46 votes
Accepted

Is using the same IV in AES similar to not using an IV in the first place?

Lets see if I can clarify things for you. For one, the IV is not specifically related to AES at all. AES is a keyed invertible transform from a 128 bit value to a 128 bit value; that's all it can do....
user avatar
  • 132k
38 votes

Rubik's Cube as Encryption

Can this be considered as Encryption If the sequence of necessary moves is treated as the key, yes. how secure can this encryption scheme be? First some details about the cube: 6 faces, ...
user avatar
  • 1,187
37 votes
Accepted

Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers

I strongly disagree with saying that AES-128 is broken, in any way, shape or form, and likewise ECC with 256-bit keys. Note that even in this answer by @kelaka regarding AES-128, you would need over ...
user avatar
32 votes

Isn't AES-NI useless because now the key length need to be longer?

No, AES-NI provides a hardware implementation of AES. Before AES-NI, anyone could have purchased a specialized hardware encryption device that ran AES in hardware. So having AES-NI doesn't really ...
user avatar
  • 37.7k
26 votes

Is using the same IV in AES similar to not using an IV in the first place?

You shouldn't think of it as ‘using an IV with AES’. In fact, unless you are a cryptographer, you should forget that ‘AES’ itself exists as a thing: it is a pseudorandom permutation family $\...
user avatar
24 votes

Why is the market for cryptographic primitives non-commercialized?

Are there more examples? About the only other example I can think of is Cryptography Research Inc (now owned by Rambus); however what they sell is methods of implementing primitives (in ways that are ...
user avatar
  • 132k
23 votes

AES: Why is it a good practice to use only the first 16 bytes of a hash for encryption?

Why is it a good practice to use only the first 16 bytes of a hash for encryption? As you noted, it isn't. But, the problem is not with the "16 bytes" part of the statement, or the concern for ...
user avatar
  • 19.2k
23 votes
Accepted

Is Caesar cipher perfectly secret?

Yes, because instead of a Caesar cipher you now have a One-time pad. In particular, it meets the requirements of a key that is random and as long as the message. So as long as the key is kept secret ...
user avatar
  • 1,370
23 votes
Accepted

Why is the market for cryptographic primitives non-commercialized?

Offering a crypto technology for free is the easiest, and certainly one of the reason that's done. Alternatives are: Keeping it secret. Patenting it and selling licenses. An example of 1 is the ...
user avatar
  • 124k
22 votes
Accepted

After ECDH with Curve25519, is it pointless to use anything stronger than AES-128?

The reasoning is wrong, because the scaling of attacks on AES is qualitatively different from the scaling of attacks on X25519. A successful multi-target attack on a system using AES-128—that is, an ...
user avatar
20 votes
Accepted

Do key collisions for symmetric ciphers exist?

The number of possible permutations of a block cipher are $2^n!$ where $n$ is the block size. A permutation maps all $2^n$ possible input blocks to $2^n$ possible output blocks. A key, with key space $...
user avatar
19 votes
Accepted

Isn't AES-NI useless because now the key length need to be longer?

You might gain some perspective from reading up on specialized AES search hardware, like these two systems: COPACOBANA Its successor RIVYERA If you go to the second link and expand the "...
user avatar
19 votes
Accepted

What exactly does s2k do in gpg

The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a ...
user avatar
18 votes
Accepted

Authentication using AES

TL;DR No, the approach is not secure. Use a standard like CMAC instead. Or even better, check your AES accelerator module to see if it supports any AEAD modes of encryption like GCM, CCM, EAX. Long ...
user avatar
  • 37.7k
18 votes

Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers

As you specifically asked for comparisons of the 128-bit security with concrete things, here is some food for thoughts (to complement the other answers): $2^{61} ≈$ SHA-1 chosen-prefix collision (i.e....
user avatar
  • 7,246
18 votes

Is Caesar cipher perfectly secret?

