Henno Brandsma
  • Member for 10 years, 3 months
  • Last seen more than a week ago
2 answers
25 votes
3k views
Why is PuTTYgen-created RSA public exponent(e) not in {3,17,65537}?
17 votes

Any $e$ such that $\gcd(e, (p-1)(q-1)) = 1$ will do. There is no need for it to be in the set $\{3,17,65537\}$; these last numbers are chosen for speed of encryption, mostly (two set bits leads to ...

View answer
1 answers
5 votes
6k views
How is LUKS dm-crypt secure if the key is stored with the encrypted data?
Accepted answer
12 votes

The key is not stored with the encrypted data, the encrypted key is. This is part of the header. In short, when the volume is created a random key (the master key) is generated and this random key is ...

View answer
3 answers
7 votes
6k views
How to attack a classical cipher using known partial plaintext?
11 votes

As the other poster rightly pointed out, it's a Playfair cipher. Even without the known plaintext, the program "playn" here will give the right text in less than a second. (you can compile it ...

View answer
2 answers
20 votes
12k views
What are the main weaknesses of a Playfair cipher, if any?
9 votes

Some additions to the other answer: any given letter can only correspond to a fairly limited number of ciphertext letters: only the ones in the same column or row, and never to itself. So a highly ...

View answer
3 answers
1 votes
653 views
Understanding MACs and why cleartext is sent over
8 votes

A MAC is used to ensure two properties, really: the message has not been altered and the message has been indeed be sent by Alice and not Eve. If the MAC is secure, then Eve cannot change the message ...

View answer
2 answers
11 votes
6k views
AES Inverse Key Schedule
7 votes

Yes. See the schema in this answer. You are given $k_{43}, k_{42}, k_{41}, k_{40}$. So you can compute $k_{39}$ from $k_{43} = k_{42} \oplus k_{39}$ etc. Just follows the recursion backwards. There ...

View answer
1 answers
6 votes
2k views
What causes first block of AES decryption to be garbled, even with correct IV?
Accepted answer
7 votes

For TLS the IV for the first packet is generated from the shared secrets; quoting the RFC 2246: To generate the key material, compute key_block = PRF(SecurityParameters.master_secret, ...

View answer
1 answers
-1 votes
185 views
Why is the XOR of plaintexts equal to the XOR of ciphertexts with a two time pad?
Accepted answer
6 votes

We know, by the encryption rule for one-time pads, where $k$ is the re-used pad: $p_1 \oplus k = c_1$ and $p_2 \oplus k = c_2$. For $\oplus$ (xor) the following arithmetic is valid: $a \oplus a = 0$...

View answer
3 answers
5 votes
2k views
AES column mixing and S-Box confusion
Accepted answer
6 votes

You should think of Rijndael's S-box as a function that maps bytes to bytes, where a byte (octet) is considered to be a member of a finite field of size $2^8$ (with xor as addition). It's not seen as ...

View answer
3 answers
38 votes
41k views
What are preimage resistance and collision resistance, and how can the lack thereof be exploited?
6 votes

Often the hash (iterated and salted mostly) of a password is saved in a database, instead of the password. If a user logs in, the hash is computed and compared against the stored hash value. This way ...

View answer
3 answers
1 votes
1k views
Base64 encoding of strings
5 votes

The whole purpose of base64 encoding is to take arbitary byte values and transform them into a limited subset of ASCII characters so that they can be "safely" sent (older transmission protocols could ...

View answer
3 answers
1 votes
3k views
RSA - How to change the encrypted numerical result into text?
5 votes

You don't encode the encrypted result of an RSA encryption to text; it's just a sequence of bytes. It makes no sense as "text". In network traffic such bytes can often just be sent as is, but if you'...

View answer
4 answers
6 votes
870 views
How to forge Schnorr signatures if you can guess the challenge
5 votes

Suppose that we have Eve, that knows what $e$ is going to be, and does not need to know the prover's private key $s$, just the public one $v$. She then sends $g^k \cdot v^{-e}$ as her first "move", ...

View answer
4 answers
1 votes
769 views
Message exchange with textbook RSA
Accepted answer
5 votes

Basically $M = 9$ is a challenge. Alice will have to sign it (compute $M^d \pmod {21})$, because only she knows $d$. As $(M^e)^d = (M^d)^e = M \pmod{21}$, it should be clear what Bob should do to ...

View answer
2 answers
1 votes
221 views
How can I use the whole potential of DES?
5 votes

Programming your own DES is usually a bad idea (unless as an exercise to understand the algorithm better), but OK. By definition the algorithm works with blocks of data that consist of 8 bytes (i.e. ...

