Tag Info

Hot answers tagged

8

The definition of a cryptographic hash function includes resistance to preimages: given h(x), it should be infeasible to recover x. A hash function being "reversible" is the exact opposite of that property. Therefore, you can have no more a "reversible hash function" than you can have a fish allergic to water. Possibly you might want a hash function ...


8

The "nonce" is better known as the Initialization Vector -- with "IV" being the universal short name for that concept. CTR mode works by encrypting the successive values of a counter (CTR stands for "CounTeR"), so the IV in CTR mode is merely the value at which the counter starts. CTR basically produces a long key-dependent pseudorandom stream, and ...


4

AES is encryption; it is meant to maintain confidentiality. Encryption does not maintain integrity by itself: an attacker who can access encrypted data can modify the bytes, thereby impacting the cleartext data (though the encryption makes the task a bit harder for the attacker, it is not as infeasible as is often assumed). To get integrity, you need a MAC, ...


4

Consequences of an IV reuse range from "serious" to "dramatic", depending on the encryption mode. AES, by itself, is a block cipher: it processes blocks of 128 bits. When encrypting a message (with a length other than exactly 16 bytes), one must use a block cipher mode of operation. Many such modes are "sequential" in some way, with a running state, and the ...


4

The main "problem" that ECC tries to fix is that RSA is RSA. Namely, people want to have a backup kind of algorithms, in case RSA gets brutally broken through a stupendous (and unpredictable) advance in integer factorization techniques. Integer factorization has been heavily studied for more than 2500 years (it was already all the rage in the Neo-Babylonian ...


4

Sounds like you're well on your way to figuring this out. I've never exploited ECB chosen plaintext, but I recently did a padding oracle exploit, so I've got some idea how you would do this. The basic idea is to brute force one byte at a time. Just suppose we have a simple example where there is no other data inserted so it's just "[username][secret]". ...


4

Since you generate the user-specific keys, you can also keep a copy of these keys somewhere (somewhere safe, preferably) and use them when needed. Alternatively, you can generate the keys with a cryptographic derivation system which uses a "superkey" and the user's identity. For instance, consider the following: The superkey is K. A user is identified ...


3

"NSA Suite B" is a definition of algorithms that shall be implemented to be able to... claim "Suite B" support. It is more guidelines than anything else, aimed at improving interoperability. Having support for Suite B algorithms can be a requirement to sell products to the US Federal Government; however, in general, there is no rule which makes ...


3

I assume your question is: Can an attacker find pass15 more easily if they know both hasha and hashb than if they know only hashb? If that hash function is truly good it should have a good uniformity. That means that any input given to the function will be mapped to an output irrespective of how similar input is mapped. This means that knowing how ...


3

It seems to me a cryptographic hash, such as the SHA family, would do what you are describing. If not perhaps you could clarify your question.


3

You should start off by reading carefully the Wikipedia article on asymmetric encryption. Public and private keys work together: A third-party can encrypt data with your public key, and you will be able to use your private key to decrypt it. Nobody else will. You can use your private key to encrypt data and anyone who has your public key will be able to ...


3

Don't invent your own cryptographic protocols. It's easy to come up with all kinds of ideas and combine all kinds of techniques, but doing this properly is exceptionally hard and requires a lot of experience and extensive peer reviews. This isn't something you can do on your own in a few minutes, especially if you don't happen to be a cryptographer. What ...


2

A possibility would be to use 'sudo' (or a script / alias relying on it). Thanks to sudo, you can allow your users to temporarily use another (not necessarily root) in order to execute a very specific command: Create a new account which will own the private key, Configure sudo so your users can launch an SSH client using this account and its private key. ...


2

Crytographic software and hardware is considered munitions by the US Government as it could be used for keeping wartime secrets. As such, it falls under US Export control. This level of control has been loosened significantly in the last 15 years or so, but there is still a fair amount of laws about what is and isn't covered. Three of the main grounds for ...


2

Right now, in X.509, there is no such thing as tracking of a number of uses of a given key. This is part of what is meant by "X.509 is context-free": validation is about whether the certificate path you have in front of you is valid or not, irrespective of whether a similar path or something different was shown to you 5 minutes ago when talking to the "same" ...


