56
votes
Accepted
Is AES-128 quantum safe?
All of the above sources are correct; there is not a realistic threat to AES from Grover's algorithm.
The headline statement of $2^{64}$ quantum operations is often misinterpreted because people think ...
- 26.4k
48
votes
Accepted
Is using the same IV in AES similar to not using an IV in the first place?
Lets see if I can clarify things for you.
For one, the IV is not specifically related to AES at all. AES is a keyed invertible transform from a 128 bit value to a 128 bit value; that's all it can do....
- 151k
41
votes
Accepted
Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers
I strongly disagree with saying that AES-128 is broken, in any way, shape or form, and likewise ECC with 256-bit keys. Note that even in this answer by @kelaka regarding AES-128, you would need over ...
- 28.2k
38
votes
Rubik's Cube as Encryption
Can this be considered as Encryption
If the sequence of necessary moves is treated as the key, yes.
how secure can this encryption scheme be?
First some details about the cube:
6 faces, ...
- 1,187
32
votes
Isn't AES-NI useless because now the key length need to be longer?
No, AES-NI provides a hardware implementation of AES. Before AES-NI, anyone could have purchased a specialized hardware encryption device that ran AES in hardware. So having AES-NI doesn't really ...
- 38.9k
29
votes
Why do web-services tend to use preshared secret keys for client authentication instead of public keys?
I don't think it makes sense to call these kinds of tokens "symmetric keys", because they are not encryption keys that are used as input to a symmetric cipher. They are bearer tokens that ...
- 390
26
votes
Is using the same IV in AES similar to not using an IV in the first place?
You shouldn't think of it as ‘using an IV with AES’. In fact, unless you are a cryptographer, you should forget that ‘AES’ itself exists as a thing: it is a pseudorandom permutation family $\...
- 49.5k
25
votes
Accepted
After ECDH with Curve25519, is it pointless to use anything stronger than AES-128?
The reasoning is wrong, because the scaling of attacks on AES is qualitatively different from the scaling of attacks on X25519.
A successful multi-target attack on a system using AES-128—that is, an ...
- 49.5k
25
votes
Can Quantum Computers crack RSA and AES?
It's almost public knowledge by now.
Quantum Computing (QC) does break existing asymmetric-key algorithms - those based on integer factorization and discrete-logarithm such as RSA, DH, ECDSA, etc.
...
- 9,795
24
votes
Accepted
Is Caesar cipher perfectly secret?
Yes, because instead of a Caesar cipher you now have a One-time pad.
In particular, it meets the requirements of a key that is random and as long as the message. So as long as the key is kept secret ...
- 1,674
24
votes
Why is the market for cryptographic primitives non-commercialized?
Are there more examples?
About the only other example I can think of is Cryptography Research Inc (now owned by Rambus); however what they sell is methods of implementing primitives (in ways that are ...
- 151k
23
votes
Accepted
Is password-based AES encryption secure at all?
You are correct in that the best strategy for an adversary would be to guess the password, as opposed to cryptanalysis of AES plaintext/ciphertexts. However, this does not make encryption pointless - ...
- 19.9k
23
votes
AES: Why is it a good practice to use only the first 16 bytes of a hash for encryption?
Why is it a good practice to use only the first 16 bytes of a hash for encryption?
As you noted, it isn't.
But, the problem is not with the "16 bytes" part of the statement, or the concern for ...
- 19.9k
23
votes
Accepted
Why is the market for cryptographic primitives non-commercialized?
Offering a crypto technology for free is the easiest, and certainly one of the reason that's done. Alternatives are:
Keeping it secret.
Patenting it and selling licenses.
An example of 1 is the ...
- 145k
19
votes
Accepted
Isn't AES-NI useless because now the key length need to be longer?
You might gain some perspective from reading up on specialized AES search hardware, like these two systems:
COPACOBANA
Its successor RIVYERA
If you go to the second link and expand the "...
- 14.7k
19
votes
Accepted
What exactly does s2k do in gpg
The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a ...
- 87.8k
19
votes
Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers
As you specifically asked for comparisons of the 128-bit security with concrete things, here is some food for thoughts (to complement the other answers):
$2^{61} ≈$ SHA-1 chosen-prefix collision (i.e....
- 7,789
18
votes
Is Caesar cipher perfectly secret?
What you described it not a Caesar cipher. A Caesar cipher is a cipher where all letters are shifted by the same number of positions. In the question text you are describing a shift cipher. This is ...
- 2,631
16
votes
What should the nonce value be for client-side encryption?
The library also uses XChaCha20Poly1305 and that requires a nonce of 192-bit (24-byte). It is an extension of ChaCha20Poly1305 ...
- 49.5k
15
votes
Accepted
How to generate the exact AES key in both client and server side?
There are two main ways to have the same symmetric key on both parties:
key exchange using asymmetric crypto
generate the key from a known secret (eg: a password), such as using a password-based key-...
- 1,583
14
votes
Is password-based AES encryption secure at all?
Am I right? Is it completely pointless to use passwords to AES encrypt files?
No, certainly it isn't completely pointless to use password to AES encrypt files. However, problem lies within details.
...
- 2,980
14
votes
Accepted
Post Quantum Symmetric Cryptography
AES-256 is still considered the strongest (and is considered secure) as related key attacks are not particular to analysis with quantum computers.
Related key attacks could happen when AES is used ...
- 94.5k
14
votes
For a typical n-bit symmetric key, how many keys would be considered too weak to use?
I understand that all zeros or all ones would be weak for any cipher.
This isn't actually true. For good cipher there are no weak keys.
And certain ciphers, e.g. DES, have a list of weak keys. But ...
- 2,980
14
votes
For Symmetric Cryptography, why is it considered more important to safeguard a key than the function/algorithm for encrypting/decrypting a message?
Some facts for you to consider:
Brutal-force a cryptographic key is much harder than brutal-force breaking into a house - the former can take as long as for a star to explode, while the latter take ...
- 9,795
13
votes
Accepted
Symmetric cipher key size vs number of rounds. Longer key = more secure cipher?
With enough plaintext/ciphertext available (sizably more plaintext than keysize), any cipher can be attacked by trying all the keys; that's brute force. Therefore, for any cipher, too short key ⟹ ...
- 145k
13
votes
Explaining Chaotic Cryptography
Explain the problem that the solution of "chaotic cryptography" is intended to solve
You have the question tagged with encryption, cryptanalysis, and symmetric. So it sounds like it is a method of ...
- 19.9k
13
votes
Accepted
Does symmetric key cryptography usually include hash function?
From what point of view can hash functions be classified as symmetric key cryptography?
Hash functions do not use public/private key pairs, thus are not asymmetric cryptography (though they are ...
- 145k
13
votes
For Symmetric Cryptography, why is it considered more important to safeguard a key than the function/algorithm for encrypting/decrypting a message?
At least two reasons.
1: security. You want your algorithm to be a good one. One of the best ways we know of ensuring cryptographic algorithms are good is to have as many experts as possible assess ...
- 231
12
votes
Accepted
What is the correct way to implement PBKDF2 + AES CBC + HMAC?
You'll find there's a lot of splitting hairs regarding this topic, especially key derivation. But yes, your pseudocode is fine, although you may want to revise (0, 128) => (0, 127) and (129, 256) => (...
- 4,007
12
votes
Accepted
Is it possible to derive an asymmetric algorithm from a symmetric one?
Besides the hash based signature constructions mentioned by @CodesInChaos in the comments, it is entirely possible to build an asymmetric cryptosystem from a secret key one. Granted, the secret key ...
- 19.9k
Only top scored, non community-wiki answers of a minimum length are eligible