46
votes
Accepted
Is using the same IV in AES similar to not using an IV in the first place?
Lets see if I can clarify things for you.
For one, the IV is not specifically related to AES at all. AES is a keyed invertible transform from a 128 bit value to a 128 bit value; that's all it can do....
- 132k
38
votes
Rubik's Cube as Encryption
Can this be considered as Encryption
If the sequence of necessary moves is treated as the key, yes.
how secure can this encryption scheme be?
First some details about the cube:
6 faces, ...
- 1,187
37
votes
Accepted
Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers
I strongly disagree with saying that AES-128 is broken, in any way, shape or form, and likewise ECC with 256-bit keys. Note that even in this answer by @kelaka regarding AES-128, you would need over ...
- 26.9k
32
votes
Isn't AES-NI useless because now the key length need to be longer?
No, AES-NI provides a hardware implementation of AES. Before AES-NI, anyone could have purchased a specialized hardware encryption device that ran AES in hardware. So having AES-NI doesn't really ...
- 37.7k
26
votes
Is using the same IV in AES similar to not using an IV in the first place?
You shouldn't think of it as ‘using an IV with AES’. In fact, unless you are a cryptographer, you should forget that ‘AES’ itself exists as a thing: it is a pseudorandom permutation family $\...
- 45.8k
24
votes
Why is the market for cryptographic primitives non-commercialized?
Are there more examples?
About the only other example I can think of is Cryptography Research Inc (now owned by Rambus); however what they sell is methods of implementing primitives (in ways that are ...
- 132k
23
votes
AES: Why is it a good practice to use only the first 16 bytes of a hash for encryption?
Why is it a good practice to use only the first 16 bytes of a hash for encryption?
As you noted, it isn't.
But, the problem is not with the "16 bytes" part of the statement, or the concern for ...
- 19.2k
23
votes
Accepted
Is Caesar cipher perfectly secret?
Yes, because instead of a Caesar cipher you now have a One-time pad.
In particular, it meets the requirements of a key that is random and as long as the message. So as long as the key is kept secret ...
- 1,370
23
votes
Accepted
Why is the market for cryptographic primitives non-commercialized?
Offering a crypto technology for free is the easiest, and certainly one of the reason that's done. Alternatives are:
Keeping it secret.
Patenting it and selling licenses.
An example of 1 is the ...
- 124k
22
votes
Accepted
After ECDH with Curve25519, is it pointless to use anything stronger than AES-128?
The reasoning is wrong, because the scaling of attacks on AES is qualitatively different from the scaling of attacks on X25519.
A successful multi-target attack on a system using AES-128—that is, an ...
- 45.8k
20
votes
Accepted
Do key collisions for symmetric ciphers exist?
The number of possible permutations of a block cipher are $2^n!$ where $n$ is the block size. A permutation maps all $2^n$ possible input blocks to $2^n$ possible output blocks. A key, with key space $...
- 85k
19
votes
Accepted
Isn't AES-NI useless because now the key length need to be longer?
You might gain some perspective from reading up on specialized AES search hardware, like these two systems:
COPACOBANA
Its successor RIVYERA
If you go to the second link and expand the "...
- 14k
19
votes
Accepted
What exactly does s2k do in gpg
The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a ...
- 84.7k
18
votes
Accepted
Authentication using AES
TL;DR
No, the approach is not secure. Use a standard like CMAC instead. Or even better, check your AES accelerator module to see if it supports any AEAD modes of encryption like GCM, CCM, EAX.
Long ...
- 37.7k
18
votes
Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers
As you specifically asked for comparisons of the 128-bit security with concrete things, here is some food for thoughts (to complement the other answers):
$2^{61} ≈$ SHA-1 chosen-prefix collision (i.e....
- 7,246
18
votes
Is Caesar cipher perfectly secret?
What you described it not a Caesar cipher. A Caesar cipher is a cipher where all letters are shifted by the same number of positions. In the question text you are describing a shift cipher. This is ...
- 2,132
17
votes
Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?
First, a bit of background. If we refer to the size of an elliptic curve group as $n$, we select an elliptic curve with $n = hq$, where $q$ is a large prime, and $h$ is a small integer called the ...
- 132k
17
votes
Found a way to crack AES-128, what now?
In complete honesty: if you have to ask this question, it's overwhelmingly unlikely that you have actually succeeded in breaking the security of AES. At best, you may have discovered a well-known ...
- 10.7k
17
votes
Accepted
What is the difference between PBE and symmetric key encryption?
As typically implemented, PBE takes a low-entropy, user-supplied password, adds some entropy to it, and thus strengthens it before turning it into a key. This key can then be used for symmetric ...
- 316
16
votes
Accepted
Is CAST5 still a secure algorithm to use?
CAST5 seems to be a solid 64-bit block cipher with 128-bit key. As far as I can tell after a short literature search, it's definition is sound and unbroken, despite nearly two decades of exposure (...
- 124k
15
votes
Do key collisions for symmetric ciphers exist?
Apparently there's at least one real-life example of a block cipher with equivalent keys:
TEA has a few weaknesses. Most notably, it suffers from equivalent
keys—each key is equivalent to three ...
- 858
15
votes
Accepted
How to generate the exact AES key in both client and server side?
There are two main ways to have the same symmetric key on both parties:
key exchange using asymmetric crypto
generate the key from a known secret (eg: a password), such as using a password-based key-...
- 1,573
14
votes
Accepted
Why does applying 56-bit DES twice only give 57 bits of security?
Decrypt the ciphertext with every possible key and store the result: $2^{56}$ decryptions. Now encrypt the (known) plaintext of the ciphertext with every possible key: $2^{56}$ encryptions. Now you ...
- 3,820
14
votes
For a typical n-bit symmetric key, how many keys would be considered too weak to use?
I understand that all zeros or all ones would be weak for any cipher.
This isn't actually true. For good cipher there are no weak keys.
And certain ciphers, e.g. DES, have a list of weak keys. But ...
- 2,910
14
votes
What should the nonce value be for client-side encryption?
The library uses XChaCha20Poly1305 and that requires a nonce of 192-bit (24-byte). It is an extension of ChaCha20Poly1305 to increase the nonce size, ChaCha20 had ...
- 43.4k
13
votes
Accepted
Post Quantum Symmetric Cryptography
AES-256 is still considered the strongest (and is considered secure) as related key attacks are not particular to analysis with quantum computers.
Related key attacks could happen when AES is used ...
- 85k
13
votes
Accepted
Symmetric cipher key size vs number of rounds. Longer key = more secure cipher?
With enough plaintext/ciphertext available (sizably more plaintext than keysize), any cipher can be attacked by trying all the keys; that's brute force. Therefore, for any cipher, too short key ⟹ ...
- 124k
12
votes
Found a way to crack AES-128, what now?
Assuming you really had broken AES or another frequently used algorithm that is thought to be secure, the first step would be to prove it.
Write the code for the attack. Verify that it works on ...
- 31.3k
12
votes
Accepted
What is the correct way to implement PBKDF2 + AES CBC + HMAC?
You'll find there's a lot of splitting hairs regarding this topic, especially key derivation. But yes, your pseudocode is fine, although you may want to revise (0, 128) => (0, 127) and (129, 256) => (...
- 3,695
12
votes
Which is the simplest cryptographic algorithm which is close to commercial-level security?
I would say MiMC is the simplest block cipher with plausible security. The idea is to cube the state, add a random constant, and repeat. This is typically done in a large prime field, but it is ...
- 387
Only top scored, non community-wiki answers of a minimum length are eligible