So, say you have a good hash function$h$(e.g., SHA256 though MD5 should work for your purposes too) a good option for you would be to use use:$h_1(...

3

An easier way of explaining it is here: http://www.demoivre.org/courses/CIS628/chapter15.pdf So for a point $(x_0,y_0,z_0)$ we set $x_0$ as the secret and then randomly choose $y_0$ and $z_0\pmod{P}$. Now we generate our plane to distribute to the participants: we pick two random integers $a$ and $b$, then we set $$C = z_0 - ax_0 -by_0 \pmod{P}$$ we now ...

3

But I read a question here that PFS can be achieved by deriving session keys with a hash of an old session key. But if I were to know the master key (the pre-shared key?), I could easily calculate all session keys or am I misunderstanding something? So the idea of PFS is that if the entire (secret) state of an entity at a time point $x$ is leaked and there ...

3

This principle is commonplace, it is a key derivation from a shared secret. The academic thing to do is to use a Key Derivation Function or a MAC where hash of a concatenation is used, perhaps $$\operatorname{HMAC-Hash}\;[\;\text{Key}=\text{(EC)DH Shared Secret},\,\text{Message}=\text{Counter}\;]$$ We call the output a derived key, and it can be a one-use ...

2

Yes, the Pseudo Random Number Generator (PRNG) in OpenSSL is Cryptographically Secure, which means it passes statistical tests, but as @Maarten Bodewes suggests in his comment, why not go one step further and use that PRNG directly, rather than through OpenSSL? OpenSSL can use EGD (which stands for Entropy Gathering Daemon). It is a process that taps into ...

2

Kab is session key, which generated by KDC and must be new every time. So the most simple answer is: Bob could not to decrypt {Kab,A}Kab, because he does not know Kab before step 3.

2

If there is no known information about the other side and there is no trusted third party (or any kind of chain of trust), then there is no encrypted comunication possible. Cryptography always has to build upone something, it doesn't work without assumptions: You can't verify the other persons identity, you can't verify any claims, and you can't know if ...

2

Look into the Signal protocol and its associated Double Ratchet algorithm. This changes DH keys after every message without much overhead. As no prime generation is involved in generating new DH keys, there is no expensive processing that would make this impractical. If you don't want to change as often as once per message, you can perform the ratchet once ...

2

We call this idea a key derivation function (hashing the ECDH secret) for a stream cipher (expanding a short secret and a counter into a long pad). This idea is not problematic or weak; in fact, it is ubiquitous. For example, a part of the TLS protocol essentially works as follows: Agree on an ECDH secret $s$. Derive a session key $k = H(s)$ by hashing $s$...

2

I believe the end goal is to use the QKD data as a one-time pad, so the QKD rate would need to be the same as the plaintext data rate. That is the only guaranteed-secure method. (Although I think QKD might be a bit of a scam.) Also, you can't use a key forever. I recently made a 400Gbps AES-GCM encryptor. You're not supposed to send more than 2^32 ...

1

To understand how nonces and timestamps are used to prevent a replay attack, you must understand generally what a replay attack is. A replay attack is a network attack in which a data transmission (that is valid) is repeated or delayed. An attack like this is usually done by an adversary who happens to intercept this data and re-transmits it. If Alice (...

1

Most of it is by definition, use a key twice, or use a pseudo random number as the key, its no longer a one time pad (because that's not how its defined). Why would an encryption technique be weaker than a one time pad if it used a pseudo random number? Because with unlimited computational power (or my be with some other trickery) you could work out the ...

1

This is a problem of permutations with repetition, as we have repeated 1s and 0s. The general formula is quite simple: $$P_r=\frac{n!}{n_0!n_1!...n_k!}$$ $n$ is the number of objects (the length of the string in your case). $n_0$, $n_1$ and $n_k$ is the number of times that the 1st object, the 2nd one and the $(k-1)$st object are repeated, respectively. \$...

1

Use a trusted messenger. If possible, transfer the OTP yourself. Sending OTP keys over the Internet is usually not a very good idea because "the distribution itself won't deliver perfect security" and one must worry about "integrity and authenticity", as Maarten Bodewes has said. Moreover, it is reasonable to assume that using a OTP might attract some ...

Only top voted, non community-wiki answers of a minimum length are eligible