Luis Casillas
  • Member for 5 years, 9 months
  • Last seen this week
Hypothetical encryption technique, is it secure?
2 votes

I think I can spot an implicit assumption that you're making that could easily trip this up: Assumption: None of the ciphers is its own inverse. Counterexample: Stream ciphers are a popular class of ...

View answer
Splitting an AES-256 key into two?
Accepted answer
1 votes

I understand there are already few question here which are similar but mine is a bit different in that I want to split AES 256 bit into two 128 bit key and then use a different AES key of 128bit to ...

View answer
AES or One-time-pad for encrypting a single 128bit block?
1 votes

So, AES is more secure than one-time-pad in this case. No, the one-time pad is perfectly secure, so it cannot be less secure than AES. What's tripping you up is you're not understanding a subtle ...

View answer
If you have two inputs of the same length, are there theoretically collissions in both MD5 and SHA-256?
1 votes

What I mean is can there be two messages M, M' both of the same length such that both md5(M)=md5(M') and sha256(M)=sha256(M')? Yes, such a pair of messages must exist, for the same reason that any ...

View answer
if a hash function has no known preimage attacks, does that mean there are no known attacks against using it in signatures?
1 votes

Your idea of salting the signature to prevent the collision attack doesn't work, because your salted signing operation is a deterministic mathematical function, and the random choice of salt is only ...

View answer
Are the GPS coordinates a good source of entropy?
1 votes

I think you're running into a conceptual misunderstanding here and looking to extract entropy from values that are better understood as a signal (your GPS's estimate of your position) instead of ...

View answer
Why is it secure to reuse key and nonce in ChaCha20-Poly1305 AEAD construction?
1 votes

Actually, by your own criterion, the same nonce is routinely used much more than twice, because each call to the ChaCha20 core function reuses the same key and nonce, except with a different counter ...

View answer
Seed/key algorithm security
1 votes

"Short" and "long" are relative terms. If I secretly make 128 coin flips and write down the results, that sounds like a lot of coin flips, doesn't it? There's $2^{128} > 10^{38}$ combinations I ...

View answer
Why can a symmetric encryption algorithm be considered a pseudo-random number generation algorithm?
Accepted answer
1 votes

Here are two standard (and equivalent) definitions of confidentiality in symmetric encryption. If Alice sends Bob a message and Eve manages to see it in transit, Eve cannot (without an unreasonable ...

View answer
Is Salsa20+Poly1305 an AEAD?
1 votes

My question is that Poly1305 provide authentication and Salsa20 provides encryption, a combination of both can be considered AEAD or not? There are many ways you could combine both, some are AEADs ...

View answer
If classical ciphers are used with compressed plaintext, how much does it make frequency analysis attack harder?
1 votes

Compression works by approximating an optimal code—one where if the probability of a given message is $p$, its encoded length is $-log(p)$. This means that the lengths of the encryptions of compressed ...

View answer
What is the use of a nonce in public-key encryption if it's meant to be shared?
1 votes

Thing is, this got me thinking - a nonce, in my book is a protection against forgery, but here I am giving it away. The primary purpose of nonces is not protection against forgery, but rather, to ...

View answer
Format Preserving Encyption question
Accepted answer
1 votes

The questions you're getting confused by are, indeed, confusing, but I think I figured out what's going on. Imagine a scenario where: A company want to issue exactly 10,000 numbered coupons; They are ...

View answer
Is a PRG concatenation using the same input still a PRG?
1 votes

Note that for $G : \{0,1\}^s \to \{0,1\}^{n}$ to be a PRG, $n$ must be some polynomial of $s$, so let's rewrite this as $G : \{0,1\}^s \to \{0,1\}^{\ell(s)}$, where $\ell(s)$ is a polynomial. To ...

View answer
Is it safe to use a deterministic salt as an input to KDF (Argon2)?
1 votes

I'm prototyping an app that uses client-side password hashing in order to hide the "real" account password from a server (the server hashes any recieved password anyway, so no plaintext ...

View answer
Any standards for canonical ordering of HMAC or additional data in AEAD ciphers?
1 votes

Imagine I have some serialization (example JSON) that can have 1-100 fields I’ll assemble into data to be get a MAC (my AD in AEAD). The receiving end has no idea which ones are coming, and the ...

View answer
What is the meaning of "probabilistic encryption algorithm"?
1 votes

How can the output of a probabilistic algorithm be different for the same pair of plain text and key when used two different times? The probabilistic algorithm makes calls to a random number ...

View answer
How can a cryptosystem be unconditionally secure?
1 votes

However, since most books define the keyspace $\mathcal{K}$ to be finite, then with infinite time any computational device can perform an exhaustive keysearch. The thing is that it isn't sufficient ...

View answer
What characteristics define a function to be a block cipher
1 votes

So for example, I have the following cipher: $F_k^r(m) := r(k,m)$. Now $r$ is defined as a random compression function such that $r: \{0,1\}^{3n} \rightarrow \{0,1\}^n$. The length of $k$ and the ...

View answer
Cryptographically secure hash function vulnerable to length extension attacks both to front and to back?
1 votes

I think here it helps to examine the nature of length extension attacks, which have to do with the fact that practical hash functions are iterative. They break up their input into a sequence of fixed-...

View answer
Is it safe to use a timestamp to build a nonce?
1 votes

The first point I'd make is: why can't you just use TLS? (Or if it's a non-interactive protocol, why can't you use ECIES?) Nonce-96-bit = Timestamp-Milliseconds-64bit combined_with CsRandom-Number-...

View answer
How do I check if the output of my CFB TEA encryption algorithm is correct?
1 votes

I would recommend modularizing the implementation into these components: A generic interface abstracting the concept of a block cipher. A generic CFB mode implementation, that instead of hardcoding ...

View answer
Should number of iterations of PBKDF2 stay secret?
1 votes

Let's say I encrypt my passwords with PBKDF2 and store it somewhere. It's not clear here whether you literally mean to encrypt some passwords with a key derived from a master password (as a password ...

View answer
Why is release of unverified plaintext so Bad?
1 votes

Isn't unverified plaintext released just nonsense? You're looking at it from a human perspective, and assuming that gibberish is harmless because there's a human in the loop that would spot it. But ...

View answer
Can I prove my app uses randomness right way?
1 votes

A real-life example that's relevant is Diceware, where users generate strong, uniform random passphrases by rolling dice and looking the results up in a numbered wordlist. Diceware's virtue is ...

View answer
XOR and cipher stream
1 votes

why is the plain text, cipher stream and cipher text all in binary? In the first picture, it is all in letters, now in the second picture, it is all in binary. Because classical cryptography (e.g., ...

View answer
HMACSHA1 vs HMACSHA2 (for PBKDF2)
1 votes

You should pick the function that gives a CPU-equipped defender the most advantage against GPU-based attackers (which are the likeliest attackers). How do we find this out? First, let's benchmark ...

View answer
Is there such a thing as perfect CPA security?
Accepted answer
1 votes

The CPA indistinguishability experiment definition that you give is taken from Katz & Lindell's textbook. In my copy (2nd Ed.), it's on page 74. It would seem like this definition cannot be ...

View answer
One Time Pad change by third party?
Accepted answer
1 votes

I was reading about how a one time pad output can be changed by a third party without the receiving person realising. Surely the output at the other end would be garbage? There's no guarantee either ...

View answer
Authentication of data using XOR and a secure function
1 votes

This is a form of what this Bernstein paper calls an (unprotected) counter sum. It is not a secure MAC, it is vulnerable to a simple attack (and I'll use 1-based indexing, unlike your question's 0-...

View answer
1
6 7
8
9 10