What you described it not a Caesar cipher. A Caesar cipher is a cipher where all letters are shifted by the same number of positions. In the question text you are describing a shift cipher. This is ...
user avatar
  • 2,132
17 votes

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

First, a bit of background. If we refer to the size of an elliptic curve group as $n$, we select an elliptic curve with $n = hq$, where $q$ is a large prime, and $h$ is a small integer called the ...
user avatar
  • 132k
17 votes

Found a way to crack AES-128, what now?

In complete honesty: if you have to ask this question, it's overwhelmingly unlikely that you have actually succeeded in breaking the security of AES. At best, you may have discovered a well-known ...
user avatar
17 votes
Accepted

What is the difference between PBE and symmetric key encryption?

As typically implemented, PBE takes a low-entropy, user-supplied password, adds some entropy to it, and thus strengthens it before turning it into a key. This key can then be used for symmetric ...
user avatar
  • 316
16 votes
Accepted

Is CAST5 still a secure algorithm to use?

CAST5 seems to be a solid 64-bit block cipher with 128-bit key. As far as I can tell after a short literature search, it's definition is sound and unbroken, despite nearly two decades of exposure (...
user avatar
  • 124k
15 votes

Do key collisions for symmetric ciphers exist?

Apparently there's at least one real-life example of a block cipher with equivalent keys: TEA has a few weaknesses. Most notably, it suffers from equivalent keys—each key is equivalent to three ...
user avatar
  • 858
15 votes
Accepted

How to generate the exact AES key in both client and server side?

There are two main ways to have the same symmetric key on both parties: key exchange using asymmetric crypto generate the key from a known secret (eg: a password), such as using a password-based key-...
user avatar
  • 1,573
14 votes
Accepted

Why does applying 56-bit DES twice only give 57 bits of security?

Decrypt the ciphertext with every possible key and store the result: $2^{56}$ decryptions. Now encrypt the (known) plaintext of the ciphertext with every possible key: $2^{56}$ encryptions. Now you ...
user avatar
  • 3,820
14 votes

For a typical n-bit symmetric key, how many keys would be considered too weak to use?

I understand that all zeros or all ones would be weak for any cipher. This isn't actually true. For good cipher there are no weak keys. And certain ciphers, e.g. DES, have a list of weak keys. But ...
user avatar
  • 2,910
14 votes

What should the nonce value be for client-side encryption?

The library uses XChaCha20Poly1305 and that requires a nonce of 192-bit (24-byte). It is an extension of ChaCha20Poly1305 to increase the nonce size, ChaCha20 had ...
user avatar
  • 43.4k
13 votes
Accepted

Post Quantum Symmetric Cryptography

AES-256 is still considered the strongest (and is considered secure) as related key attacks are not particular to analysis with quantum computers. Related key attacks could happen when AES is used ...
user avatar
13 votes
Accepted

Symmetric cipher key size vs number of rounds. Longer key = more secure cipher?

With enough plaintext/ciphertext available (sizably more plaintext than keysize), any cipher can be attacked by trying all the keys; that's brute force. Therefore, for any cipher, too short key ⟹ ...
user avatar
  • 124k
12 votes

Found a way to crack AES-128, what now?

Assuming you really had broken AES or another frequently used algorithm that is thought to be secure, the first step would be to prove it. Write the code for the attack. Verify that it works on ...
user avatar
  • 31.3k
12 votes
Accepted

What is the correct way to implement PBKDF2 + AES CBC + HMAC?

You'll find there's a lot of splitting hairs regarding this topic, especially key derivation. But yes, your pseudocode is fine, although you may want to revise (0, 128) => (0, 127) and (129, 256) => (...
user avatar
  • 3,695
12 votes

Which is the simplest cryptographic algorithm which is close to commercial-level security?

I would say MiMC is the simplest block cipher with plausible security. The idea is to cube the state, add a random constant, and repeat. This is typically done in a large prime field, but it is ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible