Tag Info

16

Salt-less password hashing is only a problem since the amount of passwords actually used in practice is comparably small and also not evenly distributed. Thus it is both in terms of time and memory possible to generate a table with pre-computed hashes and then check the salt-less hashes against this table to reverse the hash. The protection against this are ...

8

We choose groups like RFC 3526 Group #14 or larger so that the precomputation is so large it is not feasible. The main problem with weakdh/logjam is that the chosen groups were originally chosen to be breakable for ‘export-grade’ cipher suites, or what I like to call ‘US imperialism-grade’ cipher suites. The scheme was that US companies—which are the only ...

5

There are two paths in hardware that would be possible without doing something exotic. Erase the actual bits. Blow the bank. Erase: When I make analog floating-gates, I use classical physics to program them (put charge on the gate) and a quantum effect of tunneling to pull charge off (make the gate positive). I could tunnel and read concurrently which ...

4

First, let's re-iterate that there is no true one-time pad in modern cryptography or any other information system - it's only a hypothetical thinking reference. The reason to use OTP in this case, would be to maximize the utility of the rare window where there would be a secure channel. Let's imagine a world without internet and public-key cryptography ...

4

Practically speaking, I think that - in the realm of cryptography - a HSM is the closest that you can get. A HSM is a tamper-proof box that destructs or disables the keys and data stored within it when it detects distortion. Of course a HSM is a practical device; it doesn't provide information theoretic certainty that the information will be destroyed. ...

3

A cryptographic algorithm has provable security if it's unbreakable, even if an adversary has unlimited computational power / time. Is my understanding of provable security correct? It doesn't appear to be accurate. It appears to be mixing up "provably secure" and "information-theoretically secure". You can have a system that is provably secure as ...

3

Any group operation works for a one-time-pad if you can shoehorn a message uniquely into a group element—addition modulo $n$, multiplication modulo $n$ if you can uniquely encode a message block as an integer coprime with $n$, addition or multiplication in finite extension fields, invertible matrix multiplication over finite fields, whatever group you want—...

2

As far as I know OTP is the only algorithm proven to provide perfect secrecy. Naah, there are others. For example, you can do Shamir secret sharing, have the key be one of the shares, and broadcast the other $N-1$ shares. That also has perfect secrecy - it also doesn't have any specific advantages over OTP, so we never consider bothering. What other ...

2

The Gilbert-MacWilliams-Sloane MAC referred to by @SqueamishOssifrage in the comments is information theoretically secure "for single use", at the cost of having hashes that have length $2\ell$ for fixed length messages of length $\ell.$ Poly1305 is not information theoretically secure. It is much more flexible, can take essentially arbitrary length inputs,...

2

This is a standard concept in cryptography, and it is called a stream cipher. It doesn't give ‘perfect’ secrecy, which is a red herring, but it is the modern standard for how to do cryptography—for example, your web browser is almost certainly using exactly this principle right now to talk to the crypto.stackexchange.com web server, using either AES-GCM or ...

2

Ferroelectric RAM is a modern analog to magnetic core memory, from the standpoint that reading it looses the information previously stored (source). Usually there is on-die write-after-read circuitry to prevent information loss (much like that was built in core memory controllers). If that circuitry was removed we'd get a read-once memory. On the other hand,...

2

Because the one-time pad allows you to send a confidential message over an (otherwise) insecure channel at a later time than when you send the key over the requisite secure channel. And at that later time you may not have access to that secure channel. One way to put it is this: most cryptography requires you to use some sort of out of band secure channel ...

1

So there is already PFS in phase I by design. Each time someone establishes a new IPsec VPN tunnel, a new DH shared secret g^xy will be used to compute SKEYID_d, right? Hence, the session key in phase II will also be unique. This is PFS right there? No, you do not recompute a fresh SKEYID_d for every Quick Mode; instead, a value for SKEYID_d is assigned ...

1

You use a secure communication channel to share the key. This is where my brains stop working. Good, your good skeptic brain should at least pause at this point to form a question. Preferably it should start working again and try and get an answer, e.g. from this site :) Why share the key of a OTP through a secure channel, and not just share the ...

1

There is a very practical way to do something essentially equivalent to storing a long one-time pad: store a 32-byte key $k$, and when you need a page of pad material, take the first 32 bytes of $\operatorname{ChaCha}(k)$ as a new key, replacing $k$ in memory, and the remaining bytes—up to about a zettabyte—as your pad. Voilà! As long as you overwrite the ...

1

how does that violate the definition (1) ? Let's assume $|K|<|M|$. Then there exist $c\in C$ and $m\in M$ such that for all $k\in K$, you cannot get $c=E_k(m)$ ($c$ encrypts $m$ under the key $k$). Now expand the conditional probability of your definition (1): $$\Pr[M=m|C=c]=\frac{\Pr[M=m\;\&\;C=c]}{\Pr[C=c]}$$ but since $|K|<|M|$, we already ...

1

No, knowledge of the IKE preshared key will not allow anyone to listen into the IPsec traffic (either with PFS or without). IKE always performs a Diffie-Hellman exchange to generate the initial keying material; knowledge of the preshared keys does not tell the attacker either the Diffie-Hellman private values, or the shared secret. The encryption keys are ...

1

Secrecy capacity is defined as the maximum bit rate that can be sent securely through a channel. Single-letter means that the corresponding capacity expression does not depend on the block length $n$. For example in a degraded wiretap channel, we have the following single-letter characterization of the capacity $C$: $$C = I(X;Y) - I(X;Z)$$ But in more ...

1

However, since most books define the keyspace $\mathcal{K}$ to be finite, then with infinite time any computational device can perform an exhaustive keysearch. The thing is that it isn't sufficient to perform an exhaustive key search. You must also have a procedure to evaluate the candidate decryptions that the key search produces and judge which ones are ...

Only top voted, non community-wiki answers of a minimum length are eligible