The IV used in schemes such as CBC has to be random and unpredictable. But at the same time it does not have to be kept secret.  If the IV does not have to be secret, why does it have to be random then? I fail to make sense out of these seemingly contradicting requirements.  I have seen descriptions of attacks which exploit the non-randomness. So, I would understand why randomness is needed. However, things get confusing when the requirements specify that the IV does not have to be secret !This seems to defeat the whole purpose of randomness.  Somebody help clarify this please.
121639
I heard multiple times not to reuse the same IV and IV should be random but doesn't need to be secret. I also heard if the IV is something like sequential numbers or something predictable I should hash(salt+pepper) it. Why on earth should i be doing that if they don't need to be a secret?  In this specific case i am encrypting rows with one secret AES key and i am using a fixed IV but xor-ing it with the row id. Its predictable and not secret but by doing this it isn't reused which i thought was the important part.  Are IVs suppose to be secret? Are predictable IVs ok? Should i be hashing predictable IV?
37818
I'm trying to wrap my head around how different padding methods affect the strength of CBC-MAC's. Suppose a message is split into different blocks, m1, m2, m3 etc. and the last block is padded with 0's to fill it if needed.  If the message is intercepted, why can an attacker easily create another message with the same MAC tag for the same key as the message that was intercepted?  If another message is intercepted that does not contain any padding (so it completely fills the last block), how does this make it more difficult for the attacker to create a tag that matches? Does the message need to meet any conditions for the attack to work?  If this padding method is not secure, what is a better method to secure against these attacks? Would it be more secure if the padding was just random? Not sure how that would work.
21465
When I say totally random, I mean absolutely random, not pseudorandom. If I want to say "totally random" numbers such as 1,26,17,4,1 and 27, although I see them to be totally random, they aren't. These are numbers that I think are influenced by my childhood, ideology and everything that I've seen. So, what do you think? Is there anything completely random?
12059
I understand the use of pseudo-random number generators. I am not getting mixed up between these and "real" random number generators.  However, I don't understand for what a real random number generator is used. If it is not deterministic, how can it be used in an algorithm?
71360
This is a question I had from an exercise session.  First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES in CBC decryption mode with a secret $IV_2$ and key $K_2$.  Is this construction safe against meet-in-the-middle attack?  Wouldn't the first two operations negate themselves because $C_1$ would decrypt into $P_1$?
1065
I just learned that using CBC encryption with an IV which is predictable is not secure.  From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can verify if the IV he guessed was right. How does this qualify as an attack?
90129
As was pointed out in  I cannot prove this, but it seems intuitively impossible.  An encryption function is supposed to obscure the plaintext to the point where no information can be obtained about it. If the underlying encryption algorithm can even be determined, that goal has not been achieved.  Is this correct? Can double-encrypting (with either the same or separate algorithms) weaken security?
37331
I have a coworker who writes unit tests for objects which fill their fields with random data. His reason is that it gives a wider range of testing, since it will test a lot of different values, whereas a normal test only uses a single static value.  I've given him a number of different reasons against this, the main ones being:   random values means the test isn't truly repeatable (which also means that if the test can randomly fail, it can do so on the build server and break the build) if it's a random value and the test fails, we need to a) fix the object and b) force ourselves to test for that value every time, so we know it works, but since it's random we don't know what the value was   Another coworker added:   If I am testing an exception, random values will not ensure that the test ends up in the expected state random data is used for flushing out a system and load testing, not for unit tests   Can anyone else add additional reasons I can give him to get him to stop doing this?  (Or alternately, is this an acceptable method of writing unit tests, and I and my other coworker are wrong?)
50454
Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.)  Can this be done such that each player has the power to be reasonably sure that the random number was fairly selected, without having to trust anyone else?  This question stems from a discussion in comments to my answer on the . I came up with a protocol but someone else spotted a flaw. This site seems more appropriate. Please feel free to make use of my answer to that question.
