40
Lets see if I can clarify things for you.
For one, the IV is not specifically related to AES at all. AES is a keyed invertible transform from a 128 bit value to a 128 bit value; that's all it can do. Now, if you just happen to have a 128 bit value that you want 'encrypted' into a 128 bit ciphertext, well, you can just use AES as is.
However, we typically ...
38
Can this be considered as Encryption
If the sequence of necessary moves is treated as the key, yes.
how secure can this encryption scheme be?
First some details about the cube:
6 faces, each with 9 pieces visible each. Because the faces share some pieces, and the immovable cube center is not visible, there are only 26 pieces in total: 6 centers (...
35
I strongly disagree with saying that AES-128 is broken, in any way, shape or form, and likewise ECC with 256-bit keys. Note that even in this answer by @kelaka regarding AES-128, you would need over 34 million years of the entire bitcoin mining power to carry out a computation of $2^{128}$. This is far from broken. If quantum computers ever happen at scale, ...
33
No, AES-NI provides a hardware implementation of AES. Before AES-NI, anyone could have purchased a specialized hardware encryption device that ran AES in hardware. So having AES-NI doesn't really change anything. When key sizes are chosen, they must take into account that specialized hardware could be developed. So, the key sizes we use already take this ...
26
It's a good question. As pg1989 said, this is the basis behind stream ciphers, which are very fast in practice.
I thought I'd quickly expand upon your statement that "the one-time pad is the perfect cipher and impossible to crack." This is true, in a sense, but it's worth pointing out that sometimes an attacker wants to do something simpler than "cracking" ...
25
Are there more examples?
About the only other example I can think of is Cryptography Research Inc (now owned by Rambus); however what they sell is methods of implementing primitives (in ways that are resistant to side channel attacks); however those operate just like the standard primitives, so that might not count.
Why do people, scientists not try to ...
24
You shouldn't think of it as ‘using an IV with AES’. In fact, unless you are a cryptographer, you should forget that ‘AES’ itself exists as a thing: it is a pseudorandom permutation family $\operatorname{AES}_k\colon \{0,1\}^{128} \to \{0,1\}^{128}$, which is a technical jargon term that is practically meaningless to any application developer.
Instead, you ...
answered Mar 20 '18 at 11:04
Squeamish Ossifrage
43.8k3 gold badges89 silver badges187 bronze badges
23
Why is it a good practice to use only the first 16 bytes of a hash for encryption?
As you noted, it isn't.
But, the problem is not with the "16 bytes" part of the statement, or the concern for collisions. The problem is with the "hash" part.
16 bytes
As stated in one of the links you shared, AES only uses key sizes of 128, 192, and 256 bits (or 16, 24, ...
23
Offering a crypto technology for free is the easiest, and certainly one of the reason that's done. Alternatives are:
Keeping it secret.
Patenting it and selling licenses.
An example of 1 is the Clifford Christopher Cocks cryptosystem, which is precisely RSA with $e=N$, and remained unpublished for 24 years. The technology is not widely used until it is ...
22
Yes, because instead of a Caesar cipher you now have a One-time pad.
In particular, it meets the requirements of a key that is random and as long as the message. So as long as the key is kept secret and never used for another message, you have OTP security.
21
Yes, this is a widely-used cryptographic construction called a stream cipher. For more information about this and other encryption schemes, Coursera's cryptography class is a good resource.
21
Most hashes are built from permutations (either keyed permutations/block-ciphers, as in MD5, SHA-1 and SHA-2, or unkeyed permutations as in Keccak/SHA-3 and CubeHash). A permutation is a shuffling of the inputs. Once you have a good random permutation, you can easily build a hash from it. See Construction of One-way compression functions from block ciphers ...
20
The number of possible permutations of a block cipher are $2^n!$ where $n$ is the block size. A permutation maps all $2^n$ possible input blocks to $2^n$ possible output blocks. A key, with key space $2^k$ selects one of them. Although that's a huge number of keys, it is dwarfed by the amount of possible permutations.
Now it's not by definition impossible ...
19
You might gain some perspective from reading up on specialized AES search hardware, like these two systems:
COPACOBANA
Its successor RIVYERA
If you go to the second link and expand the "Cryptanalysis Performance" section, they give a performance comparison between their custom AES machine and other platforms. But the short version is that their custom ...
19
The reasoning is wrong, because the scaling of attacks on AES is qualitatively different from the scaling of attacks on X25519.
A successful multi-target attack on a system using AES-128—that is, an attack that recovers one of many keys—can cost much less than $2^{128}$ evaluations of AES-128. Specifically, using Oechslin's rainbow tables, and on a machine ...
18
TL;DR
No, the approach is not secure. Use a standard like CMAC instead. Or even better, check your AES accelerator module to see if it supports any AEAD modes of encryption like GCM, CCM, EAX.