2

The core of GCM is CTR: successive values of a counter are encrypted with AES (each value is represented over a 16-byte block), thus generating a key-dependent pseudorandom stream. Actually encryption (and decryption as well) is done by XORing that stream with the data to encrypt. The XOR is done bit by bit and can be stopped at any length without any need ...


2

First thing to do is define what you mean by "secure and authenticate". You need to put into words who the attackers are, what they can do, and what they should be prevented from doing. On example of such an attack model is the following: Attackers are outsiders. They eavesdrop on the common channel (the radio waves). They want to obtain the confidential ...


2

1). No, assuming a secure block-cipher mode (e.g., CBC, CTR) was used (basically any mode other than ECB) provided the initialization vectors are not reused. With ECB mode you could match up messages with patterns of repeated blocks in the plaintext to corresponding repeated blocks in the ciphertext. See ECB description on wikipedia for more. Reusing ...


2

Point compression does not lose information; that's the point. Technical details: suppose we are working in field Zp for a big prime p. The curve equation is: Y2 = X3 + aX + b for two constants a and b which define the curve. For a point (X,Y) on the curve, you can use the equation to recover Y2 from X alone. Since we are working in a field, Y2 can have ...


1

PRG do not really map something small to something big. Seed and numbers are often of the same size. Also they are not unpredictable but deterministic for a given seed. Only the sequence of numbers the PRG creates is "random". Anyway, if you need a function where you put in something big and get a smaller result where you can not simply revert the process, ...


1

This is a random guess as I'm not an expert... To answer the question in the title, "What's the point of the nonce in CTR mode?", I would say that it's to make the protocol stateless. Meaning that both side doesn't need to store any information in order to encrypt/decrypt multiple runs, except the key. To understand the above statement, let's look at block ...


1

This would be trivial to attack if the code actually did what you intended and it was decryptable. (It doesn't though). You have to try all 63 (length of your alphabet) different values of the hashes modulo the alphabet size and then you can decrypt any message. Essentially you shift each character by Hp+1 modulo 63, where H is the computed hash value. ...


1

Tom gave a good answer for your other question, so I will address the last one. Would you have any qualms with using ECC to encrypt sensitive material? Yes, I would have qualms about using RSA or even ECC to encrypt sensitive material in today's world. RSA relies on the integer factorization problem and ECC relies on the discrete logarithm problem. ...


1

Generally speaking, you are right: given the keys 0, 1 and 2, it is possible to produce the encrypted form of any other file for the same password, even if the said password is not known. If you follow this road, you will probably be interested in Info-ZIP, a clean opensource reimplementation of the PKZIP format. Alternatively, you may want to recover the ...


1

Cryptography basics Coursera.org offers a great course on cryptography. You can check it here: https://www.coursera.org/course/cryptography Not only you will be able to learn a lot, Coursera will also help you to test your learning by giving you some tests. Web Security/Network Security Basics Coming down some books, there is one good book called Gray Hat ...


1

Don't put too much faith in such anonymizing. Indeed, MAC addresses fit on 48 bits, out of which two are used for administrative reasons, leaving only 46 bits (at most) unknown to someone eager to recover the MAC addresses (indeed, the attacker can assume that the MAC address from a physical user machine will be "unicast" and "globally unique", so the two ...


1

OpenVPN relies on SSL/TLS for establishing the session secret values, with certificates on both client and server (this is documented here). To do a successful Man-in-the-Middle attack, the attacker must impersonate both the client and the server: the attacker must pose as a fake client, when talking to the server, and as a fake server, when talking to the ...


1

What you have explained sounds similar to WEP encryption for 802.11. I am not a cryptologist either, but have read through the Aircrack-ng docs quite a few times. Using this encryption technique for a static data set opens the application to statistical based attacks such as Korek and FMS. A deep explanation of how these attacks are done on WEP can be found ...


1

Even a non-cryptographic hash can usually not be reversed (that is irrespective of other special properties of cryptographic hashes, such as collision/preimage resistance). The reason why it usually isn't possible is that you simply do not have enough information. A hash function (generally) turns N bits of input into M bits of output, where M is a small ...


1

In answer to question 2, you could use RSA instead for the signature algorithm. While people are moving to ECDSA due to it being faster, there's nothing inherently wrong with RSA still.



Only top voted, non community-wiki answers of a minimum length are eligible