13 votes

Is there a downside to encrypting too much data with the same key?

Yes, but the answer is more or less embedded in the question here; you can only say that you encrypt too much data in case the secret key and / or plaintext becomes vulnerable. Most modes of ...
user avatar
  • 85.9k
12 votes
Accepted

AES key reuse and guessing the key

You're missing a piece in your understanding of modern encryption. AES is a symmetrical block encryption cipher. It describes how to use a key (which can be 128, 192 or 256 bits long) to encrypt and ...
user avatar
  • 256
11 votes

Many time pad attack (XOR)

A character is usually encoded as an ASCII. This means that it uses up one byte. That's a number from $0 - 255$. It can be represented as a hexadecimal $\text{0x00} - \text{0xFF}$. All your operations ...
user avatar
11 votes
Accepted

What happens if a nonce is reused in ChaCha20-Poly1305?

If you reuse a nonce, you lose confidentiality for the messages with that nonce. Messages with other nonces retain their confidentiality. However, the attacker can also attack the MAC part (Poly1305) ...
user avatar
  • 31.3k
9 votes
Accepted

Is there any reason not to use Single-Key EM with AES and a constant key?

This is considered in §6 of Bogdanov et al., who go on to devise an alternative 2-round AES-based Even-Mansour cipher—$\text{AES}^2$. The problem is, essentially, that 1-round Even-Mansour is only ...
user avatar
  • 11.7k
9 votes

How does one attack a two-time pad (i.e. one time pad with key reuse)?

I just came across this question and was surprised that no one referenced the paper: A Natural Language Approach to Automated Cryptanalysis of Two-time Pads by Mason et al. at ACM CCS 2006. This shows ...
user avatar
9 votes
Accepted

Can the same One-Time-Pad be re-used with some tricks

Based on comments it seems the question asks if this is as secure as OTP as opposed to finding a practical attack. It is clearly not as secure as OTP. It is not information thetorical secure. With ...
user avatar
  • 10.7k
8 votes

Problems with using AES Key as IV in CBC-Mode

This usage is very insecure as it can leak the AES KEY (If decryption is allowed). Consider this case where the server prints the decrypted text. The attacker can modify the $C_i$ to recover the $IV$, ...
user avatar
8 votes
Accepted

Is including the key as AAD actually dangerous?

One potential issue with GCM is that it can potentially make the problems you get from repeating nonces worse; instead of allowing you to forge, and revealing the plaintext for the packets with the ...
user avatar
  • 134k
7 votes

Is it safe to reuse ECDH asymmetric keys for authentication?

Such keys are called static keys. Keys that are newly generated each time are called ephemeral keys. Note that you need to trust the public keys of the static key pairs to use them for authentication. ...
user avatar
  • 85.9k
7 votes

XOR and key reuse

You've constructed a (somewhat artificial) special case where what you call the "plaintexts" also meet the requisites that one-time pad keys are supposed to meet: Secret Chosen uniformly at random ...
user avatar
7 votes

Research question: usefulness of newly discovered symmetric key cryptosystem

The unique (we think) property of the cryptosystem offered by this mathematical discovery is that so long as Alice and Bob publicly choose a new particular mathematical object ($T$) to apply their key ...
user avatar
  • 134k
6 votes

Is it safe to reuse ECDH asymmetric keys for authentication?

Yes, the same keypairs can be used to derive shared secrets between multiple pairs of parties. If knowing the shared secret between Alice and Bob would help Eve find out the shared secret between ...
user avatar
  • 31.3k
6 votes

Can the same One-Time-Pad be re-used with some tricks

A OTP is by definition just that, one time. Reuse allows analysis. Taking the OTP and applying a fixed algorithm to it, even using different encryption each time to refresh it, simply gives two codes ...
user avatar
  • 270
6 votes
Accepted

Public Key generation for Ed25519 vs X25519

The public key representations are related but not the same. They cannot be used interchangeably without additional processing. The curves are birationally equivalent; a point on a curve has an ...
user avatar
  • 2,829
5 votes
Accepted

Can I use an ECDH Shared Secret from the same Private / Public Key Pair?

