First of all, I know it's a very bad idea to invent your own encryption algorithm. It's better to use existing known, trusted, extensively tested and studied algorithms with a proven track record. The idea below is purely theoretical, from a studying point of view. I thought of a rather simplistic encryption method, and wondering what you people think of how (in)secure this is, compared to AES.  I propose the following symmetric encryption method:  Given any input data, and a password (each of arbitrary length), we encrypt the data as follows:  H1 and H are hashing functions (e.g. SHA256 or SHA3-512). H1 and H may be the same.  n1 and n are the number of bits of H1's and H's output (e.g. if H1=SHA3-512 then n1=512, and if H=SHA256 then n=256). Preferably n1&ge;n.  S = a randomly generated salt of 128 bits, which is written at the start of the output.  K = H1(S+password) where + means binary concatenation.  The data is processed in blocks of n bits (the last block may be smaller).  Block i is XOR'ed with B(i) = H(K XOR i) where i is the block index (starting at zero), represented as a simple binary integer, extended to n1 bits (to match K's size).  If the last block is m &lt; n bits, only those m bits are procesed (the remaining n-m bits of the last B(i) are not used).  The decryption procedure is basically the same, except S is taken from the encrypted data instead of generated.  I would suggest H1 = scrypt, bcrypt, or PBKDF2 with moderate work parameters, and H = SHA256 or SHA3-256.  Properties/advantages:   It's a stream cipher. Every block of n bits can be encrypted and decrypted completely independent of other blocks. This makes the algorithm suitable for streaming, parallelization, and if part of the data is damaged or missing, the rest can still be decrypted (except if the salt at the beginning is corrupted). Additional data can be appended later, and parts of the existing data can be replaced in-place. Because of the random salt S, similar data encrypted with the same password will result in completely different outputs. Even if you happen to know part of the input data, nothing is revealed about the rest of the data or the password. It's fast, provided that H is fast. Encryption and decryption are the same (only difference is generating a random salt vs reading it). Other than the 128-bit salt, the encrypted data stays the same size (unlike certain other encryption algorithms, especially asymmetric). No padding involved that can be abused to tamper with the data or partial decrypting by trial and error (some other encryption schemes have padding vulnerabilities).
12716
Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x.  We represent numbers in simple binary instead of a counting function. 0 in dec = [256 zeros] in binary, 1 = [255 zeros]1, 23092348 = [241 zeros]1011000000101110001111100, etc.  For each nth block needed for the length of the plaintext, XOR x with n and hash it with SHA-256 to form b[n].  Let p[n] be the nth 256-bit block in the plaintext and c[n] be the nth block in the ciphertext. Then c[n] := b[n] XOR p[n].  Send the unencrypted nonce along with the ciphertext.  To decrypt c[n], XOR it with b[n] to retrieve p[n].  Is this secure? If so, then why do we need AES-256?  If this is not secure, then is there any mode of operation for which SHA-256 is secure as a block cipher? Specifically, it would need to be used in cipher feedback, output feedback, or any other mode that only uses the cipher in the encryption direction.
73632
There have been several attacks against hash functions such as $h_{sha1}$ and $h_{md5}$.  Professor A suggests a new function $h_{666}$ with an output length of 666 bits.   Professor B suggests combining the two functions $h_B=h_{sha1}(h_{md5}(m))$.   Professor C suggests combining all four functions $h_C=h_{md5}(m) \oplus h_{sha1}(m) \oplus h_B(m) \oplus h_{666}(m)$, where short messages are padded with zeros where necessary.     Explain / prove why each and every one of these functions may be less safe than $h_{sha1}$.   I couldn't think of anything to say about $h_{666}$, since we know nothing about it, except that it has a constant output length, which I know many other hash function have. I thought it might have to do with the length not being a multiplication of 2, but couldn't reach a specific conclusion.  I think $h_B$ is bad because we know that $h_{md5}$ is known to have collisions, and such collisions will affect $h_B$ as well.  Couldn't exactly understand what's wrong with $h_C$, unless again it has to do with collisions of $h_{md5}$ and/or the safety of $h_{666}$.  Any help would be appreciated, thanks!
90129
As was pointed out in  I cannot prove this, but it seems intuitively impossible.  An encryption function is supposed to obscure the plaintext to the point where no information can be obtained about it. If the underlying encryption algorithm can even be determined, that goal has not been achieved.  Is this correct? Can double-encrypting (with either the same or separate algorithms) weaken security?
35921
Suppose I want a strong 20-bit blockcipher.  In other words, I want a function that takes a key (suppose the key is 128 bits), and implements a permutation from 20 bits to 20 bits.  The set of permutations should be close to a randomly-chosen subset of size $2^{128}$ of all $2^{20}!$ permutations on 20 bits.  I don't want you to build a new blockcipher from scratch.  Instead, assume you have a "strong" blockcipher like AES (128-bit blocksize, 128-bit keysize) and use this to build your 20-bit cipher.   Of course, your construction should be practical (i.e., you should be able to run it in both directions with reasonable amounts of time and memory).