View answer
1 answers
0 votes
340 views
Why is g is less than p in Diffie-Hellman?
5 votes

It's an element of the field of all integers modulo $p$, and these are represented by the numbers $0,\ldots, p-1$. And $g$ will be one of them.

View answer
2 answers
9 votes
33k views
Cipher Feedback Mode
5 votes

To address the other issue (with the CFB-1, CFB-8, registers, etc.): Note that in the picture we encrypt whole blocks of the previous ciphertext, and xor the result with the next plaintext block, to ...

View answer
2 answers
2 votes
169 views
When is each key used when encrypting an email using OpenPGP?
Accepted answer
5 votes

Let Alice have a key pair (PubKeyA, PrivKeyA), where the first is public, the second private, and similarly for Bob (PubKeyB, PrivKeyB). Alice and Bob know each other's public keys in a reliable way (...

View answer
1 answers
2 votes
194 views
Problem reproducing AES results
Accepted answer
4 votes

I think the flash implementation is wrong: (using Linux, OS X terminal etc.) not true, see below echo 328831e0435a3137f6309807a88da234 | xxd -r -p > plain.dat openssl enc -e -aes-128-ecb -iv 00 -K ...

View answer
3 answers
8 votes
1k views
Finding roots in $\mathbb{Z}_p$
4 votes

Yes, there is. There is a polynomial algorithm for solving general polynomial equations, like $x^n - a \mod{p}$ in a finite field. And for simple powers, its even easier. So I wouldn't use this for a ...

View answer
3 answers
13 votes
2k views
Is it reasonable to assure that p-1 and q-1 aren't smooth?
4 votes

I'll leave the probability to someone else, but to ensure the non-smoothness of $p-1$ most libraries (including OpenSSL) will generate a prime $p'$ such that $2p' + 1$ is also prime, and then ...

View answer
1 answers
2 votes
241 views
Blowfish encryption with different keys produces same ciphertext
3 votes

It looks like the library is treating the string as the key to Blowfish, which has a veriable key size; the way the keysetup is done (with a cyclical use of the key bytes, see more details on the ...

View answer
2 answers
6 votes
3k views
Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?
3 votes

The padding used for RSA is not the PKCS #5/#7 padding (as you seem to suggest in your own answer), but the Wikipedia entry seems to refer to PKCS #1 v1.5 (RFC2313)) which uses a padding 00 || BT || ...

View answer
1 answers
1 votes
236 views
Hash algorithm for user accounts passwords in macOS 10.12, 10.13, 10.14
3 votes

As @kelalaka said, the answer is still valid as described in this question, so a PBKDF2-SHA512 hash with a large salt and iteration count in the 100000's, usually.

View answer
2 answers
4 votes
953 views
AES-128 as compression function in Merkle-Damgard construction
3 votes

This short thesis describes some of the basic ways in which to use the Merkle-Damgård construction based on block ciphers. The construction that is commonly used in MD5 and related constructions is in ...

View answer
1 answers
2 votes
260 views
How does the nonlinear function of KeeLoq work?
Accepted answer
3 votes

Suppose you want to compute $F(0,0,0,1,0)$, then note that $00010_2 = 2_{10}$ so the result is bit $2$ (counted from $0$ from right to left) of 0x3A5C742E, or in C terms just (3A5C742E >> 2) &...

View answer
3 answers
2 votes
600 views
How can I get the binary form of AES's MDS matrix in MixColumns tranformation?
3 votes

This question can be used to get what you want. There we use bytes (so expand those to bits) and you have to use extra XOR's (i.e. binary additions) to get the field multiplications.

View answer
2 answers
8 votes
3k views
What exactly does s2k do in gpg
3 votes

s2k = "string to key", so a password is transformed into a key for a symmetric cipher. It's documented in RFC4880. The "count" is the number of bytes hashed in each hashing step, which is only ...

View answer
1 answers
2 votes
823 views
Implementing AES-CBC (Matasano Crypto Challenge 10)
3 votes

I suppose you have removed the base64 decoding, so you are working on the raw data. Then indeed the first block is decrypted as if we were in ECB-mode, because after decrypting the first block, we ...

View answer
1 answers
2 votes
803 views
Deriving 256-bit key from PBKDF2-SHA1
Accepted answer
3 votes

I think it's OK in this instance: an attacker cannot check the first half of the hash (160 bits) because he cannot use AES-256 yet; the key is incomplete. So he needs to run the second half too. He ...

View answer
1
2 3 4 5