No, it's not a problem. What you've found is known as the square computational diffie-hellman problem(SCDH) and it can be shown that this is equivalent to the computational diffie-hellman problem(CDH)...
user avatar
  • 44.7k
5 votes

Is including the key as AAD actually dangerous?

I think the realistic answer is that we don't know if it's dangerous. In cryptography, anything we don't know the security properties of needs to be treated by default as if it's insecure. To my ...
user avatar
5 votes

Is including the key as AAD actually dangerous?

As a concrete example of a recent discussion where a similar question was considered, the IRTF draft for AES-GCM-SIV was at one point revised because of possible attacks on protocols that (...
user avatar
5 votes

Why are ephemeral/session/temporary keys useful?

Why else are ephemeral keys used? Ephemeral keys are not a specific form of keys, they are just short lived keys within a key establishment protocol. Usually they are not directly trusted as they are ...
user avatar
  • 85.9k
5 votes
Accepted

Research question: usefulness of newly discovered symmetric key cryptosystem

Does a cryptosystem exhibiting such properties already exist? For all practical purposes this looks like CPA-secure symmetric encryption which is a solved problem in practice and for practical ...
user avatar
  • 44.7k
5 votes

Why is possible to encrypt multiple messages within the same stream in AES

You did not clearly read the documentation of your library. With the cipher.encryptor() you open streaming and it is only finalized with the ...
user avatar
  • 43.5k
4 votes

Perfect secrecy with n-time key

What you need for this is something called an $n$-wise independent hash function (like "pairwise independent" but $n$ instead). Such a hash function has the property that when applied to at most $n$ ...
user avatar
4 votes

AES key reuse and guessing the key

Apologies if this is too basic but all the explanations about AES focussed on the details of the protocol, not these more basic concepts. In fact you are asking about general secret key ...
user avatar
  • 1,192
4 votes
Accepted

How to attack a two time pad if the plain text is randomized?

If your PRNG is good and your seed unknown $C_R = pt \oplus PRNG(seed)$ is essentially already an encryption of the plaintext using a stream cipher constructed from a PRNG. Specifically it is ...
user avatar
  • 4,691
4 votes
Accepted

How to decrypt two images encrypted using XOR with the same key?

PNG is a compressed image format. This means that, unlike with uncompressed formats like BMP or netpbm, the bytes stored on disk in the PNG file do not correspond directly to the bytes of actual ...
user avatar
4 votes

Why is possible to encrypt multiple messages within the same stream in AES

You're encrypting only one message here, namely secret messageI'll give you 100 and that's my last offer. You chose AES-CTR without authentication. In this mode, ...
user avatar
  • 468
3 votes

Is it bad design to reuse an AES key?

Now, on to your question. But, since reusing the IV with the same key is something that you should never, ever, ever do, I'm going to assume that instead, you are generating a new random IV for each ...
user avatar
  • 37.8k
3 votes
Accepted

Is reusing keys for CBC and CBC-MAC secure when using encrypt-then-MAC?

No, it is not necessarily secure. Here is a simplified example of why not. Assume one block zero messages are encrypted without padding. The ciphertext is $I||E(I \oplus 0)$. The MAC value is thus $E(...
user avatar
  • 31.3k
3 votes

Decrypting messages crypted with one time pad (used more than once)

First of all, there is nothing really special about spaces. It is a fact of how the ascii encoding is put together that e.g. chr(ord('a') ^ ord(' ')) = 'A' and vice ...
user avatar
3 votes

Envelope Encryption with asymmetric keys vs KMS

It's all about where you store the secret and who has access to it. First a clarification: You are confused. KMS does not use asymmetric encryption (also called Public-Key encryption). It uses ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible