151
As usual, journalism talking about technical subjects tends to be fuzzy about details...
Assuming that a true Quantum Computer can be built, then:
RSA, and other algorithms which rely on the hardness of integer factorization (e.g. Rabin), are toast. Shor's algorithm factors big integers very efficiently.
DSA, Diffie-Hellman ElGamal, and other algorithms ...
51
An unknown "encryption" algorithm has been historically achieved at least once. I am speaking of Minoan Linear B script, a writing method which was used in Crete around 1300 BC. The method was lost a few centuries later, with the death of all practitioners and the overall collapse of civilization during the so-called Greek Dark Ages. When archaeologists ...
51
The Zodiac killer ciphers are an interesting case. As there were four ciphers sent to the local papers, I will address each in turn. They do share some common traits however.
They are each their own cipher, so the 'solution' used for cipher 408 cannot be applied to the other messages.
Each message has a unique character count.
The Zodiac Killer sent these ...
51
The private key is unrelated to the passphrase. So is the public key. The public key is also generally stored unencrypted, even when the private key is protected by a passphrase. (Exceptions may exist where the public key is stored in an encrypted form, but in the basic case and assuming a sufficiently large key, doing so provides no additional security ...
32
To attack a cryptographic protocol, you have the following attack methods
Known plaintext: Trying to find correlations between the plaintext you have and the corresponding ciphertext.
Chosen plaintext: Encrypting specific plaintext and studying the changes to the ciphertext as the plaintext changes.
Choosen ciphertext: Decrypting specific ciphertext and ...
27
You're assuming that they're actually encrypted. A lot of crazy people have written things that nobody understands. Just because the author thinks they're in code doesn't necessarily mean that the code can be reversed.
24
The passphrase guards against accessing the private key
The passphrase is meant to guard the private key in the event of physical access. If the hacker can sign on to your server and can access your certificate store, he could use the passphrase to obtain a copy of the certificate that would include the private key. Hopefully hackers don't routinely have ...
17
There's no exact answer, and here's why:
Brute Force
We start with a 128-bit symmetric key. Assuming the algorithm (e.g. AES) isn't yet broken, we have to look at power consumption. Assuming 100% efficient computation devices whose technology far exceeds any computer, ASIC, graphics card, or other key-cracking device you can dream up, there's a minimum ...
16
There are two generic ways to produce a "sufficiently unbiased" random digit.
First method is to loop if the byte was not in the right range. I.e.:
Get next random byte b.
If b is in the 0..249 range, return b mod 10.
Loop.
This method may consume an unbounded number of random bytes, but it is perfectly unbiased and it is very unlikely to require looping ...
15
I think nobody has said it aloud here, so I will.
If a cryptographer is given only one ciphertext with no means to get more, the ciphertext is short and no knowledge of the plaintext is given, it is near impossible to decrypt the text. The only way this is still possible is if the cipher is around the difficulty level of a substitution cipher.
Given the ...
15
A cryptanalyst would probably just do this by hand;
This is a text file.
All printable characters.
Frequency analysis shows 2 * '<' and 2 * '>' which is true of all plaintexts, whereas all other character frequencies change, which probably means something interesting is going on.
I would say less than an hour to figure out your password scheme. ...
13
If you're going to distribute a secret algorithm, why not just distribute one-time pads instead? It's more secure.
If you don't like the idea of one-time pads because too much data is moving over the wire, then why are you assuming that the attacker only has one cyphertext?
Assuming somebody only has one cyphertext, and doesn't have the algorithm, (two ...
13
This could be encrypted with any key length that is equal or longer than 28 characters (sum of lengths of ciphertext you provided) and as such unsolvable. The character variation between the plaintext CANDY VERY CRANBERRYhttphttp and its ciphertext TXOtWjYhVk 8&O$4AmSAcZf.r5Hz is:
17,23,1,48,-2,74,3,35,4,18,0,-11,-44,14,-42,-14,-4,27,1,-24,-5,-26,-14,-...
