I could not find any evidence pointing towards homomorphic encryption. What I could find were different combinations of deterministic and format-preserving encryption. There is probably also a variant ...

We call a primitive broken, if there is any attack faster than bruteforce/what we expect of an ideal primitive. Broken does not mean that there are practical attacks. Even when there were no known ...

A block cipher is a family of permutations where the key selects a particular permutation from that family. With a tweakable bockcipher both key and tweak are used to select a permuation. So tweak and ...

The main difference is that with two 56 bit keys the maximal security level is 112 bit, and thus an attack that has a cost of $2^{112}$ operations is no attack, whereas for three 56 bit keys the ...

SHA-256 is based on a Davies–Meyer compression function. Easy to find fixed-points are a known property of this construction. A notable property of the Davies–Meyer construction is that even if the ...

Collisions of RSA keys should never happen for realistic key sizes and good random number generators. Assume a 1024 bit RSA key; the primes from which it has been derived are about 512 bit. If we ...

The chance of a collision in such a set is approximately $\frac{1/2 \cdot n^2}{2^{160}}$, which for n=100k evaluates to about $3.4 \cdot 10^{-39}$. So it is fair to say, such a collision won't ...

First of all, I'm no expert in this area. Generally $n$ bit ECC seems to have a security level of about $n/2$, but I found some claims that it's lower for certain types of curves. RFC4492 - Elliptic ...

A block cipher is pretty much a substitution cipher. So let's look at a simple alphabetic substitution cipher. There are 26 different plaintexts and 26 different ciphertexts. The cipher is a ...

A few observations: RC4 suffers from related key attacks. This means your idea of concatenating a 224 bit key and a 32 bit IV is not a good idea. You should rather use $\operatorname{SHA-256}(Key\... View answer Accepted answer 23 votes Observation: An individual 1-byte pearson hash behaves like an 8 bit block cipher, encrypting the initial state using the message as key. This means that given a fixed message, each possible initial ... View answer Accepted answer 22 votes With any$n$bit hash it is possible to: Find preimages with work$2^n$on classical computers and$2^{n/2}$using quantum computers Find collisions with work$2^{n/2}$on classical computers and$2^{...

Length extension attack The reason why $H(k \mathbin\| m)$ is insecure with most older hashes is that they use the Merkle–Damgård construction which suffers from length extensions. When length ...

Most hashes are built from permutations (either keyed permutations/block-ciphers, as in MD5, SHA-1 and SHA-2, or unkeyed permutations as in Keccak/SHA-3 and CubeHash). A permutation is a shuffling of ...

I assume you're talking about SSL/TLS or a similar protocol. In these protocols there are two reasons to use Diffie-Hellman: Your certificate only supports signing Either it is an RSA certificate ...

When people say HMAC-MD5 or HMAC-SHA1 are still secure, they mean that they're still secure as PRF and MAC. The key assumption here is that the key is unknown to the attacker. $$\mathrm{HMAC} = \... View answer 18 votes If you know \phi(n) it's trivial to calculate the secret exponent d given e and n. In fact that's just what happens during normal RSA key generation. You use that e \cdot d =1 \mod \phi(n), ... View answer Accepted answer 17 votes Salsa20 has strong rotational symmetry. The main point of these constant is that they're not invariant under rotations, introducing an asymmetry. The precise value isn't very important, as long as it'... View answer Accepted answer 17 votes The security of that approach is equivalent to that of normal CBC. Your scheme with first plaintext block IV^\prime is clearly identical to normal CBC with IV=AES(IV^\prime). Since a block cipher ... View answer Accepted answer 16 votes The wikipedia page for the Birthday problem gives the details, including the exact formula. As an approximation you can use:$$p \approx 1-\exp(-\frac{\tfrac{1}{2}n(n-1)}{2^{256}}) \approx 1-\exp\...

XSalsa20 uses the same cryptographic core as Salsa20 and comes with a security proof that it's secure if Salsa20 is secure. It doesn't use the core of ChaCha and thus has worse diffusion. The way ...

The paper "On the Joint Security of Encryption and Signature in EMV" shows that ECIES and EC-Schnorr signatures can be used together without compromising security: In the random oracle model ECIES-...

In principle raw SHA2 is suitable for deriving an AES key from a DH shared secret. But the "proper" solution is to use a KDF. My preferred choice is HKDF, which can use SHA256 as the underlying hash ...

Write documentation / a paper: An overview What kind of cipher it is and an outline of how it works. Advantages of your algorithm Why should somebody use it, over existing designs? Possible ...

AES has a block-size of 128 bits in all its variants. The number in AES-128/192/256 is the key-size. Rijndael, the block-cipher that became AES, also supports 256 bit blocks, but that part was not ...

We simply strive for crypto that's as close as possible to ideal. Indistinguishably is the strongest property we can demand from a PRNG/streamcipher. It's hard to predict which non ideal properties ...

Password hashes need first pre-image resistance and should not cause many collisions among typical passwords (preserve the entropy). This collision "attack" violates neither requirement and causes no ...

A Mersenne prime is a prime number that can be written in the form $M_p = 2^n-1$, and they’re extremely rare finds. Of all the numbers between 0 and $2^{25,964,951}-1$ there are 1,622,441 that are ...