Luis Casillas
  • Member for 5 years, 7 months
  • Last seen this week
3 answers
3 votes
918 views
How to prevent accidental nonce reuse with AEAD cipher
Accepted answer
2 votes

Hard to provide a definitive answer without more information about your application (which would render the question off-topic for Crypto SE). But one relevant technique that many systems use is a ...

View answer
3 answers
2 votes
381 views
Terminology: Is a block cipher in counter mode still considered a block cipher or is it classified as a stream cipher?
2 votes

The way that a lot of practice-oriented, introductory materials use the terminology is at odds with the more rigorous, academic treatments. For example, it's very common to find problematic ...

View answer
2 answers
0 votes
172 views
Blockchain cryptography
2 votes

One key difference between cryptographic hash functions and PRGs is this: Pseudorandom generators (PRGs) are secret key algorithms. A PRG's user needs to provide it with some random input that must ...

View answer
1 answers
3 votes
262 views
Does it make sense to have long SSH Key with shorter Passphrase?
Accepted answer
2 votes

You're not modeling what information the attacker has. The strength of the system only reduces to that of the passphrase if the attacker has a copy of the passphrase-encrypted private key. If they ...

View answer
3 answers
0 votes
2k views
Recommended minimum entropy for online passwords in 2018
2 votes

I think you're missing one major factor in your list: Is the password being used to derive an encryption key that's never in the possession of another party, or is is only used to authenticate the ...

View answer
2 answers
1 votes
283 views
MAC attacks without knowing the key
2 votes

One way to try tackling simpler problems like this is by writing them out as equations and doing algebra on them. In this case, let's take this statement from your comment with the answer: The ...

View answer
3 answers
2 votes
165 views
Protecting my message without encryption
2 votes

I think this is a question that comes down to understanding the basic Alice, Bob and Eve diagram from cryptography textbooks, like this one from Wikimedia that I've chosen because of its license and ...

View answer
2 answers
3 votes
660 views
Should text be hashed before being used as an encryption key?
2 votes

Let's say I have an API that provides an encryption wrapper around another API. I give the consuming programmer the option of either passing a string or byte array as an encryption key. Encrypting ...

View answer
3 answers
0 votes
368 views
Allow everyone to decrypt a message, but don't allow anyone to encrypt it
Accepted answer
2 votes

This is a scenario where your description would be much improved if you explicitly considered the following questions, which you should always ask in cryptography: Who are the "honest" parties? (See ...

View answer
1 answers
0 votes
86 views
Public Key Encryption, how do you handle not trusting the middle man?
Accepted answer
2 votes

With public/private key encryption you must trust the central authority correct? Not quite. The honest parties must have an authenticated (but not necessarily confidential) channel to obtain each ...

View answer
2 answers
1 votes
220 views
clarify perfect secrecy definition
2 votes

"For all $k$, ..." would be a statement of the form that is formalized by first-order logic, but what's going on here is different, we're talking about probability theory, and if you're better ...

View answer
3 answers
2 votes
338 views
Can a key exchange protocol exchange a one time pad instead of a key?
2 votes

I think there's a problem here in that you're not specifying an attack model—what does the adversary see, and what powers do they have? For example, in the case of the one-time pad a standard ...

View answer
1 answers
4 votes
68 views
Key Derivation Functions offering better than 2^hlen security?
2 votes

Note that Krawczyk's paper builds the extract-and-expand paradigm from a notion that he labels computational randomness extractor. This is a modification of the concept of randomness extractor such ...

View answer
2 answers
-1 votes
625 views
Different languages use-cases in information encryption?
Accepted answer
2 votes

The problems here are that: If the method for obfuscating the message has definite, explicit, well-documented rules, then they are part of the encryption algorithm and therefore by Kerckhoff's ...

View answer
2 answers
0 votes
471 views
How to calculate the key size of a redesign of Enigma
2 votes

The key size is just the length of a key when expressed in some code—some system for representing the key as a finite string of symbols drawn from some alphabet. If there are $n$ distinct keys and ...

View answer
2 answers
2 votes
607 views
Could there be a floating point CSPRNG?
Accepted answer
2 votes

I think this is a question where the ambiguity of common terms like "CSPRNG" gets in the way. The problem is that when talking about "CSPRNGs" in different contexts, people variously refer to either: ...