12
between > and < so I can find it myself
Well, that's it. Whatever your "hiding method", you have to remember a way to find it back. So you password is not the sequence of characters which you ultimately type on the keyboard; your real password, the "secret convention" that you keep in your brain, is the method: find the two strings enclosed in '>' and '&...
12
Nope
Generally speaking: No. Hashing is not encryption. Hashing is not reversible. At all. It always generates a fixed length output. So with an output fixed to say 32 characters, and an input of 33 characters, there is no possible way to reverse this. The information of that one character is irretrievably lost. -- And along with it all other characters.
...
10
In theory, having several hashes may help; in practice, not so much.
The Theory
Let's consider SHA-256. From this function, we can define another hash function, which we will call SHB-256, such that SHB-256(m) = SHA-256(m) XOR m. In simple words, I compute the XOR of the SHA-256 and the first 256 bits of m.
This "SHB-256" is as good a cryptographic hash ...
10
If an encryption system allows for character-per-character cracking, then it is awfully weak, and should not be used.
Mathematically, block ciphers are defined as pseudorandom permutations. A block cipher works over the space of blocks of length n bits; such a space has size 2n. There are 2n! permutations over that space (that's a factorial, meaning that ...
10
No, this won't provide any improvement for encryption with any decent cipher. If a cipher is so bad that a known-plaintext attack is capable of fatally breaking it, then the cipher is worthless. A known-plaintext attack is one where an attacker has knowledge of plaintext/ciphertext pairs and, from that knowledge, is able to either calculate the key or ...
9
RainbowCrack is probably what you would be using to generate rainbow tables. Rainbow tables are always generated over a keyspace, such as alpha-numeric 5-9 bytes long and the chain length and count which will affect the rate and the size of the resulting tables. If you have an input file, then it's not a rainbow table, it's some other lookup table. A ...
9
To get the number of permutations, multiply the number of possibilities at each position:
26x10x26x10x26x10x26 = 456,976,000
8
Quantum computing will make most dramatic impact on asymmetric encryption, but symmetric algorithms are considered safe with a large enough key size (256 bits). So, yeah, we'll have to reinvent x509/SSL by the time quantum computing really takes off (which is a large enough TODO), but there will be large areas of cryptography that will remain relatively safe....
8
For cryptanalysis, the usual three-point method applies:
Write down the problem.
Think real hard.
Write down the answer.
And that's about all that can be said generically.
The methodology of a cryptanalyst is about the same as that of researchers in any other science. The core of the daily work of a cryptographer is to read, read, read all the papers. ...
8
Compression before encryption is a problem if the attacker can control parts of the transferred data and then use the detectable compression ratio (i.e. amount of transferred data vs. original data) to make conclusions about some of the traffic. This was in TLS used within BREACH and CRIME attacks to infer cookies and CSRF tokens. Making such attacks work ...
7
Is there any way to determine that based on the above data alone aside from just trying a bunch of common hashing/encoding sequences on the original strings and hoping to stumble across a matching output?
No, there is no other way. Sometimes we get hints from knowing the length of things (MD5 hashes are shorter than SHA-256, etc.), but that still doesn't ...
7
No, this is not a security vulnerability.
HMAC requires a key of the underlying hash algorithm's block size. In general, you should provide a key which is of the underlying hash algorithm's block size.
If you forget to provide a key of this size, then there are two options. The first option is that HMAC fails hard and fast, informing you that your key is ...
7
Yes, it is called writing research papers and getting them peer reviewed.
There is no reason you should ever write your own encryption algorithm unless you are in the field of academic research, and then you will still not "use" your algorithm for at least 4 years (that's how long it took to choose SHA-3 between the time when the algorithm was submitted to ...
7
Historically, there's no computer, let alone Python code. Encryption systems have been designed and attacked and improved since many centuries before the invention of electricity. Also, only the most basic, weakest, puniest forms of encryption can be described as "unordered data".
The really must-read introduction on cryptography and decryption is this ...
Only top voted, non community-wiki answers of a minimum length are eligible
