Tag Info

Hot answers tagged

52

Several symmetric block ciphers (specifically ones like AES, DES, Blowfish, RC5) will take the same amount of time (within measurement error) for encryption and decryption, when operating on a single block (e.g., 128-bits for AES). However, there are a couple reasons why it appears different when encrypting/decrypting multiple blocks. For example, with ...


35

Salts and IV are not the same thing; salts are for password hashing, IV are for starting up some encryption modes. Neither is meant to be secret, though; otherwise we would call them "keys". It is safe to put the IV and/or salt in file headers. Your adding of "a few random data (256 bits, just to muddy the waters)" is the computer equivalent of sacrificing ...


22

Short answer: bad idea, don't do it. Longer answer: the point of the exercise is to store something which allows the server to verify a given password, but does not allow it to rebuild the password; the latter property is desirable, so that consequences of an illegitimate read access to the server database by an attacker remain limited. So we want a ...


21

Making your own crypto is fine as long as you understand that it is for learning, not for using. There are several "layers" in cryptography. There are algorithms, like RSA, AES, SHA-256... Then there are protocols, which assemble algorithms together. And then, there are implementations, which turn protocols into executable code. For a first grasp of ...


21

You are doing it wrong. Not in the splitting or whatever; but in the thinking. AES encryption, if done properly, won't be "cracked". AES is the most robust piece in your system; this is the last part of it that you should be worrying about. What AES encryption provides is a very specific functionality: using a given key K, it transforms a piece of data (the ...


20

Go for AES. AES is the successor of DES as standard symmetric encryption algorithm for US federal organizations. AES uses keys of 128, 192 or 256 bits, although, 128 bit keys provide sufficient strength today. It uses 128 bit blocks, and is efficient in both software and hardware implementations. It was selected through an open competition involving ...


19

No. This is known as a known-plaintext attack (or a chosen-plaintext attack if you are not only aware of but can select the plaintexts), and is a type of attack that AES is highly resistant to: there are no known attacks of either type that are faster than brute force. If you've got access to the encryption coprocessor (and a good electronics lab), you may ...


18

Neither 3DES or AES is breakable with current technology (and foreseeable technology as well). However, you may encounter some security issues with 3DES if you encrypt more than about 32 gigabytes of data with a single key, whereas the limit is much higher with AES (this is due to the block size; 3DES uses 64-bit blocks, which can lead to trouble after ...


16

What you do is the following: Generate a long key (this is just a randomly generated amount of bytes in hex, you can use 128 bytes) You use this key to encrypt your file with AES (meaning you use it as a password) You encrypt the key itself with AES using your password (which is a bit shorter but easier to remember. Now AES requires this again to be either ...


15

From Wikipedia: An initialization vector has different security requirements than a key, so the IV usually does not need to be secret. However, in most cases, it is important that an initialization vector is never reused under the same key. For CBC and CFB, reusing an IV leaks some information about the first block of plaintext, and about any common ...


15

Related-key attacks are interesting mathematical properties of algorithms, but have no practical impact on security of encryption systems, as long as they are used for what they were designed, i.e. encryption (and not, for instance, as building blocks for hash functions). Bigger is not necessarily better. There is no practical need for using a 256-bit key ...


15

In OpenSSL source code, the speed aes-256-cbc function calls AES_cbc_encrypt() which itself uses AES_encrypt(), a function from crypto/aes/aes_x86core.c. It is an obvious "classical" implementation with tables. On the other hand, with EVP, you end up in the code in crypto/evp/e_aes.c which dynamically detects whether the current CPU supports the AES-NI ...


15

A blockcipher like AES is a keyed permutation. In the case of AES it takes a key and then turns a 16 byte block into another 16 byte block deterministically. To encrypt something with a block-cipher you need to use a mode of operation. Typically those modes take an IV (similar to a salt) which should be different for each message you encrypt. This ...


14

Most websites used md5 or sha1 (right?), so this is what a hacker would be expecting. Thus making the AES method more secure. Even if most websites use MD5 or SHA1, switching to AES just for the reason that it's usually not used there wouldn't make it any more secure - that's just security by obscurity, which usually doesn't effectively contribute to ...


14

AES is a block cipher, it works on 16-byte (128-bit) blocks. AES, in and on itself, can't work with data smaller or bigger than 16 bytes. Smaller data needs to be padded until they're 16 bytes, and larger data needs to be split into 16-byte blocks (and, of course, padded when needed*) Luckily, there are algorithms that help you achieve just that (work on ...