View answer
2 answers
4 votes
327 views
Can compressed data be made to look like random data?
2 votes

I saw the question "Decryption honeypots" and realized that if the message was compressed before being encrypted, then checking compressibility would not help you identify the decoded message. This ...

View answer
1 answers
1 votes
658 views
Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?
Accepted answer
2 votes

The signature for scrypt, straight from the source: /** * crypto_scrypt(passwd, passwdlen, salt, saltlen, N, r, p, buf, buflen): * Compute scrypt(passwd[0 .. passwdlen - 1], salt[0 .. saltlen - 1], ...

View answer
2 answers
1 votes
171 views
Should I use independent symmetric keys for each client should I use keys derived from a master key?
2 votes

The issue that I see unaddressed in your question is: why? When I look at your question, I can think of two general principles: As a general rule, independent random keys are better than derived ...

View answer
1 answers
1 votes
127 views
Why avoid custom HMAC implementations like the following?
Accepted answer
2 votes

You need to be clear about the interface and security goals of what you're trying to achieve, vs. those of HMAC. This passage of your question seems to state your security goals: What if an ...

View answer
3 answers
3 votes
2k views
What if in AES-128 CBC, IV is very related to KEY?
Accepted answer
2 votes

Consider the equations for the CBC encryption and decryption, where $P_i$ and $C_i$ are the blocks of a plaintext/ciphertext pair $P_1P_2\ldots$ and $C_1C_2\ldots$: $$ \begin{align} C_1 &= E_k(IV ...

View answer
3 answers
9 votes
741 views
Universally verifiable random beacon
2 votes

Thinking about this and considering Paul Uszak's very useful (albeit perhaps pessimistic) remarks, one idea to consider for this is to use measurements of randomly fluctuating natural phenomena of ...

View answer
2 answers
4 votes
110 views
Are there any industry standards for PRFs?
2 votes

@CodesInChaos already mentioned HMAC, so I won't repeat it. I'll add, however: NIST 800-38B specifies CMAC, a block cipher mode that can be used as a variable input length MAC or PRF. There are ...

View answer
1 answers
6 votes
624 views
Derivation of many (Key, IV) pairs from random 128 nonces and one secret 512 master key
Accepted answer
2 votes

Do we get to assume that the master key is uniformly selected? The goal of a KDF, as the HKDF paper defines it, is this: Its goal is to take a source of initial keying material, usually containing ...

View answer
2 answers
0 votes
956 views
Creating UID's using hash functions - most appropriate hashing algorithm?
2 votes

I want to run each of these unique integers through a hash function, with the objective of 1) maintaining the uniqueness, 2) obscuring the underlying integer value and 3) having a hash output with a ...

View answer
2 answers
2 votes
256 views
Is the statement true in the context of AES-256 encrypted data stored on a hacked server?
2 votes

I will address you first rewritten version of the text, and highlight the part that I think needs improvement: Important note: as long as the data on the server (name of platform) is encrypted and ...

View answer
3 answers
4 votes
479 views
Would a symmetric cipher with a keylength a big as the data length be information theoretically secure?
2 votes

If you have a keyed family of $2^b$ distinct permutations $E_k(p) : \{0,1\}^b \times \{0,1\}^b \to \{0,1\}^b$ over $b$-bit blocks, and select an independent, uniform random key for each plaintext ...

View answer
4 answers
5 votes
418 views
Why are stream ciphers not PRPs?
2 votes

It sounds to me like this really comes down to definitions. If you look closely at how people use it, you may spot that the term "stream cipher" is regularly used in two closely related but distinct ...

View answer
2 answers
1 votes
196 views
Clarification on Size of an Encryption Key
Accepted answer
2 votes

"Characters" is the wrong level of abstraction here, and fixating on that can only lead you astray. Proper cryptographic keys are not passwords! Passwords are normally human-chosen, and users may ...

View answer
1 answers
2 votes
153 views
Is using a rolling code as a constantly-changing shared secret effective for signing?
Accepted answer
2 votes

I'm confused at your suggestion that your clients would not have access to a public key signature facility, given that you assume that they have crypto hashes and can run code of your authorship. ...

View answer
1
6
7
8 9 10