CodesInChaos
  • Member for 10 years, 6 months
  • Last seen this week
How is CipherCloud doing homomorphic encryption?
Accepted answer
88 votes

I could not find any evidence pointing towards homomorphic encryption. What I could find were different combinations of deterministic and format-preserving encryption. There is probably also a variant ...

View answer
Why is SHA-1 considered broken?
Accepted answer
45 votes

We call a primitive broken, if there is any attack faster than bruteforce/what we expect of an ideal primitive. Broken does not mean that there are practical attacks. Even when there were no known ...

View answer
What is a tweakable block cipher?
Accepted answer
36 votes

A block cipher is a family of permutations where the key selects a particular permutation from that family. With a tweakable bockcipher both key and tweak are used to select a permuation. So tweak and ...

View answer
Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
Accepted answer
35 votes

The main difference is that with two 56 bit keys the maximal security level is 112 bit, and thus an attack that has a cost of $2^{112}$ operations is no attack, whereas for three 56 bit keys the ...

View answer
Fixed point of the SHA-256 compression function
31 votes

SHA-256 is based on a Davies–Meyer compression function. Easy to find fixed-points are a known property of this construction. A notable property of the Davies–Meyer construction is that even if the ...

View answer
How many RSA keys before a collision?
Accepted answer
27 votes

Collisions of RSA keys should never happen for realistic key sizes and good random number generators. Assume a 1024 bit RSA key; the primes from which it has been derived are about 512 bit. If we ...

View answer
Is it fair to assume that SHA1 collisions won't occur on a set of <100k strings
Accepted answer
26 votes

The chance of a collision in such a set is approximately $ \frac{1/2 \cdot n^2}{2^{160}} $, which for n=100k evaluates to about $ 3.4 \cdot 10^{-39} $. So it is fair to say, such a collision won't ...

View answer
How strong is the ECDSA algorithm?
Accepted answer
26 votes

First of all, I'm no expert in this area. Generally $n$ bit ECC seems to have a security level of about $n/2$, but I found some claims that it's lower for certain types of curves. RFC4492 - Elliptic ...

View answer
AES Key Length vs Block Length
Accepted answer
25 votes

A block cipher is pretty much a substitution cipher. So let's look at a simple alphabetic substitution cipher. There are 26 different plaintexts and 26 different ciphertexts. The cipher is a ...

View answer
Is there a way to make RC4 (ARCFOUR) secure, or is it completely broken?
Accepted answer
23 votes

A few observations: RC4 suffers from related key attacks. This means your idea of concatenating a 224 bit key and a 32 bit IV is not a good idea. You should rather use $\operatorname{SHA-256}(Key\...

View answer
Why is Pearson hash not used as a cryptographic hash?
Accepted answer
23 votes

Observation: An individual 1-byte pearson hash behaves like an 8 bit block cipher, encrypting the initial state using the message as key. This means that given a fixed message, each possible initial ...

View answer
Did NIST verify “post-quantum” claims in the SHA3 proposal papers?
Accepted answer
22 votes

With any $n$ bit hash it is possible to: Find preimages with work $2^n$ on classical computers and $2^{n/2}$ using quantum computers Find collisions with work $2^{n/2}$ on classical computers and $2^{...

View answer
Can Skein be used as a secure MAC in format H(k || m)?
Accepted answer
21 votes

Length extension attack The reason why $H(k \mathbin\| m)$ is insecure with most older hashes is that they use the Merkle–Damgård construction which suffers from length extensions. When length ...

View answer
Why does SHA-1 have 80 rounds?
Accepted answer
21 votes

Most hashes are built from permutations (either keyed permutations/block-ciphers, as in MD5, SHA-1 and SHA-2, or unkeyed permutations as in Keccak/SHA-3 and CubeHash). A permutation is a shuffling of ...

View answer
Why do we need Diffie Hellman?
Accepted answer
20 votes

I assume you're talking about SSL/TLS or a similar protocol. In these protocols there are two reasons to use Diffie-Hellman: Your certificate only supports signing Either it is an RSA certificate ...

