30

I strongly disagree with saying that AES-128 is broken, in any way, shape or form, and likewise ECC with 256-bit keys. Note that even in this answer by @kelaka regarding AES-128, you would need over 34 million years of the entire bitcoin mining power to carry out a computation of $2^{128}$. This is far from broken. If quantum computers ever happen at scale, ...


15

As you specifically asked for comparisons of the 128-bit security with concrete things, here is some food for thoughts (to complement the other answers): $2^{61} ≈$ SHA-1 chosen-prefix collision (i.e. definitively practical) from the recent SHA-mbles attack. $2^{63} ≈$ the initial SHA-1 collision from SHAttered attack (which ran over multiple months). (i.e. ...


9

Do you think that such algorithm can be commercialized[...]? This is very unlikely. AES is fast enough for most applications and where it isn't one usually uses (the cheap) hardware acceleration to fix that. Other common scenarios have the usually fast enough for them ChaCha stream cipher. This only leaves true edge cases on ultra-low power devices but this ...


8

The current recommendations of the BSI recommend 120 bit of security beyond 2022. And AES 128 is still in their recommendations. If the current estimate of AES128 is about 126.1 bits of security, that's still above the threshold. And AES has been subject to a lot of cryptanalysis for many years, so that estimate seems quite strong. For crypto with keys, ...


7

how does gpg know which cipher is needed (in this case AES256 instead of the default CAST5? The OpenPGP Symmetric-Key Encrypted Session Key Packet (RFC 4880, §5.3) says which algorithm. wouldn't it be "better" to not tell anyone what encryption type was used? Not really. This is a basic premise of essentially all serious cryptography for more than a ...


7

The unique (we think) property of the cryptosystem offered by this mathematical discovery is that so long as Alice and Bob publicly choose a new particular mathematical object ($T$) to apply their key to before each message sent (of which there is a continuum of choices for $T$), they can use the same initially chosen key to send an arbitrary number of ...


7

The HMAC calculation is used as a KDF here. So 3 keys are derived. Let's start with the statement "In practice, if you know one, you'll know the other.". This is incorrect. The KDF construction uses a one way function so that you cannot get to the input keying material (or seed) s. This means that if an adversary gets hold of the symmetric key c that you ...


6

But, if you and I have a one-time symmetric key, and I send you a message, and it is not complete gibberish, is that itself not message authentication? The informal criterion of "not complete gibberish" that you are applying here has two problems: Malleability: It is trivial to modify OTP-encrypted ciphertexts so that they will decrypt to something that's ...


5

My sky-high level understanding of modern cryptography is as follows: there is an algorithm and a key. Sure, a key is generally generated for a specific cryptographic algorithm that takes a key. The key or key pair is a randomly generated number (I think). Not necessarily. AES and Serpent just take a key consisting of random bits. RSA uses two random ...


5

S & P boxes are not random permutations. Changing them is not easy. The position of each element of an such a box is chosen following principles such as Strict Avalanche criterion, Bit independence criterion, non linearity, xor table distribution and maximum expected linear probability. Not following these makes it prone to differential cryptanalysis. ...


5

Does a cryptosystem exhibiting such properties already exist? For all practical purposes this looks like CPA-secure symmetric encryption which is a solved problem in practice and for practical purposes such a result would only be interesting if it managed to (on-average) encrypt one byte in less than 5 CPU-cycles on a modern CPU. Would a cryptosystem ...


5

AES is not an ideal cipher, nor is it intended to be an ideal cipher. AES is meant to be a practical cipher that offers a strength close to the key size. That means it is computationally infeasible to find the key even if given the plaintext and the ciphertext. AES - when correctly used with a strong mode of operation - produces ciphertext is ...


4

You've described an $n$-of-$n$ threshold encryption scheme by nesting: there are $n$ shares of a secret key, and it takes all $n$ of them (in the right order, so I hope you labeled them) to recover the plaintext. Similarly, there's a simple $1$-of-$n$ threshold encryption scheme by concatenation, which is what, e.g., OpenPGP uses for multiple-recipient ...


4

The OTP does not provide message integrity, wasn't designed too and almost certainly can't. The OTP is a model that formalizes the notion of confidentiality. A System providing integrity should to do so for every correct instantiation of such system. It is however trivial to show correct instantiations of OTP that do not provide integrity. A remark on ...