63823
I was recently reading that MD5 is "broken" because it's pretty easy to generate collisions (like 2^(L/2)). And the SHA1 (theoretically) fares no better. The solution seems to be hash algorithms that are very slow in comparison.   I am wondering why can't people combine these fast algorithms to get the best of both security and speed? What would be the time complexity to generate a simultaneous MD5 and SHA1 collision? And if it's hard enough, would these make a viable candidate for collision resistant hash applications?  (By simultaneous collision I mean generating a string with same MD5 and SHA1)
34917
Let's pretend that all digits of pi are known and arbitrarily long sequences of digits are trivial to get. Further, some mathematician proves that there are no patterns in pi. We could create a stream cipher by grabbing a piece of pi as long as our plaintext and combining the two with some function (such as XOR or modulus addition.) The key would be the starting position in pi.  Would this be equivalent (in terms of security) to a one-time pad? To what sort of attacks would it be vulnerable?
7126
I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of the credentials for the internal app.   I picked AES as the encryption algorithm, but the problem is that the password-based scheme doesn't produce a "secret" IV. So, the IV must at least be known to an attacker (stored alongside the encrypted data). A hash value used for password verification could work, or I could just generate a pseudorandom byte array and drop it in the DB as a new column. I was further considering, for simplicity, to use a constant IV.   What adverse effect will either of these choices have on the security of the encryption? Does AES depend, as many block ciphers do, on an unpredictable IV? Does it matter if the IV is stored as unencrypted plaintext?
91771
The question is rather simple, but finding resources and answers quite tricky. Homomorphic encryption should enable us to compute over encrypted data. What if the algorithm for computing should be kept in secret as well? Given we have a functioning homomorphic encryption in place, is the algorithm which is applied to the input data also secure? Is it possible for an intruder to understand how the data is computed and learn about the algorithm, given the intruder has access to the program which does the computation? Update I tried to ask about circuit privacy or protection with this question. Luckily and unfortunately I learned about this term only by asking this question, which was misleading a bit. So the question should have been: Does FHE offer circuit privacy? With this term I found some papers which answer my question.
45002
I'm pretty sure I understand how public/private key cryptography works. Anybody can encrypt a message using a well-known public key, but only the person who holds the private key can decrypt it.  My question concerns securely sending a message to multiple people. Say there are n public/private key pairs. Is there a way to encrypt a message using the n public keys such that any one of the private key holders can decrypt the message in its entirety, but nobody else can?  Further, unrelated to public/private key cryptography, is there any scheme where there are n shared keys such that anybody who knows the n keys can encrypt a message such that any one of the shared keys can decrypt the message in its entirety, but nobody else can?
49613
I was thinking of how to create an IV for a block cipher that doesn't require stored state, and I came up with the idea of using an HMAC of the (padded) plaintext and a (possibly distinct) key as the IV.  This seems to be secure:   The IV will only be reused if there is an HMAC collision or if the plaintext and key are the same.  The former would imply that the HMAC is broken and the latter is harmless, since it is just producing the output twice. The HMAC is verified after decryption, but before padding is checked, so padding-oracle attacks should not be an issue.   In particular, if the HMAC and the block cipher use different keys, there seems to be a very simple proof of security, assuming that either (1) the HMAC cannot be distinguished from a random function or (2) the block cipher is secure against maliciously-chosen (but unique) IVs:   The attacker cannot forge the HMAC, since this would require knowledge of the signing key. Since the signing and encryption keys are different in this case, and the HMAC is assumed random, malicious IVs cannot be triggered by an attacker.   Alternatively, if the cipher is secure against malicious (but unique) IVs, then the security of the cipher+security of the HMAC seem to prove the security of the system.  This (obviously) provides no protection against replay attacks, but that requires state anyway.  However, I am not a cryptographer so I do not trust my conclusions on this matter.  If this technique is secure, it would appear to be quite useful in practice, as it is simple and provides both encryption and authentication.
47758
What is the difference between encrypting something and hashing something?  in what situations would I want one or the other?
63536
It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why?   Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as the MAC-then-encrypted version of the message? Assuming no bad relations between $Encrypt$ and $H$, what are the possible weaknesses? It seems that in this case we are encrypting the hash with part of a secretly keyed stream cipher keystream, and the hash is secure; does this not fulfil an approximation of the ideal MAC?  This must be somehow bad, since no secure protocol seems to use it. Why?
87741
Disclaimer: This is exercise 2.1 in Katz-Lindell book.  Given a (symmetric) encryption scheme $\Pi=(Gen,Enc,Dec)$ where $Gen$ takes the security parameter $1^n$ as input and generates a key $k$ of length $n$.  Usually we simply assume that $Gen$ chooses key uniformly from $\{0,1\}^n$ but this is not always the case.  Given $Gen$, how would you construct a new generation algorithm $Gen'$ that indeed outputs $k$ uniformly at random?