View answer
Why is HMAC-SHA1 still considered secure?
18 votes

When people say HMAC-MD5 or HMAC-SHA1 are still secure, they mean that they're still secure as PRF and MAC. The key assumption here is that the key is unknown to the attacker. $$\mathrm{HMAC} = \...

View answer
Why is it important that phi(n) is kept a secret, in RSA?
18 votes

If you know $\phi(n)$ it's trivial to calculate the secret exponent $d$ given $e$ and $n$. In fact that's just what happens during normal RSA key generation. You use that $e \cdot d =1 \mod \phi(n)$, ...

View answer
Security considerations on "expand 32-byte k"-magic number in the Salsa20 family of stream ciphers?
Accepted answer
17 votes

Salsa20 has strong rotational symmetry. The main point of these constant is that they're not invariant under rotations, introducing an asymmetry. The precise value isn't very important, as long as it'...

View answer
Using CBC with a fixed IV and a random first plaintext block
Accepted answer
17 votes

The security of that approach is equivalent to that of normal CBC. Your scheme with first plaintext block $IV^\prime$ is clearly identical to normal CBC with $IV=AES(IV^\prime)$. Since a block cipher ...

View answer
Probability of SHA256 Collisions for Certain Amount of Hashed Values
Accepted answer
16 votes

The wikipedia page for the Birthday problem gives the details, including the exact formula. As an approximation you can use: $$p \approx 1-\exp(-\frac{\tfrac{1}{2}n(n-1)}{2^{256}}) \approx 1-\exp\...

View answer
Dancing confusion with Daniel J. Bernstein's stream ciphers
Accepted answer
16 votes

XSalsa20 uses the same cryptographic core as Salsa20 and comes with a security proof that it's secure if Salsa20 is secure. It doesn't use the core of ChaCha and thus has worse diffusion. The way ...

View answer
Using same keypair for Diffie-Hellman and signing
16 votes

The paper "On the Joint Security of Encryption and Signature in EMV" shows that ECIES and EC-Schnorr signatures can be used together without compromising security: In the random oracle model ECIES-...

View answer
Is SHA 2 suitable for key derivation?
Accepted answer
15 votes

In principle raw SHA2 is suitable for deriving an AES key from a DH shared secret. But the "proper" solution is to use a KDF. My preferred choice is HKDF, which can use SHA256 as the underlying hash ...

View answer
How to submit a new method of encryption?
Accepted answer
15 votes

Write documentation / a paper: An overview What kind of cipher it is and an outline of how it works. Advantages of your algorithm Why should somebody use it, over existing designs? Possible ...

View answer
How can there be AES-256-GCM, when GCM is defined for 128-sized blocks?
Accepted answer
15 votes

AES has a block-size of 128 bits in all its variants. The number in AES-128/192/256 is the key-size. Rijndael, the block-cipher that became AES, also supports 256 bit blocks, but that part was not ...

View answer
Why do we require a CSPRNG's output to be indistinguishable from true random?
Accepted answer
15 votes

We simply strive for crypto that's as close as possible to ideal. Indistinguishably is the strongest property we can demand from a PRNG/streamcipher. It's hard to predict which non ideal properties ...

View answer
Is PBKDF2-HMAC-SHA1 really broken?
Accepted answer
15 votes

Password hashes need first pre-image resistance and should not cause many collisions among typical passwords (preserve the entropy). This collision "attack" violates neither requirement and causes no ...

View answer
RSA primes vs. largest known primes
Accepted answer
15 votes

A Mersenne prime is a prime number that can be written in the form $M_p = 2^n-1$, and they’re extremely rare finds. Of all the numbers between 0 and $2^{25,964,951}-1$ there are 1,622,441 that are ...

View answer
The Salsa20 core preserves diagonal shifts?
14 votes

The input of the Salsa20 core is a 4x4 array of 32-bit words. If you move all the inputs diagonally (wrapping), the output will be the same as the original output, except that it's moved by the same ...

View answer
Does a trace of SSL packets provide a proof of data authenticity?
Accepted answer
14 votes

The server doesn't sign the data itself. It only signs part of the handshake if you're using a signing based suite. That means you can prove to a third party that a handshake with a certain server ...

View answer
1
2 3 4 5
9