I hear it commonly said that the advantages of Symmetric encryption are speed and no limit to the amount of data that can be symmetrically encrypted.  I also hear it commonly said that the advantages of Asymmetric encryption are security.  But theoretically, if I want to symmetrically encrypt a 1TB file, my algorithm is just going to break the 1TB file into smaller chunks, encrypt them, and spit out the cipher text.  Why couldn't I do the same with Asymmetric encryption?  AKA,  what are the practical limitations of using Asymmetric encryption for bulk encryption?
38584
I've been told that asymmetric cryptography requires that the message to be encrypted be smaller than its key length. Why is this?  I know about hybrid encryption, which . But I still want to know why public-key cryptography needs the data to be shorter than the key length.
113851
I've tried and used Disk Utility to create an encrypted image, so I can store data in it securely. However, when I tried to write files to this image, the write operation was too slow (to write ~50 GB of data, it would take 1 day as estimated).  My question: is there a robust alternative that allows creating an encrypted space in the hard disk to store data with fast read/write operations?  Edit: Adding details:  Device :   Apple MacBook Pro (15-inch, Mid 2012)   Processor : 2.6 GHz Intel Core i7 Memory : 8 GB 1600 MHz DDR3 Hard drive : APPLE HDD HTS547575A9E384   Rotational Rate:  5400 Partition Map Type:   GPT (GUID Partition Table)  OS version : 10.12.1   I am transferring data to an encrypted image on the hard drive. Its encryption type is 128-bit AES.  Source of data  The external hard drive that I am transferring data from : StoreJet Transcend Media.   Partition Map Type : GPT (GUID Partition Table)  Encrypted. Encryption Type : AES-XTS
67971
I'm in the need of an inverse public-key encryption method where you encrypt with the private key and decrypt with the public key. In other words an asymetric encryption where you can't generate the encryption key from the decryption key. Does such encryption exist? If yes which, and which would be the fastest?  If nothing like that exists I would be glad if you helped me out with my situation:    I need to authenticate users logging in from my Java application in the way that the response from the server cannot be falsified and thus giving the user full access to the application. Using public key encryption was an obvious method, I would decrypt data received from the client to confirm the credentials. This won't work because if someone manages to decompile and get the private key from the code, they would be able to generate the public key, which would make them able to crack my application again. So any ideas how I can get this secure?
2620
I have two encryption schemes $\Pi_0, \Pi_1$, at least one of them is IND-CPA secure but I don't know which one. The task is to construct a scheme $\Pi$ that is guaranteed to be CPA secure and to provide a proof for this.  Despite reading ,  I still don't understand the best way to construct the scheme and how to fully prove its security.  Any ideas or hints into the right direction are appreciated!
41298
I read the book "Introduction modern cryptography". It gives the notion of computational security of private-key encryption at first which comes from perfect security and statistical security.     Let $(E,D)$ be an encryption scheme that uses $n$-bits keys to encrypt $l(n)$-length messages. $(E,D)$ is computationally secure if    $$E_{U_{n}}(x_{0}) \approx E_{U_{n}}(x_1)$$   And then it introduces the secure game (e.g. CPA, CCA)? I think it is a part of provable security.  "Unconditional security" (or "information-theoretic security" or "perfectly secrecy") and "computational security" are two opposite classes of security. But I do not think "computational security" and "provable security" are two independent classes of security. I know that computational security emphasizes the power of attacker is bounded (polynomial-time algorithm). And the provable emphasizes the mathematical assumptions or cryptography primitives. But it also related to the computational power.
49613
I was thinking of how to create an IV for a block cipher that doesn't require stored state, and I came up with the idea of using an HMAC of the (padded) plaintext and a (possibly distinct) key as the IV.  This seems to be secure:   The IV will only be reused if there is an HMAC collision or if the plaintext and key are the same.  The former would imply that the HMAC is broken and the latter is harmless, since it is just producing the output twice. The HMAC is verified after decryption, but before padding is checked, so padding-oracle attacks should not be an issue.   In particular, if the HMAC and the block cipher use different keys, there seems to be a very simple proof of security, assuming that either (1) the HMAC cannot be distinguished from a random function or (2) the block cipher is secure against maliciously-chosen (but unique) IVs:   The attacker cannot forge the HMAC, since this would require knowledge of the signing key. Since the signing and encryption keys are different in this case, and the HMAC is assumed random, malicious IVs cannot be triggered by an attacker.   Alternatively, if the cipher is secure against malicious (but unique) IVs, then the security of the cipher+security of the HMAC seem to prove the security of the system.  This (obviously) provides no protection against replay attacks, but that requires state anyway.  However, I am not a cryptographer so I do not trust my conclusions on this matter.  If this technique is secure, it would appear to be quite useful in practice, as it is simple and provides both encryption and authentication.
2162
Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme?    Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both operations.  Upon intercepting one of these messages and attacker could brute force this secret key by trying to solve the HMAC or by successfully decrypting the first block of the ciphertext.  Performing  a decryption on a single block of AES-256 should be a lighter operation than performing a SHA1-HMAC on a potentially large message.  Therefore AES-256 is ideal for a massively parallel brute-force attack and the use of the SHA1-HMAC doesn't hurt the system.  Is this approach sound, or is there an attack that has not been taken into consideration?