4

is there a property that guarantees that $D_{k'}(c)$ fails to verify/decrypt? No, there is not; all the security guarantees that authenticated encryption provides is of the form "if you don't know the keys, then it is difficult to..."; it says nothing about the difficulty of anything if you do know the keys. And, it turns out that, with GCM, you can ...


4

Why is the mechanism of encryption formulated in this way? Writing $D(d,E(e,\alpha)) = \alpha$ would imply that $E(e, \alpha)$ is a unique value, and it generally is not in practice (as most encryption schemes are, in fact, nondeterministic; that is, there are a number of ciphertexts that correspond to any specific plaintext). The text as written $\text{Pr}...


4

You shouldn't encrypt large files as if they were just one message; you should split them up into small chunks and encrypt each chunk separately with an AEAD, using some construction that: Protects against modification, reordering, insertion and deletion of chunks; Protects against truncation of the file; Rotates keys once too much data has been processed ...


4

There is no theoretically required here. ShiftRows changes the position of bytes, regardless of their value SubBytes changes the value of bytes, regardless of their position Therefore the order of these operations does not matter


3

The shared symmetric key is the same for all users? The shared key is exactly the same for each user, assuming they are connected to the same WEP access point. Because the nonce is concatenated with the key and fed directly into RC4, each wireless frame is technically using a different key (at least until the small 24-bit nonce repeats). This is unlike 802....


3

Hybrid encryption refers to an implementation of a public-key encryption interface by the composition of a public-key primitive to encapsulate a symmetric key that's used with a symmetric algorithm to encrypt the actual messages. The motivation is that public-key primitives don't perform nearly as well as symmetric ones, so this hybrid encryption optimizes ...


3

There are many assumptions in your question, and most of them are often not correct. The messages cannot be intercepted. If this is true then you simply don't need cryptography at all, your communication is already secure. You use cryptography when you're not sure that it is already secure. The messages cannot be altered If this is true then you don't ...


3

Yes, Serpent also does a deterministic well-known key expansion. So it should be possible to identify the sub keys in memory. You will want to know what implementation you are looking for since there is more than one sensible order for the key material to be in.


3

What would be a good choice for the hash type? Whatever works best for you. As long as the hash is considered secure, the difference comes down to performance. SHA-256 and SHA-512 are both traditional and safe choices recommended e.g. by NIST. You can't really go wrong with either of those. Which one is faster depends on your hardware. (SHA-384 is ...


3

Symmetry is something that is inherent in the design of SPN ciphers. It doesn't explicitly make the layout of the cipher smaller, but it definitely helps. You also see this in AES-NI where you can pipeline AES so each round is an instruction as you can just put latches on the boundaries. For Feistel Ciphers, or Simon at least, I just run the ciphers as ...


3

What is the real advantage of option 2 (asymmetric encryption of firmware)? As correctly pointed by the question, not much. All I can think of: It allows to change the symmetric key at each firmware release (actually, the firmware will be encrypted with a random symmetric key, sent asymmetrically encrypted in a header). This advantage is mitigated by the ...


3

Trivium is designed as an 80-bit key and 80-bit $\operatorname{IV}$. Noted in Algorithms, key size and parameters report 2014. Technical report, ENISA - European Union Agency for Network and Information Security, 2014. increasing the key size was not an easy task. Kreyvium is defined in Stream ciphers: A Practical Solution for Efficient Homomorphic-...


2

For example when I encrypt message A with key K and it outputs B, can somehow A and B be put together, so it will output K? Except for encryption messages where you are specifically restricted to use a specifc key K only once (e.g. OTP), then no, it is infeasible to recover K from A and B. This is a fairly fundamental requirement on encryption methods (...


2

Yes, Vigenère cipher is vulnerable to frequency analysis. BUT! It requires some pre-processing first. I propose to walk us through a small example of how frequency analysis can help decrypting Vigenère cipher in order to get a better idea of the process. Firstly, it is important to notice that if you were to choose a key length of 1, then Vigenère cipher ...


2

Yes, it would be possible to identify Serpent or Twofish keys from round keys in memory, which are likely to exist in a software-only implementation optimized for speed (but not in hypothetical hardware implementations, and not necessarily in implementations optimized for RAM or code size). The Serpent round keys are 132 words of 32 bits, output by a ...


Only top voted, non community-wiki answers of a minimum length are eligible