# Tag Info

3

Under an ideal cipher model, every key implements a random permutation. A random wrong key that maps $x_1$ to $y_1$ thus maps $x_2\ne x_1$ to a random ciphertext $y_2'$ other than $y_1$. For a $b$-bit block cipher, there are $2^b-1$ such ciphertexts, thus the probability that $y_2'=y_2$ is $1/(2^b-1)$. The probability that an incorrect key survives two tests ...

0

From probability: Let X be an experiment with possible different outcomes $x_1 ,...,x_n$ with respective probabilities $P(x_1)=p_1,...P(x_n)=p_n$ . Let A be the subset of sample space ${ x_1..,x_n}$ with probability P(A)=p. Let K <= N integers with N >0 and K>=0, $$\begin{pmatrix}N \\k \\ \end{pmatrix} p^k (1-p) ^{ (N-k)} \tag{1}$$ that A ...

0

Thanks to @SEJPM's great answer, I spent some time understanding how it works, and here is a transcript of the workflow in pseudo-code (language-agnostic): dek = 16 bytes random # fixed once forever # encrypt the data nonce0 = 16 random bytes ciphertext, tag = AES_GCM_cipher(dek, nonce0).encrypt(plaintext) save to disk: nonce0 | ciphertext | tag # ...

2

This is case for the Fundamental theorem of software engineering which states: "We can solve any problem by introducing an extra level of indirection." In this case what is usually done is introducing an extra randomly drawn intermediate key (usually called "data encryption key, DEK"). You then encrypt the DEK with a key derived from ...

2

The RSA keys generated by the (Java) code in the question are 1024-bit, thus are not considered secure (even though there has not yet been any successful attack of a 1024-bit RSA key where that size was the only issue, see this). Security authorities no longer recommend anything below 2048-bit, and none that I know condones 2048-bit after 2030. Other common ...

1

AES-128 consists of 10 rounds. Each round includes a public permutation (consisting of the composition of public permutations SubByte ShiftRows MixColumns except for the last round where MixColumns is ommited), and secret tranformations AddRoundKey (consisting of a XOR with a key-dependent and round-dependent value) before the first round, in-between rounds,...

2

The question as initially asked essentially considers a 64-bit symmetric Feistel cipher with 16 rounds, a large (128-bit) key, a near-ideal round function, but the same function and key at each round. A slide attack allows at least a distinguisher, I think with in the order of $2^{31}$ queries to an encryption oracle. With some more, it might be possible to ...

Top 50 recent answers are included