Tag Info

Hot answers tagged

50

Several symmetric block ciphers (specifically ones like AES, DES, Blowfish, RC5) will take the same amount of time (within measurement error) for encryption and decryption, when operating on a single block (e.g., 128-bits for AES). However, there are a couple reasons why it appears different when encrypting/decrypting multiple blocks. For example, with ...


35

Salts and IV are not the same thing; salts are for password hashing, IV are for starting up some encryption modes. Neither is meant to be secret, though; otherwise we would call them "keys". It is safe to put the IV and/or salt in file headers. Your adding of "a few random data (256 bits, just to muddy the waters)" is the computer equivalent of sacrificing ...


21

Short answer: bad idea, don't do it. Longer answer: the point of the exercise is to store something which allows the server to verify a given password, but does not allow it to rebuild the password; the latter property is desirable, so that consequences of an illegitimate read access to the server database by an attacker remain limited. So we want a ...


21

Making your own crypto is fine as long as you understand that it is for learning, not for using. There are several "layers" in cryptography. There are algorithms, like RSA, AES, SHA-256... Then there are protocols, which assemble algorithms together. And then, there are implementations, which turn protocols into executable code. For a first grasp of ...


19

Go for AES. AES is the successor of DES as standard symmetric encryption algorithm for US federal organizations. AES uses keys of 128, 192 or 256 bits, although, 128 bit keys provide sufficient strength today. It uses 128 bit blocks, and is efficient in both software and hardware implementations. It was selected through an open competition involving ...


18

Neither 3DES or AES is breakable with current technology (and foreseeable technology as well). However, you may encounter some security issues with 3DES if you encrypt more than about 32 gigabytes of data with a single key, whereas the limit is much higher with AES (this is due to the block size; 3DES uses 64-bit blocks, which can lead to trouble after ...


16

What you do is the following: Generate a long key (this is just a randomly generated amount of bytes in hex, you can use 128 bytes) You use this key to encrypt your file with AES (meaning you use it as a password) You encrypt the key itself with AES using your password (which is a bit shorter but easier to remember. Now AES requires this again to be either ...


15

Related-key attacks are interesting mathematical properties of algorithms, but have no practical impact on security of encryption systems, as long as they are used for what they were designed, i.e. encryption (and not, for instance, as building blocks for hash functions). Bigger is not necessarily better. There is no practical need for using a 256-bit key ...


15

In OpenSSL source code, the speed aes-256-cbc function calls AES_cbc_encrypt() which itself uses AES_encrypt(), a function from crypto/aes/aes_x86core.c. It is an obvious "classical" implementation with tables. On the other hand, with EVP, you end up in the code in crypto/evp/e_aes.c which dynamically detects whether the current CPU supports the AES-NI ...


15

A blockcipher like AES is a keyed permutation. In the case of AES it takes a key and then turns a 16 byte block into another 16 byte block deterministically. To encrypt something with a block-cipher you need to use a mode of operation. Typically those modes take an IV (similar to a salt) which should be different for each message you encrypt. This ...


14

Most websites used md5 or sha1 (right?), so this is what a hacker would be expecting. Thus making the AES method more secure. Even if most websites use MD5 or SHA1, switching to AES just for the reason that it's usually not used there wouldn't make it any more secure - that's just security by obscurity, which usually doesn't effectively contribute to ...


14

AES is a block cipher, it works on 16-byte (128-bit) blocks. AES, in and on itself, can't work with data smaller or bigger than 16 bytes. Smaller data needs to be padded until they're 16 bytes, and larger data needs to be split into 16-byte blocks (and, of course, padded when needed*) Luckily, there are algorithms that help you achieve just that (work on ...


12

Neither, unless it's both. You're asking the wrong question. You should not be thinking about a cryptographic algorithm at this stage, but about a cryptographic protocol. Cryptographic protocols are hard to design, and a frequent source of security bugs. You don't fully understand public-key cryptography, so you aren't ready to use it in your own ...


12

From Wikipedia: An initialization vector has different security requirements than a key, so the IV usually does not need to be secret. However, in most cases, it is important that an initialization vector is never reused under the same key. For CBC and CFB, reusing an IV leaks some information about the first block of plaintext, and about any common ...


12

As the author of the Ruby AEAD library, I can assure you that OpenSSL does support GCM on 1.0.1c. ~ $ /usr/local/bin/openssl version OpenSSL 1.0.1c 10 May 2012 ~ $ /usr/local/bin/openssl enc -help 2>&1 | grep gcm -aes-128-gcm -aes-192-gcm -aes-256-gcm If it is unavailable on your platform (OpenSSL added GCM support in 1.0.1, I believe), I have ...


