Luis Casillas
  • Member for 5 years, 7 months
  • Last seen this week
2 answers
0 votes
259 views
Is it safe to use a MAC as iv for CTR encoding?
Accepted answer
3 votes

First remark here should be don't roll your own crypto. That said, your idea seems to be a variant of Synthetic Initialization Vector mode (SIV, RFC 5297), where a pseudorandom function of the ...

View answer
1 answers
1 votes
2k views
Is there a way or how to predict the output size as a result of encryption?
3 votes

This depends on: Precise choice of encryption algorithm Choice of representation for the ciphertext Size of additional metadata stored with each ciphertext On #1, 3DES, AES128, AES192 are block ...

View answer
2 answers
1 votes
681 views
How to express a coin flip based random generator mathematically?
3 votes

Boneh's definition of a pseudorandom generator stipulates that a PRG is a mathematical function—a mapping from an input domain to an output codomain such that the choice of argument value uniquely ...

View answer
4 answers
7 votes
3k views
When is an RNG a CSPRNG, a CSRNG, or a TRNG?
3 votes

(Disclaimer: I wrote the passage quoted in the question.) Can an RNG which relies — among other things — on a non-deterministic physical noise source still be called "pseudo" random? I would ...

View answer
2 answers
5 votes
221 views
Steganography in speech by adding extra "filler" syllables
Accepted answer
3 votes

To the extent that I think this is a cryptographic question (which I don't!), I don't think these language games qualify as steganography. Steganography conceals the existence of a message by ...

View answer
1 answers
2 votes
313 views
XEX mode - how to perturb the tweak
Accepted answer
3 votes

You then take $T$ and left shift it one bit. If the carry from that operation is a 1, then you XOR in 0x87 on the bottom byte. That becomes the pre- and post-crypto XOR material for the next block and ...

View answer
2 answers
3 votes
277 views
Does “SHAttered” only work for PDF files?
Accepted answer
3 votes

The current version of the SHAttered website has an image that describes the structure of the attack, relative to the PDF. I believe under fair use we can reproduce the image below: So the collision ...

View answer
2 answers
4 votes
753 views
ECB vs CBC for encrypting high entropy data
3 votes

If you look at modes designed for key wrapping or that list it as a key application, a common feature you see is that they are authenticated encryption modes that provide both message confidentiality ...

View answer
1 answers
3 votes
163 views
Unpredictability and non-secret IVs
Accepted answer
3 votes

In an adaptive chosen plaintext attack, the adversary is given the opportunity to query an oracle for encryptions of messages of the attacker choice. In a CPA attack against CBC, for each query the ...

View answer
3 answers
3 votes
536 views
Is it possible to make sense of an unknown language by means of cryptanalysis?
Accepted answer
3 votes

I think the fairest answer that can be given to this question is that cryptanalysts really aren't linguists. To the extent that cryptanalysts deal with language, they do it in a very practical, not ...

View answer
1 answers
0 votes
995 views
Is it possible to obtain AES-128 key from a known ciphertext-plaintext-iv tuple used the encrypt the plaintext?
3 votes

Ciphers are designed to withstand far more adverse situations than the single known plaintext/ciphertext pair that you describe. In particular, they are intended to be secure against chosen plaintext ...

View answer
1 answers
3 votes
442 views
How does Kerckhoffs's principle apply to Adversarial Neural Cryptography?
Accepted answer
3 votes

If I'm interpreting section 2.2 correctly, the "optimal Eve" $O_E(\theta_A) = argmin_{\theta_E}(L_E(\theta_A, \theta_E))$ is actually allowed to see Alice's parameters $\theta_A$. The training of ...

View answer
5 answers
2 votes
687 views
Why do cryptographers need loads of true random numbers?
3 votes

Looking briefly at the paper in the question that you're linking and reading a bit between the lines, it seems like the primary intended application for the high rates is simulations, not cryptography....

View answer
1 answers
0 votes
232 views
Given a sequence of integers, would applying AES encryption to the sequence produce a unique set of strings?
Accepted answer
3 votes

Since any cipher must be able to decrypt every message that it encrypts, it follows that, given a fixed key, any cipher must be an injective function: In mathematics, an injective function or ...

View answer
2 answers
3 votes
1k views
Is the security of MAC function is based on HASH function
3 votes

The key thing you're missing here is that collision resistant hash functions ("CRHFs," what we normally call just "crypto hashes") and message authentication codes ("MACs") have substantially ...