84020
I was just reading the  and came across an interesting table explaining how the winner was chosen:    Unfortunately the NIST site is down so I can't gain further information about the approval process so I was hoping someone here would know in more detail.   Who or what decided on the numbers in this table which ranks each algorithm? I.e. can the exact analysis process be described? Who created that process? People in NIST or an equally divided group of government, industry and public cryptographers? What is included in "Design Features"? I.e. What were those features that were important? "Performance" analysis could have been done with benchmarks but "Implementation Difficulty" sounds subjective. How was that quantified? Could the numbers in that table been tweaked to skew the results in favor of a particular algorithm?   Those questions aside and assuming the magic numbers above were arrived at a fair and equitable process without bias or hidden agendas, it seems to me this table or ranking system is still missing a "weighting" criteria. All categories seem to be weighted with the same importance. That is "Smart Card Performance" is equally important as "General Security". That seems incorrect. I would argue that security is of the utmost importance so that should have a higher weighting relative to the other criteria which would be secondary concerns. A good quote would be:     Security at the expense of usability, comes at the expense of security.   I wondered what would happen if I applied a high weighting factor to security and left the other points as they are. For example:    Now Serpent is first equal with Rijndael with Twofish coming in a close second. Interesting.  What about if I am developing a software product, I don't care about about hardware performance or smart card performance so I can rule those two out completely in my decision. The table might look like this:    Now Twofish is the winner and Rijndael is second equal with Serpent and MARS. MARS might even be more attractive with its variable key size up to 448 bits.  My overall point is that Rijndael, Serpent, Twofish and MARS all appear to be within the same ballpark quality range as far as block ciphers go and this rating criteria. There might be a more accurate mathematical way to apply a weighting factor. If I was revamping the security on a project and concerned about NSA involvement in weakening encryption standards then I could re-weight some of the criteria and priorities to suit my project's specific goals. I might decide on a different algorithm from Rijndael. Back in 2000 Rijndael might have suited the US government's purposes and planned surveillance agendas but not my project's. I would compare it to selecting an algorithm just like TrueCrypt gives you the option of choosing between 3 different algorithms. Would that be a reasonable call?
60094
In reference to , what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal information about plaintext in contrast to HMAC. Is my understanding right?  What are other security properties of MAC and HMAC?
39709
In asymmetric ciphers we publish the public key for anyone, which means an attacker can encrypt any message they want and compare the ciphertext and plaintext without communicating with the owner of the private key. So do known-plaintext attacks make sense for asymmetric ciphers, or are they only for symmetric ciphers?  Ps. What are all the attacks there exist for public key ciphers? (I know of chosen ciphertext and timing attacks.)
82539
I'm doing a code review for a crypto solution that reuses the same key with a constant IV.  I want to demonstrate that this is not the right way to do things by figuring out the key and decrypting all of their test data.   I have access to lots of ciphertext. I know the same key is used. I know the same IV is used. Cipher is AES/CBC/PKCS5 Plaintext is 16 bytes. Ciphertext is 32 bytes (PKCS5 padding?) I can put whatever plaintext I want through the system and then get that ciphertext.   What's the high-level pseudo code or process to break this system?
102728
At work we have two competing theories for salts.  The products I work on use something like a user name or phone number to salt the hash.  Essentially something that is different for each user but is readily available to us.  The other product randomly generates a salt for each user and changes each time the user changes the password.  The salt is then encrypted in the database.  My question is if the second approach is really necessary?  I can understand from a purely theoretical perspective that it is more secure than the first approach, but what about from a practicality point of view.  Right now to authenticate a user, the salt must be unencrypted and applied to the login information.    After thinking about it, I just don't see a real security gain from this approach.  Changing the salt from account to account, still makes it extremely difficult for someone to attempt to brute force the hashing algorithm even if the attacker was aware of how to quickly determine what it was for each account.  This is going on the assumption that the  passwords are sufficiently strong.  (Obviously finding the correct hash for a set of passwords where they are all two digits is significantly easier than finding the correct hash of passwords which are 8 digits).  Am I incorrect in my logic, or is there something that I am missing?  EDIT: Okay so here's the reason why I think it's really moot to encrypt the salt.  (lemme know if I'm on the right track).    For the following explanation, we'll assume that the passwords are always 8 characters and the salt is 5 and all passwords are comprised of lowercase letters (it just makes the math easier).  Having a different salt for each entry means that I can't use the same rainbow table (actually technically I could if I had one of sufficient size, but let's ignore that for the moment).  This is the real key to the salt from what I understand, because to crack every account I have to reinvent the wheel so to speak for each one.  Now if I know how to apply the correct salt to a password to generate the hash, I'd do it because a salt really just extends the length/complexity of the hashed phrase.  So I would be cutting the number of possible combinations I would need to generate to "know" I have the password + salt from 13^26 to 8^26 because I know what the salt is.  Now that makes it easier, but still really hard.    So onto encrypting the salt.  If I know the salt is encrypted, I wouldn't try and decrypt (assuming I know it has a sufficient level of encryption) it first.  I would ignore it.  Instead of trying to figure out how to decrypt it, going back to the previous example I would just generate a larger rainbow table containing all keys for the 13^26.  Not knowing the salt would definitely slow me down, but I don't think it would add the monumental task of trying to crack the salt encryption first.  That's why I don't think it's worth it.  Thoughts?  Here is a link describing how long passwords will hold up under a brute force attack:
60080
I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic &quot;salt&quot; is, when I might need to use it, and why I should or should not use it. Can I get a very simple and clear (beginner level) explanation? If you know of any references on the topic, those would also be useful.
64613
I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is .  What I really need is basic explanation of the attack itself with a small example if possible such as any basic block cipher that you could come up with with 3-4 rounds. This is for my personal understanding so any input is more than welcome.
73954
What is the "Random Oracle Model"?  Is it an "assumption" akin to the hardness of factoring and discrete log?  Or something else?  And why do some researchers have a strong distrust of this model?