Long Version
In order for a message authentication code (MAC) to be secure, an adversary with oracle access to the MAC (basically this means the adversary can send ...
18
The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a symmetric encryption or MAC algorithm.
Turning passwords into keys is tricky business because passwords that human can remember and accept to type tend to be weak with regards ...
17
As typically implemented, PBE takes a low-entropy, user-supplied password, adds some entropy to it, and thus strengthens it before turning it into a key. This key can then be used for symmetric encryption.
The problem is that the user's password often has so little entropy to start with. If an attacker learns the salt, digest method and quantity of ...
17
As you specifically asked for comparisons of the 128-bit security with concrete things, here is some food for thoughts (to complement the other answers):
$2^{61} ≈$ SHA-1 chosen-prefix collision (i.e. definitively practical) from the recent SHA-mbles attack.
$2^{63} ≈$ the initial SHA-1 collision from SHAttered attack (which ran over multiple months). (i.e. ...
16
In complete honesty: if you have to ask this question, it's overwhelmingly unlikely that you have actually succeeded in breaking the security of AES. At best, you may have discovered a well-known attack against misuse of particular block cipher modes; for instance, plaintext recovery with a chosen-ciphertext attack against ECB, or blind manipulation of the ...
16
CAST5 seems to be a solid 64-bit block cipher with 128-bit key. As far as I can tell after a short literature search, it's definition is sound and unbroken, despite nearly two decades of exposure (more for the round function).
CAST5 is also known as CAST-128, defined in RFC 2144 (1997), and endorsed by ISO/IEC 18033-3:2010 (current). It is a 16-round ...
16
What you described it not a Caesar cipher. A Caesar cipher is a cipher where all letters are shifted by the same number of positions. In the question text you are describing a shift cipher. This is the right wording.
What you described is an OTP. I agree with Eugene Styer's answer. If the letters for the key are taken from the same set (26 letters), and the ...
15
First, a bit of background. If we refer to the size of an elliptic curve group as $n$, we select an elliptic curve with $n = hq$, where $q$ is a large prime, and $h$ is a small integer called the cofactor; it is typically either 1, 4 or 8. The values of $q$ and $h$ will be part of the curve definition.
As you know, with straight DH, we agree on a point $G$...
14
Decrypt the ciphertext with every possible key and store the result: $2^{56}$ decryptions. Now encrypt the (known) plaintext of the ciphertext with every possible key: $2^{56}$ encryptions. Now you have to check every entry, which is in both lists and try it with another plaintext-ciphertext pair. If you can successfully decrypt that, you are very likely to ...
14
Apparently there's at least one real-life example of a block cipher with equivalent keys:
TEA has a few weaknesses. Most notably, it suffers from equivalent
keys—each key is equivalent to three others, which means that the
effective key size is only 126 bits. As a result, TEA is especially
bad as a cryptographic hash function. This weakness led to ...
14
I understand that all zeros or all ones would be weak for any cipher.
This isn't actually true. For good cipher there are no weak keys.
And certain ciphers, e.g. DES, have a list of weak keys. But I assume that there would many 'patterns' that would be detected (if that is the correct term) as weak. For example, 0x0505 ...05, 0x1010...01 and 0x0A0A...0A. ...
14
There are two main ways to have the same symmetric key on both parties:
key exchange using asymmetric crypto
generate the key from a known secret (eg: a password), such as using a password-based key-derivation function
The former is what you will find in TLS, where public key infrastructure is used to verify the other party's public key.
The latter is used ...
14
The library uses XChaCha20Poly1305 and that requires a nonce of 192-bit (24-byte). It is an extension of ChaCha20Poly1305 to increase the nonce size, ChaCha20 had 96-bit nonces. There is no standard for it, only a draft in ietf.org
The nonce is an acronym for 'number used once'. The crucial point is that one must never use the (Key, nonce) pair again. We ...
13
DES is a block cipher. It consists of a pair of algorithms, one for encryption and one for decryption. Each algorithm takes two inputs: the key, and the block to encrypt or decrypt; the output is the encrypted or decrypted block. For DES, the size of a block is 64 bits. So DES only tells you how to encrypt or decrypt data that consists of exactly 64 bits.
...
answered Aug 8 '13 at 11:51
Gilles 'SO- stop being evil'
14.7k3 gold badges40 silver badges76 bronze badges
13
AES-256 is still considered the strongest (and is considered secure) as related key attacks are not particular to analysis with quantum computers.
Related key attacks could happen when AES is used within a construction such as a hash function, where the output of one round is used as a key for the next round.
As far as we know now, quantum computing won't ...
Only top voted, non community-wiki answers of a minimum length are eligible