105123
I have often read that using RSA for encrypting bigger size plaintext is not good solution.  What I understand is that using RSA encrytion is best for small plaintext and most effective if it is smaller than 'bit size' of RSA. For instance, if I use RSA with a 2048 bit size then the plaintext that I can encrypt must be smaller than 256 bytes.  Is this true? What happens if the plaintext is bigger than 256 bytes? Why is there a problem with larger plaintext when performing RSA encryption?
81615
In  to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of the recommended ways described in , Appendix C, of generating an unpredictable IV for CBC mode encryption.  I further noted that this is, in fact, mathematically equivalent to using an all-zero IV and simply prepending the nonce (padded to a full cipher block) to the plaintext before applying CBC mode encryption.  However, in the comments to , it was noted that this construction is trivially CPA-insecure (as noted e.g. in section 4 of  by Rogaway) if the nonce may be chosen by the attacker.  (Of course, it could be argued that, if your nonces may be controlled by an attacker, you really should be using a fully nonce-misuse resistant mode like  instead of CBC anyway.)  That said, let's take this opportunity to hopefully settle this issue once and for all:   Assuming that the nonce values are unique and generated according to some fixed public counter sequence that is not under the attacker's control, is the encryption scheme described above (i.e. pad the nonce to a full cipher block, prepend it to the plaintext, and encrypt the result using CBC mode with an all-zero IV) actually IND-CPA secure? If so, is there a published proof of this?  If not, is there a known attack under the IND-CPA model that doesn't assume the attacker can choose the nonces? How does the quantitative security (e.g. attacker's advantage as a function of the number of encryption oracle queries) compare to standard CBC mode with random IVs?  AFAICT, both are basically only secure up to the birthday bound, but a more detailed analysis could be useful. As a bonus, what if the nonce is padded to some fixed length that is less than a full cipher block?  Is the resulting scheme still IND-CPA secure (assuming that the nonce doesn't overflow, of course) and if so, how does this affect the number of messages that can be safely encrypted?
7698
Is it possible to encrypt a message in such a way that multiple keys can independently decrypt it?  In other words:  Having knowledge of $key_1, key_2 ...key_N$, which are different symmetrical keys, is it possible to generate a ciphertext that can be independently decrypted using either $key_1$ or $key_2$ or $key_N$, in such a way that the length of the ciphertext is less than directly proportional to $N$?
107323
So I recently discovered the --s2k mode in gpg.  Sadly it is not very well-documented. I mean, what is s2k even supposed to mean?  Could someone explain to me the purpose and detailed function of s2k?    Is --s2k-cipher-algo even necessary in a symmetric encryption scenario where you define the cipher separately?  What exactly  does --s2k-count do?  What does the number after --s2k-count do? What does it indicate and why is 65 million the highest number? 65 million of what? What is done so many times?
9165
As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However  states that     A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.   To be more precise, it's the 2nd principle that states     It must not be required to be secret, and it must be able to fall into the hands of the enemy without inconvenience;   Of course I understand why I should keep the key secret, but publishing my protocol's internals seems counter-intuitive. Why should I do it? Wouldn't that give the advantage to the attacker?
89837
There is a lot of confusion between hash- and encryption algorithms; I would like to understand:   When do we use a hash algorithm and when do we use an encryption algorithm (a cipher)? How difficult it is to reverse hash- and encryption algorithms? From the theoretical/mathematical perspective, what differentiates a hash- and encryption algorithm?
71304
I have at least three, distinct motivations for having a simple way to use asymmetric key encryption by hand or without modern computers.  First, I was recently demonstrating to a 12-year-old how encryption works. I created some basic cyphers and had him figure them out. (I recommend this; it's quite fun.) Wanting to up the ante, I looked for ways to send messages back and forth using public-private key encryption, and I failed with flying colors.  Second reason for wanting this is that it would really help me understand how asymmetric encryption works. At the moment, I can't figure out a way to do solve this on my own, and I feel that betrays my lack of understanding in the subject.  Finally, (this one may be a stretch) I'm writing a fantasy story, and I'd like to do something unique with the form of exchange. One thought was to have a memorized key that the owner held, which she would use to sign her (paper) payment of 30 units for a loaf of bread, or whatever, combining her key with the shopkeeper's public key. (UPDATE: Note that this gets into digital signatures, rather than asymmetric key encryption. I'm hoping they are related, but if they're not, forget it.)  Any ideas how to accomplish this? If it's simply not feasible, I would appreciate an explanation as to why.  There are two similar questions on this site, but neither of them address asymmetric key encryption, unless I'm more misinformed than I thought:
25900
I, myself, do not plan on getting into a situation where I would be unable to use a computer in order to communicate securely.  However, I can think of many practical situations in which mental cryptography would be useful.  Is there a secure cryptosystem that is simple enough to be performed mentally?  Clearly, one of the challenges is remembering >100 bits of entropy to leverage, but I am assuming that this can be done beforehand.  How susceptible would any such system be to side channel attacks (like trash rummaging)?
71360
This is a question I had from an exercise session.  First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES in CBC decryption mode with a secret $IV_2$ and key $K_2$.  Is this construction safe against meet-in-the-middle attack?  Wouldn't the first two operations negate themselves because $C_1$ would decrypt into $P_1$?
100840
Is it better to encrypt a plain text file before compression, or vice versa?