56276
I (and many others for that matter) have always been fascinated by the inner workings of the modern building block of cryptography: block ciphers.  Now, the ressources on the "black art" of design and analysis of these ciphers are sparse; especially for the entry level. Available information like  seems to be somewhat outdated (due to its age).  What's the general consensus of the “best” (read: recommended) strategy to start designing and/or analyzing modern cryptographical block ciphers?    Nota bene: Think of this as a general, wiki-alike question – for learning purposes only. (Besides that, this Q&amp;A would represent a place we can point people to when alike algorithm design questions arise.)
111433
I'm writing a little desktop app that should be able to encrypt a data file and protect it with a password (i.e. one must enter the correct password to decrypt).  I want the encrypted data file to be self-contained and portable, so the authentication has to be embedded in the file (or so I assume).  I have a strategy that appears workable and seems logical based on what I know (which is probably just enough to be dangerous), but I have no idea if it's actually a good design or not.  So tell me: is this crazy?  Is there a better/best way to do it?   Step 1: User enters plain-text password, e.g. "MyDifficultPassword"   Step 2: App hashes the user-password and uses that value as the symmetric key to encrypt/decrypt the data file.  e.g. "MyDifficultPassword" --> "HashedUserPwdAndKey".   Step 3: App hashes the hashed value from step 2 and saves the new value in the data file header (i.e. the unencrypted part of the data file) and uses that value to validate the user's password.  e.g. "HashedUserPwdAndKey" --> "HashedValueForAuthentication"   Basically I'm extrapolating from the common way to implement web-site passwords (when you're not using OpenID, that is), which is to store the (salted) hash of the user's password in your DB and never save the actual password.  But since I use the hashed user password for the symmetric encryption key, I can't use the same value for authentication.  So I hash it again, basically treating it just like another password, and save the doubly-hashed value in the data file.  That way, I can take the file to another PC and decrypt it by simply entering my password.  So is this design reasonably secure, or hopelessly naive, or somewhere in between?  Thanks!  EDIT: clarification and follow-up question re: Salt. I thought the salt had to be kept secret to be useful, but your answers and links imply this is not the case.  For example,  linked by erickson (below) says:      Thus, password-based key derivation as defined here is a function of a password, a salt, and an iteration count, where the latter two quantities need not be kept secret.   Does this mean that I could store the salt value in the same place/file as the hashed key and still be more secure than if I used no salt at all when hashing?  How does that work?  A little more context: the encrypted file isn't meant to be shared with or decrypted by others, it's really single-user data.  But I'd like to deploy it in a shared environment on computers I don't fully control (e.g. at work) and be able to migrate/move the data by simply copying the file (so I can use it at home, on different workstations, etc.).
89444
Assuming I'm a bank which seeks for secure hash functions to use in the process of  signing on digital contents.  I'd like to explain / prove why using each one of the following hash functions might be less secure than using SHA-1 (yes, I know SHA-1 no longer considered secure, but the question does consider it as one, or at least states "do not be less secure than sha-1").   $h_{666}(m) = $ some new hash function with 666 bit long output. $h_{ib}(m)=h_{sha-1}(h_{md5}(m))$ $h_{hm}(m)=h_{md5}(m) \oplus h_{sha-1}(m) \oplus h_{ib}(m) \oplus h_{666}(m)$, while the XORing operation here xors the matching bits between two outputs, padding with 0s the smaller ones.   I would say…   I can tell that using new hash function is a bad idea since no one has yet to research and attack it, aside from the fact that more bits is less efficient. Apart from this explanation, I don't see other reason to disqualify this answer. md5 is broken and collisions can be made quite easy, so two different inputs to this function can collide and have the same input to the sha-1 function, which will result in collision between the final outputs. I have no clue how to disqualify this one. The intuition says 'xoring with bad hash functions is not a good idea', but I can't really justify my answer. I also think the padding doesn't actually affect anything, becuase if SHA-1 result is secure then padding 0s to it won't make it collide with other inputs suddenly.   Am I correct, or did I miss something obvious somewhere?  Edit  This is different from  since here the idea is to combine unsecure hash with a secure one. This is not about just combining hashes.
110846
While developing some code that uses the .NET AesManaged algorithm, I made some mistakes but was surprised at the results.  My encryption was correct.  I was generating a random IV block and writing it to the file (without encrypting the IV).  Then I was encrypting the plaintext and writing it.  The decryption was wrong though... instead of reading the first block from the file an using it as an IV, it was just using a random IV and decrypting everything.  The first block came out gibberish but the 2nd (and subsequent) ones were decrypted properly!  Why would this be?  And even weirder... when I tried to fix it by encrypting the IV in the encryption code (instead of writing the IV unchanged) the decryption result was the same!  (gibberish then correctly decrypted blocks).  Although I eventually fixed my code, how do these results make sense?