I know there are way better and more tested encryption methods, but I was wondering if the following code could be use for symmetric encryption?  var text = "hello"; var password = "mypass"; var message = hash(text) + encrypt(text, password);  function encrypt(text, password){     var key = hash(hash(text) XOR hash(password));     var passphrase = key;     while(passphrase.length &lt; text.length){         key = hash(key);         passphrase += key;     }     passphrase = passphrase.substring(0, text.length);     return text XOR passphrase; }   It can easily be decrypted if you know the password.  Is there any flaw to this simple algorithm?  N.B.: A similar question was asked  but the algorithm doesn't work...
10733
A few years ago I devised a symmetric-key system that worked like so:  H()   = some hashing function h     = the number of bits in the result of H() key   = bits to be used as a key ^     = the XOR operation +     = concatenation len() = the length function (in bits)  max = ceiling(len(cipertext) / h) pad = pad_0 + ... + pad_max pad_0 = H(key) ^ H(plaintext) pad_n = H(pad_(n-1)) cipherpart_n = plaintext_n ^ pad_n ciphertext = H(plaintext) + cipherpart_0  + ... cipherpart_max   Basically, it builds up a "pad" based on the hash of the message and hash of the key and XORs the message against it.  I am not actually an expert, so I was wondering why an approach like this isn't very common.
73738
Let's say I would like to communicate with my friend using asymmetric/public-key encryption, e.g. RSA.  (Note: I do realize that in practice this is done through an intermediate symmetric key, but this question assumes we only use asymmetric encryption.)  Say I try to do this: I slice up my data into 2n-byte blocks (padding with zeros [edit: padding appropriately] if necessary), append the block index to the block (to prevent the same plaintext from turning into the same ciphertext), then use my friend's public key to encrypt each block separately.  Is this a secure scheme, or does the fact that I'm re-using the key make it susceptible to some kind of attack? If so, is it used in practice in any existing algorithms? If not, is there any way to make it safe, aside from using a symmetric key?
31547
I was given a cryptography question during an interview the other day.   Imagine you are given an efficient algorithm which for a given RSA public key (n,e) is able to decrypt 1% of the messages encrypted with that key.   1% means that the algorithm will deterministically decrypt 1% of all possible ciphertexts on the first call, and will never decrypt the other 99% of all possible ciphertexts with any number of invocations.   Figure out an algorithm that uses this one and can decrypt any message. Any ideas?
4452
I am very new to cryptography (so be kind), but I have a question that may seem silly.   If the one-time pad is the perfect cipher and impossible to crack, why would the following algorithm not be one of the strongest:  To encrypt:   generate a random bit array using a pseudo number generator with the key as the seed  The generated bit array is the size of the data use a simple XOR to encrypt using the generated bit array   To decrypt:   pseudo-random number generator will generate the same bit array with the same seed (the key) generate bit array the same size of the encrypted data run XOR on encrypted data using bit array that's generated   This is very simplified, but you can imagine how for larger encryption you could break down the data into blocks, and in order to ensure that the block bit arrays are random a new seed for each can be derived from the key. So, if $f(k)$ is the pseudo random number generator, and b is the block number, you can encrypt each block with $f(k+b)$. ($k$ is key)   Instead of using a pseudo-random number generator, you could use some hash algorithm to generate the pad.    (assuming you can use equivalently strong keys) would this not be a very strong cipher method? Perhaps it may be strong and heavy on memory since the pad needs to be the size of the data. So during encryption and decryption you need to generate a pad that's equivalent to the size of the data.   Is there a flaw in this algorithm, or would something like this not be practical and much slower than current standards?
24255
I read the summary of deniable encryption on wikipedia:   Then I read a question, by doom123 on security.SE:   But I had a subtly different problem which can be stated as follows:   Alice wants to send Bob the book "Mocking Jay" which is banned in Bob's country.  Alice encrypts "Mocking Jay" to data MJ with the password P1. Using another book of similar size (or by trimming a larger book), say the "The Hobbit", she processes the data MJ and computes password P2.   The solution to this problem will allow Bob to claim that he maintains a copy of "The Hobbit" (assuming that "The Hobbit" is not banned of course), while being able to read  "Mocking Jay". The solution, in theory, should also allow Bob to plausibly deny that there's any other copy hidden in the data "MJ" other than "The Hobbit"; or like the aforementioned security.SE question, should allow "MJ" to hold any number of copies (and thus any number of passwords), providing Bob the excuse of acknowledging only one copy that he has the knowledge of.  The  provided by the user lynks to the question posed by doom123 solves the problem for storing data on a hard-disk. Is there a general solution to this problem?  UPDATE 1 With regards to the answer provided by fgrieu I am slightly modifying the question. Is it possible to add a third layer (and an arbitrary number of further layers) of such encryption? What I mean is, with Mocking Jay, The Hobbit, and Silmarillion (assuming that the books are roughly the same in size) as inputs, is it possible to create an encrypted output say MJTHSI? I am alright with the passwords being the output as well. Decrypting with password P1 will reveal Mocking Jay. If rubber-hose is used password P2 can also be given up revealing The Hobbit (with the intention of ultimately protecting Silmarillion which can be revealed using P3).
