Tag Info

Accepted

Largest integer factored by Shor's algorithm?

wondering what the largest integer is which they were able to factor with a small quantum computer This answer starts with stunt records. See final paragraph for the the largest meaningful record. ...

What size should the HMAC key be with SHA-256?

Short answer: 32 bytes of full-entropy key is enough. Assuming full-entropy key (that is, each bit of key is chosen independently of the others by an equivalent of fair coin toss), the security of ...
• 141k

What is the maximum size of the plaintext message for RSA OAEP?

Important note: usually OAEP is only used to encrypt a random symmetric key, which is then used to encrypt a plaintext message; this is called a hybrid cryptosystem. Repeated use of OAEP would require ...
• 92.6k
Accepted

Argon2 output length and parameter storage?

You need to consider the weakest link property: a security system is never stronger than its weakest link. Since Argon2 is a password-based function, the weak link here is going to be the strength of ...
• 14.5k

What is the minimum and maximum value of an RSA private exponent?

In summary: Modern practice is to fix a small public exponent $e$ such as $e=2^{(2^4)}+1=65537$, then choose a public modulus $N$ of $\text{nlen}$ bits (the key size) with large random prime factors ...
• 141k
Accepted

What is the maximum key size for a 128 bit AES?

Despite similarities, it is really important to understand that passwords and cryptographic keys should not be carelessly conflated. Some important contrasts: Passwords are normally selected by ...
• 14.5k
Accepted

Password entropy much lower than entropy of encryption keys. Why is this acceptable?

I know that humans would find it impossible to maintain a 128 bit password -- however, I wonder if there is some technical reason why a 52 bit password would not be as weak as a 52-bit encryption key ...
• 32.1k

Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?

SHA-512 has both a larger internal state and a higher number of rounds than SHA-256 - which means that it provides a higher bit strength. Somewhat surprisingly it may also outperform SHA-256, as it ...
• 92.6k

Brute-forcing Symmetric Keys

No, it doesn't help. It doesn't hurt either; as long as you don't repeat keys, the probability of success is always the same. That is, if there are $2^n$ possible keys, and you test $\lambda$ of ...
• 147k

What is the purely mathematical definition of encryption strength?

There isn't just one, because there are many different scenarios where you'd use such a function, where the attacker has lesser or greater powers, or variably stringent success goalsâ€”different attack ...
• 14.5k
Accepted

Why can't we give block ciphers larger keys?

I saw many people complainig about AES , twofish and serpent that these ciphers all could be crackable in the near future and even today with big datacenters . This is a good example of why we should ...
• 19.6k

What is the maximum key size for a 128 bit AES?

AES-128 requires keys 128 bits in length, period. As Thomas points out in his comment, the size of characters is encoding-dependent, so there is no well-defined "number of characters" in an AES key. ...

"128-bit security" or "128 bits of security"?

The term used in the Security level article in Wikipedia is n-bit security or for example: 128-bit security level In cryptography, security level is a measure of the strength that a cryptographic ...
• 428
Accepted

What is the recommended minimum key length for ECDSA signature

You are already well on your way if you've found https://keylength.com. It references the documents that the recommendations are based on, so if you need a more clear reason to go for a specific key ...
• 92.6k
Accepted

80-bit collision resistance because of 80-bit x87 registers?

Coprocessors are designed for improved performance in a certain case, and in the case of fixed-width mathematics, I do not believe you would see a performance increase. I am quite sure that 80-bits ...
• 4,820

Why can't we give block ciphers larger keys?

I saw many people complainig about AES , twofish and serpent that these ciphers all could be crackable in the near future and even today with big datacenters Let me go through some of the lesser ...
• 147k

Nexor, an encryption algorithm that promises unlimited key sizes: Is it safe?

Looking very briefly at the source, it's just using the output of /dev/urandom to generate keys, then using that as a (poor) One-Time Pad. /dev/urandom is just a ChaCha20-based RNG with some decent ...
• 5,836

Does this RSA decryption scheme make sense?

You're right, normal RSA does not (and cannot) work like that. Most likely, your client either: is using RSA with an absurdly low (and insecure) key size, is not actually using RSA at all, or has ...
• 46.1k

How big an RSA key is considered secure today?

An adversary with a moderately large quantum computer to run Shor's algorithm will cut through a 1024-bit RSA modulus like a hot knife through butter, and maybe through a 2048-bit RSA modulus like a ...
• 48.5k
Accepted

It will happen immediately, because you just posted your password to the internet, where the adversary is watching. On the other hand, if you can describe the procedure you used to generate it, we ...
• 48.5k

How Secure is gpg Command Using Symmetric AES-256 From Being Cracked

GPG's AES-256 symmetric encryption is believed to be as secure as it is difficult to guess the passphrase or compromise the machine used to perform encryption and decryption. Guessing the passphrase ...
• 141k

80-bit collision resistance because of 80-bit x87 registers?

The original SHA-1 and Skipjack specifications did not provide a justification for using a 80-bit key size, so we can only speculate about the reasons. However, it is important to understand that ...
• 36.4k

Recommended key size for DKIM

Nobody has publicly announced that they've broken 1024-bit RSA (other than via implementation defects that can happen with any key size), but it's not out of the question. I can't find a recent ...
Accepted

For RSA keys, is the safety of a given key-length different for signing vs encryption?

No, the security is about identical, as the underlying RSA problem is the same. Besides that, non-repudiation is usually managed differently with regards to legal requirements. Providing ...
• 92.6k

Is a 4DES or 5DES system possible?

There is a very interesting paper that relates to this exact question (but you wouldn't guess it from the title). The paper is titled Efficient Dissection of Composite Problems, with Applications to ...
• 27.8k
Accepted

How secure is AES-256, but with an effective key length of 56-bits?

It would appear that this is as a consequence of the Wassenaar Arrangement (more detailed explanation). Basically, because cryptography falls under certain laws regarding munitions and arms ...
• 4,042

What is the purely mathematical definition of encryption strength?

One of the definition is stated in the other answer (indistinguishably). Another way to assert the strength of an algorithm is to compute the complexity of an attack. Let us assume E : \mathcal{K} \...
• 9,988

Why can't we give block ciphers larger keys?

Cryptographers can and we do create block ciphers with bigger keys, take for instance the Threefish cipher which has key/block sizes of 256, 512 and 1024 bits. However, since strong block ciphers ...
• 92.6k