13

Neither, unless it's both. You're asking the wrong question. You should not be thinking about a cryptographic algorithm at this stage, but about a cryptographic protocol. Cryptographic protocols are hard to design, and a frequent source of security bugs. You don't fully understand public-key cryptography, so you aren't ready to use it in your own ...


13

The primary reason not to use AES_* functions in MySQL is because they are using ECB block mode of operation, which is insecure. Read more at: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation Edit: Since MySQL 5.6.17 things have changed and MySQL supports CBC block mode, but it has to be enabled manually. Read ...


12

The difference is that: PBKDF2 by design is slow SHA256 is a good hash function; it is not slow, by design So if someone were to try a lot of different possible passphrases, say the whole dictionary, then each word with a digit appended, then each word with a different capitalisation, then two dictionary words, etc. then this process would be much slower ...


12

As the author of the Ruby AEAD library, I can assure you that OpenSSL does support GCM on 1.0.1c. ~ $ /usr/local/bin/openssl version OpenSSL 1.0.1c 10 May 2012 ~ $ /usr/local/bin/openssl enc -help 2>&1 | grep gcm -aes-128-gcm -aes-192-gcm -aes-256-gcm If it is unavailable on your platform (OpenSSL added GCM support in 1.0.1, I believe), I have ...


12

GCM is recommended; it is even approved by NIST. However, AEAD ciphers are supported in TLS only since TLS 1.2; see section 6.2.3.3, which is new, when compared to TLS 1.1. The actual GCM-able cipher suites are defined in RFC 5288. Note that TLS 1.2 (and, for that matter, TLS 1.1 too) is immune to BEAST-like attacks when using CBC. Therefore you will have a ...


12

Which is faster, a Fiat 500 or a V12 Ferrari engine ? The Fiat 500 sure is a rather minimal car... but at least it has wheels. The Ferrari engine, however magnificent it may be, is still "just an engine"; put it down on a road and it will be no more mobile than a boulder. Therefore, the question does not really make sense. And so is yours. AES is a block ...


11

Password hashing algorithms such as PBKDF2, bcrypt, and scrypt are meant for use with passwords and are purposefully slow. Cryptographic hashing algorithms are fast. Fast is good in most situations, but not here. Slowing down the algorithm (usually by iteration) make the attacker's job much harder. Password hashes also add a salt value to each hash to ...


11

The point of the salt is to prevent precomputation attacks, such as rainbow tables. Without a salt, anyone could just generate a huge dictionary of hashes and their associated plaintexts, and immediately crack any known hash. With the salt, such a dictionary is useless, since it's infeasible to generate such a dictionary for all possible salts. I did a ...


11

I will try to answer your question as specifically as possible. I contacted Intel tech support to ask them exactly this question: Is the AES key on the Intel 520 encrypted with the ATA password. After weeks of back and forth, I finally received an explicit confirmation from them. I quote: Yes, ATA password is used to encrypt the encryption keys stores ...


10

Comparing the two directly is a little like comparing a tractor to a train - they're both vehicles but have completely different function and construction. RSA is an asymmetric cipher. It is ideal for secure exchange of messages across an untrusted network, because the public key can be known by everyone - a message encrypted with the public key can only be ...


10

By adding more algorithms, you do two things: Potentially increase the strength of the encryption. Increase the attack surface of your application. AES128-CBC is strong. If you're implementing it properly, and using strong random keys and unique random IVs, you're very safe. The US government (NSA) certifies AES for use in securing top-secret documents. ...


10

Even if you use CTS, you still need an initialization vector (IV) which MUST (I insist, MUST) be generated anew for each file with a cryptographically strong pseudo-random number generator. So you will not be able to fit all of it without increasing the size. This is unavoidable, as long as you use a "normal" block cipher. Also, if you need encryption, then ...


9

What happens here depends on the mode of operation. As a basic rule, knowledge of the messages will not allow you to recompute the key itself, but it may give you enough information to (instantly) crack any other message encrypted with the same key and IV. With CTR mode, a key-dependent stream is produced by encrypted the successive values of a counter, and ...


9

There are a few reasons why this is necessary. First, as you stated, it makes cryptanalysis of the data difficult due to being unable to identify the boundary between ciphertext and background noise. This could be defeated by capturing two snapshots of the volume and identifying the locations that change, so it's hardly a concrete security measure in this ...


9

Usage of the openssl enc command-line option is described there. Below, I will answer your question, but don't forget to have a look at the last part of my text, where I take a look at what happens under the hood. It is... instructive. OpenSSL uses a salted key derivation algorithm. The salt is a piece of random bytes which are generated when encrypting, ...



Only top voted, non community-wiki answers of a minimum length are eligible