12

Which is faster, a Fiat 500 or a V12 Ferrari engine ? The Fiat 500 sure is a rather minimal car... but at least it has wheels. The Ferrari engine, however magnificent it may be, is still "just an engine"; put it down on a road and it will be no more mobile than a boulder. Therefore, the question does not really make sense. And so is yours. AES is a block ...


11

The point of the salt is to prevent precomputation attacks, such as rainbow tables. Without a salt, anyone could just generate a huge dictionary of hashes and their associated plaintexts, and immediately crack any known hash. With the salt, such a dictionary is useless, since it's infeasible to generate such a dictionary for all possible salts. I did a ...


11

I will try to answer your question as specifically as possible. I contacted Intel tech support to ask them exactly this question: Is the AES key on the Intel 520 encrypted with the ATA password. After weeks of back and forth, I finally received an explicit confirmation from them. I quote: Yes, ATA password is used to encrypt the encryption keys stores ...


11

GCM is recommended; it is even approved by NIST. However, AEAD ciphers are supported in TLS only since TLS 1.2; see section 6.2.3.3, which is new, when compared to TLS 1.1. The actual GCM-able cipher suites are defined in RFC 5288. Note that TLS 1.2 (and, for that matter, TLS 1.1 too) is immune to BEAST-like attacks when using CBC. Therefore you will have a ...


10

Password hashing algorithms such as PBKDF2, bcrypt, and scrypt are meant for use with passwords and are purposefully slow. Cryptographic hashing algorithms are fast. Fast is good in most situations, but not here. Slowing down the algorithm (usually by iteration) make the attacker's job much harder. Password hashes also add a salt value to each hash to ...


10

The difference is that: PBKDF2 by design is slow SHA256 is a good hash function; it is not slow, by design So if someone were to try a lot of different possible passphrases, say the whole dictionary, then each word with a digit appended, then each word with a different capitalisation, then two dictionary words, etc. then this process would be much slower ...


10

Even if you use CTS, you still need an initialization vector (IV) which MUST (I insist, MUST) be generated anew for each file with a cryptographically strong pseudo-random number generator. So you will not be able to fit all of it without increasing the size. This is unavoidable, as long as you use a "normal" block cipher. Also, if you need encryption, then ...


9

Comparing the two directly is a little like comparing a tractor to a train - they're both vehicles but have completely different function and construction. RSA is an asymmetric cipher. It is ideal for secure exchange of messages across an untrusted network, because the public key can be known by everyone - a message encrypted with the public key can only be ...


9

By adding more algorithms, you do two things: Potentially increase the strength of the encryption. Increase the attack surface of your application. AES128-CBC is strong. If you're implementing it properly, and using strong random keys and unique random IVs, you're very safe. The US government (NSA) certifies AES for use in securing top-secret documents. ...


8

To calculate this you need: The block-size (16 bytes) Cost per byte (1.30 cycles per byte) Frequency of the CPU (3.8 GHz) Number of cores (2) Number of keys (2^128) I'm using "amd64; Piledriver (610f01); 2012 AMD A10-5800K; 2 x 3800MHz; hydra9, supercop-20121016" from eBACS as my example CPU. To calculate the keys tested per second you calculate: ...


8

No, 4096 bit encryption is not good enough to encrypt your data. Becase of a few reasons. AES does not support 4096 bit encryption. Even if AES supported 4096 bit encryption, it would be far to slow (most likely). When 128 bit AES is plenty secure why would you want to slow your system down for such little added value? If you actually meant RSA instead of ...


8

Yes. Most symmetric-key encryption algorithms support a streaming mode, where you encrypt the message incrementally as it arrives. This includes CTR mode, CBC mode, and most other modes. Similarly, most message authentication codes (MACs) support a streaming mode of operation when generating the MAC. On the other hand, when verifying a MAC, while you can ...


8

It depends whether you want to defend against typing mistakes, or attacks. If you just want to defend against typing mistakes, just include some structure in your configuration file. E.g., define that your configuration file MUST begin, when decrypted, with the string "This is configuration file for application FooBar". If you do not find that string upon ...


8

Yes, a transformation occurred: endianness... Look at the bytes 8 to 15: 7ead 14f8 3192 3f2b. That's your salt. It is a known quirk of od: it decodes data by 16-bit units, little-endian, then shows them "numerically", so this incurs an apparent byte swap. Use od -t x1 to get a nicer output. Edit: to answer your other question, what OpenSSL does is neither ...


8

There are a few reasons why this is necessary. First, as you stated, it makes cryptanalysis of the data difficult due to being unable to identify the boundary between ciphertext and background noise. This could be defeated by capturing two snapshots of the volume and identifying the locations that change, so it's hardly a concrete security measure in this ...



Only top voted, non community-wiki answers of a minimum length are eligible