77253
I would like to encrypt a string asymmetrically.  I would like the ciphertext to be as short as as plaintext. (or shorter)  I've read about format preserving encryption functions - are there asymmetric variants of them?
76533
The current top-voted to  states:     Another one that's not so much a security issue, although it is security-related, is complete and abject failure to grok the difference between hashing a password and encrypting it. Most commonly found in code where the programmer is trying to provide unsafe "Remind me of my password" functionality.   What exactly is this difference? I was always under the impression that hashing was a form of encryption. What is the unsafe functionality the poster is referring to?
45067
I'm trying to understand the working of RSA algorithm. I am getting confused in the decryption part. I'm assuming   $$n = pq$$ $$m = \phi(n) = (p - 1)(q - 1)$$  E is the encryption key $\gcd(\phi(n), E) = 1$  D is the decryption key, and  $DE = 1 \mod \phi(n)$  $x$ is the plain text  Encryption works as ($y = x^E \mod n$) and decryption works as ($x = y^D \mod n$)  The explanation for why the decryption works is that since $DE = 1 + k\phi(n)$,  $$y^D = x^{ED} = x^{1 + k \phi(n)} = x(x^{\phi(n)})^k = x \mod n$$  The reason why last expression works is $x^{\phi(n)} =  1 \mod n$ ? According to Eulers theorem this is true only if $x \text{ and }\phi(n)$ are coprimes. But $x$ is only restricted to be  $0 &lt; x &lt; n$  and $\phi(n) &lt; n$. So $x$ should be chosen to be coprime with $\phi(n)$?  Help me clear out the confusion!
69630
I have a cryptography workshop question I'm having trouble with as follows;  Person A creates a cipher $E_k(m)$ which produces a ciphertext from message $m$ using key $k$. The function inside $E$ is kept secret but the length of $E_k(m)$ is known.  Person B recommends "increasing" security of the cipher by instead doing :   $(E_k(m) \oplus m)\ ||\ (E_k(m) \oplus 1111...11)$      Does this in fact increase security of the cipher or increase new problems.  My thinking is, depending on the function within $E$, xoring the output of the cipher with the plaintext message $m$ could expose the key $k$, meaning the extra complexity is for nothing. Am I on the right track, or am I missing something?  I have tried searching for examples of similar schemes and found nothing (which probably means it's not a good scheme) but I need to justify my answer.   Any steers in the right direction would be greatly appreciated, I'm more than happy to do the research myself just unsure what specifically to look for.   Unfortunately the above context is all I have been provided for this question.
79642
What is the best way to generate two independent symmetric keys from one user-entered password or passphrase? Would using both scrypt and pbkdf2 achieve this?
87049
I'm not sure how password hashing works (will be implementing it later), but need to create database schema now.  I'm thinking of limiting passwords to 4-20 characters, but as I understand after encrypting hash string will be of different length.  So, how to store these passwords in the database?
91155
We had a quiz in class today where we had to break the ciphertext with the key given, but not the algorithm. Suffice to say that I wasn't able to decrypt it within the allotted time of 12 mins and will probably get a 0% score on the quiz.  So, I was just wondering if there are some kind of standard techniques that are followed when decrypting a simple substitution ciphertext.
52450
I encountered a simple function that even FHE cannot solve. Here's it:  int f(a,b,c,d){    if(a+b&gt;c+d) return a+c;       else return b+d; }   Since FHE is not order-preserving, one can't figure out whether a+b>c+d without the decryption key. That means even if practical FHE was implemented, f(a,b,c,d) cannot be computed in the Cloud independantly and securely. Not to mention linear regression, or more complex functions.  So I wonder with such an obvious limitation, why is FHE called "the holy grail of cryptography"?
18835
From what I heard, many encryption algorithms are based on the assumption that some problems are computationally hard, i.e, NP-complete. In the unlikely event that someone proves that P=NP, these codes will break.  Is there a practical encryption algorithm that will remain safe even if P=NP? I.e, an algorithm that depends on problems that are more difficult than just NP-complete?  My guess is that the answer is no: to be practical, a code must be verified in polynomial time, i.e, the problem must be in NP. Is this correct?
70415
I know the basic differences between Symmetric vs. Asymmetric cryptography, but I'd love to know more details:    Exactly why is the asymmetric approach slower than the symmetric?  Why does it make use of longer keys?  Why does it require more processing power, etc, etc? In what ways does it trump the symmetric approach?   Thanks, in anticipation, for your answers - I'm writing a BSC project on this issue.
73419
Suppose $H$ is a hash function; why is $$H(k\mathbin\|H(k\mathbin\|m))$$ not secure?  See this . In there, indeed two keys are used and the mac algorithm is $$H(k_1\mathbin\|H(k_2\mathbin\|m)).$$ Why don't we use $$H(k\mathbin\|H(k\mathbin\|m)),$$ which has only one key?
56951
I have been learning about Vigenere ciphers and then thought of this scenario: if a cryptographer encrypts a plaintext English message with a Vigenere cipher and then another cryptographer, who wants to ensure that the message is very secure, encrypts the ciphertext with another Vigenere cipher (with a different key length). Given only the ciphertext, how can you decrypt the message? A step by step explanation would be greatly appreciated.