View answer
1 answers
2 votes
333 views
How can I generate cryptographic-quality 1/f noise, aka “pink noise”?
Accepted answer
3 votes

The problem with answering this question as posed is that one would need to have a definition of "cryptographic quality" that applies to 1/f noise. You'd need to talk about something like how many ...

View answer
2 answers
2 votes
460 views
Is there an encryption scheme that is url-safe AND compact?
2 votes

The way the encryption and the encoding parts work really are orthogonal problems, with orthogonal solutions. First: You want to make sure your plaintext strings (e.g. JohnSmith@domain.com|1234|A are ...

View answer
2 answers
3 votes
140 views
Application of cryptographic hash functions which do not require collision resistance property
2 votes

You are right that not every application for a cryptographic hash function will need collision resistance. But on the other hand, you need to think of your example more critically in order to rule out ...

View answer
1 answers
0 votes
61 views
Are there any methods for constructing a password that can be reconstructed if forgotten and is as secure as randomly generated ones?
2 votes

What you're asking for is if we can describe for you a process that would allow you to generate a password such that you can later guess it without knowledge of its outcome. But the problem is you ...

View answer
2 answers
0 votes
137 views
is it unsafe to AES encrypt using multiple modes?
2 votes

A secure cipher is required to produce ciphertexts that are computationally indistinguishable from random strings, so somebody might naïvely think that this is sufficient for your iterated ciphers to ...

View answer
2 answers
2 votes
229 views
What is the difference between a PRF and a PRP, and are cryptographic hash functions the same as HMAC (PRFs or PRPS)?
Accepted answer
2 votes

I read one answer to a similar question that put forth that a hash function is distinct from a PRF, however I've also found materials purporting that cryptographic hash functions are PRFs, and I'm not ...

View answer
1 answers
1 votes
52 views
Integrity of format preserving Encryption
2 votes

The non-malleability of FPE is not a property that can be universally or even most of the time relied on to provide strong integrity protection, as the answer you're quoting points at when it says ...

View answer
1 answers
0 votes
347 views
Length extension attacks, Merkle–Damgård constructions, and HMACs
Accepted answer
2 votes

Your quote is wrong: The wikipedia page for Length Extension Attacks says "Note that since HMAC doesn't use [Merkle–Damgård constructions], HMAC hashes are not prone to length extension attacks." ...

View answer
3 answers
2 votes
101 views
Why probabilistic syntax for encryption schemes?
2 votes

The provision for the encryption algorithm $E$ to be probabilistic is, as poncho already notes, necessary to allow for probabilistic encryption. The notation $\mathrm{Pr}[D(d,E(e,\alpha)) = \alpha] = ...

View answer
2 answers
2 votes
214 views
Is this correct/incorrect password for file encryption scheme secure?
Accepted answer
2 votes

Your $k_2$ value is functioning effectively the same way as conventional password verification methods, where you store a salted password hash of the users' passwords. So it allows for an adversary to ...

View answer
3 answers
0 votes
365 views
How secure is XOR-CBC?
Accepted answer
2 votes

So the XOR-CBC encryption of the i-th block $P_i$ with the key $K$ would be given by the following equation: $$ C_i = C_{i-1} \oplus P_i \oplus K $$ Similarly, the encryption of the previous block ...

View answer
3 answers
1 votes
158 views
Why use an OTP if you already have a secure channel
2 votes

Because the one-time pad allows you to send a confidential message over an (otherwise) insecure channel at a later time than when you send the key over the requisite secure channel. And at that later ...

View answer
2 answers
0 votes
136 views
Two possible plaintext's using OTP decryption
2 votes

Which of the plaintexts is more likely to be the original plaintext and why? A very literal and devious answer to the question (at least as you have posed it) is that 'ATTACK AT DAWN' is more likely ...

View answer
3 answers
1 votes
367 views
Should the seed of CSPRNG produce the same random number?
2 votes

The term "CSPRNG" is one that I find less than entirely helpful, because it tends to encompass two distinct types of algorithm: Algorithms designed to output reproducible pseudorandom streams—meaning ...

View answer
3 answers
1 votes
2k views
Can you find the salt if you have the original password in plaintext and the hashed version?
2 votes

If the hash function is preimage resistant, then it's hard to find any input that hashes to a randomly selected given result. In this case it's not a randomly selected result because we know part of ...

View answer
1
4 5
6
7 8
10