why is the plain text, cipher stream and cipher text all in binary? In the first picture, it is all in letters, now in the second picture, it is all in binary. Because classical cryptography (e.g., ...

The contract of a true random number generator is that: Every bit it outputs has an equal chance of being a zero as a one; Knowledge of the values of any of the bits it has output in the past is of ...

Knowing that it does not need to be secret and its only required property is to be unique, why not use a 128 bits true random number for the whole block? The counter instead of starting at 0 will ...

The most important thing you're missing is that you should combine the two strings with an injective function: a function such that every unique combination of inputs determines a unique output. ...

Lots of practical cryptographic algorithms operate on variable length inputs. E.g., if you're encrypting messages, you want your algorithm to be able to handle messages of any reasonable length. But ...

You should pick the function that gives a CPU-equipped defender the most advantage against GPU-based attackers (which are the likeliest attackers). How do we find this out? First, let's benchmark ...

"For all $k$, ..." would be a statement of the form that is formalized by first-order logic, but what's going on here is different, we're talking about probability theory, and if you're better ...

Skimming these three papers should give you an idea (which I list roughly in the order I recommend you look at them): Rogaway, Philip. 2004. "Nonce-based symmetric encryption." Namprempre, ...

One of the candidate answers you should consider is "for no good reason." As Provos and Mazières put it in the bcrypt USENIX paper (section 6.1.2): Some steps in the algorithm make it doubtful ...

The CPA indistinguishability experiment definition that you give is taken from Katz & Lindell's textbook. In my copy (2nd Ed.), it's on page 74. It would seem like this definition cannot be ...

Public-key cryptography allows precisely the sort of thing that's puzzling you: two parties can, over a public channel that eavesdroppers listen on, come up with a shared secret key. “Diffie-Hellman ...

I was reading about how a one time pad output can be changed by a third party without the receiving person realising. Surely the output at the other end would be garbage? There's no guarantee either ...

This is a form of what this Bernstein paper calls an (unprotected) counter sum. It is not a secure MAC, it is vulnerable to a simple attack (and I'll use 1-based indexing, unlike your question's 0-...

I understand the "sudden death" implications of reusing a nonce with ChaCha20-poly1305, but I believe this rule doesn't apply if you are transmitting exactly the same packet. There are two aspects to ...

The property you're thinking of is just that of being a mathematical function: if $x = y$ then $f(x) = f(y)$. Computer folk, who often work with faux "functions" (scare quotes; routine or procedure ...

I think there's a problem here in that you're not specifying an attack model—what does the adversary see, and what powers do they have? For example, in the case of the one-time pad a standard ...

This looks like a straightforward application for a MAC. Let's summarize the security property of MACs: if the honest party chooses the key at random and keeps it secret, it should be impossible in ...

Note that Krawczyk's paper builds the extract-and-expand paradigm from a notion that he labels computational randomness extractor. This is a modification of the concept of randomness extractor such ...

Here's an answer that takes your question down a different path. RFC 2898, "PKCS #5: Password-Based Cryptography Specification: Version 2.0" is the document that defines the PBKDF2 function, ...

The XOR of the tags is trivially vulnerable to multiple easy attacks by an active attacker, which will yield the same tag, for example: They can reorder chunks, because XOR is associative ($a \oplus (... View answer 5 votes If the sender and recipient can agree on the nonce of every message from existing context, so that the nonce either doesn't need to be transmitted or can be derived from metadata that must be ... View answer 5 votes I think of it this way: think of a distinguisher as an adversarially-chosen statistical experiment that attempts to support or refute some hypothesis, that again is adversarially selected. This means ... View answer Accepted answer 3 votes First remark here should be don't roll your own crypto. That said, your idea seems to be a variant of Synthetic Initialization Vector mode (SIV, RFC 5297), where a pseudorandom function of the ... View answer Accepted answer 4 votes Does a practical collision attack on a cryptographic hash function also mean we can (or should) consider it to fail “indistinguishable from random data”? Or does a collision attack have no influence ... View answer Accepted answer 5 votes This sort of combination is vulnerable to a meet-in-the-middle attack. Let's start from one of your equations: $$C = P \oplus f_1(K_1) \oplus f_2(K_2)$$ If we XOR$f_1(K_1)\$ to both sides, we get:...

This depends on: Precise choice of encryption algorithm Choice of representation for the ciphertext Size of additional metadata stored with each ciphertext On #1, 3DES, AES128, AES192 are block ...

The problems here are that: If the method for obfuscating the message has definite, explicit, well-documented rules, then they are part of the encryption algorithm and therefore by Kerckhoff's ...

You need to understand the difference between security goals vs. specific algorithms. PRF and MAC are security goals—they're definitions that stipulate properties that we would like cryptographic ...