I am trying to implement RSA encryption using blocks to cut down the run time of decrypting with large bits lengths. The way my program is now, it works but reads individual characters and decrpyts them. So as you might imagine, the run time for large bit lengths is long.
Is there a way to easily implement decryption using blocks so that it works faster for these large bit lengths. Examples of code with an implementation would be nice if it is easy and feasible. Thanks.
From your description, it appears that you're using the following encryption scheme:
for i=0 to length(input):
output(RSA_encrypt(key, input[i]))
This is not a secure encryption scheme. You appear to be asking for a way to do something similar to
for i=0 to blocks(input):
output(RSA_encrypt(key, block(i, input)))
That is likewise not secure. Secure RSA-based encryption schemes generally involve encrypting a unique session key with RSA then encrypting the message using a symmetric cipher such as AES. For instance, see RSAES-OAEP. Don't try implementing it yourself, because you're likely to get it wrong. Instead, use a reputable cryptographic library.
Always remember the Rules of Crypto:
Never design your own crypto.
Never implement your own crypto.
Anyone can design crypto that they can't break themselves.
Related
I am writing software in Java that will run on Android, Windows, Linux and OSX and want the devices to all talk to each other securely.
My initial thought was just to use a asymmetric algorithm (eg. RSA) and share the public keys manually. Then sessions would be encrypted just using RSA. I hit problems with this due to buffer size, then I read about CBC etc and the problems of data leakage if some form of XOR of data was not performed.
So...I looked at using AES/CBC/{padding}. Initially this sounded good: just share the key, an IV and away we go.
But these apps all talk to each other in both directions at any time, so keeping the IV in sync did not seem possible, resulting in a new IV being sent with every message. Not a big deal, but one of the advantages of AES over RSA is data size, and now I'm going to be adding 32 bytes to every message. Though I guess keeping a 'receiver' and a 'sender' Cipher would probably work.
Now I am back to considering alternatives, and trying to avoid too much roll-your-own.
Is there any substantial reason not to use RSA and CBC (or similar) done manually? ie. break data into chunks, pad as necessary, and encrypt with RSA, doing whatever XOR strategy seems most reliable.
Is there a better was to keep secure and trusted comms between pairs of peers without creating an SSL CA? Or, is there a way of hooking into the certificate verifier so that I can use my pre-shared public keys to validate the peer connections?
Any other suggestions/examples for best/simple multi-platform peer-peer secure comms?
You should look into implementing a hybrid cryptosystem. If I can guess your knowledge about the subject correctly you should really be using a pre-existing one like TLS, or DTLS, as you're not going to design a cryptographically safe protocol out of the blue.
Note that the certificates are required to create a PKI, and the asymmetric crypto of course comes with it. You should however only have to use the asymmetric crypto during the handshake which includes the initial authentication and session key negotiation.
I am implementing RSA manually on java (yes i know not the best idea but it is for university purposes). My algorithm is working good enough with small texts but when big texts come into consideration the algorithm breaks as the number of bits is superior than my key.
I am looking into the possibility to implement a padding scheme in order to fragment my plain text into small ones and then encrypt them.
Is there any suggestion on how to the padding?
Thanks in advance.
I'm sorry that I'm writing an answer that contains basically the same information as divanov's answer, but an edit to add all the little details that I think are important would be a complete rewrite of the answer.
Generally you don't want to asymmetrically encrypt your data directly, but instead use RSA to exchange a symmetric key that is used to encrypt your data symmetrically. You can do it like this (idea taken from "Cryptography Engineering" by Ferguson, Kohno and Schneier, a book I can wholeheartedly recommend):
Assuming that l is the bit length of your modulus n, generate an l-1 bit long random number r. Encrypt r with the RSA public key.
Use a cryptographic hash function to generate the symmetric key k out of r. I would advise the use of sha256: k=sha256(r)
Encrypt you data with a block cipher like AES256 using a proper "mode" like CBC.
The advantage of this procedure is that you do not have to care about RSA paddings at all (and there is a lot of stuff that can go wrong with them). Please don't check the structure of r after decrypting, though, and just stuff if into the hash function as you otherwise might open yourself up to padding oracle attacks (akin to this one) that are beyond the scope of my answer though.
Note that for a real world scenario you have to care about authenticity of the data, too. The only common use case where encryption is mostly enough is "data at rest", i.e. if no data is transmitted over the network and you only care about physical theft of your data.
When one needs to encrypt longer plain text than a assymetric key typically random symmetric cipher block key is generated, for example, AES128 and then it is used to encrypt the data. At the end of a process symmetric key is encrypted with RSA public key and saved along with the cipher text.
A decryption consists of recovering symmetric key with a private RSA key and then using the former to decrypt the long message.
One of the reasons to do so is that RSA is much slower than, for example, AES. Another one is that block cipher has no limitation for a size of a message.
I want to add cryptography to my program and after some research on cypher algorithms i found about AES and AESWrap and my main question is, how are they related? To be honest i don't realy understand the whole process since i've never used crryptography before. At first i thought that AESWrap was the AES's decription key but it's something more than that.
I am developing a chat program in java and i want to encrypt the streams of String, so basically any outside attacker unless he knows the algorithm's process and the keys from server and client he can't get access to the stream. I thought of using Blowfish but from papers i read it appears that even though it's fast it has some problems in its rounds. Now i am digressing so to sum it all up, do i "have to" use AESWrap with AES or are those two completely different?
AESWrap is an algorithm describing a way to encrypt encryption keys. You don't need to use AESWrap to use AES. You might use AESWrap if you need to encrypt the encryption key.
If you are developing a chat program, why not use SSL/TLS to secure the communication? Using symmetric key algorithms (alone) like AES gives the problem of distributing the keys to both ends. A problem SSL/TLS solves by use of certificates.
I want to know if our data is encrypted with one encryption algorithm(AES, DES, etc.) and then we transfer our data in open network, can anyone get real data or do some thing if the encryption algorithm is known even though the hacker doesn't know about the private keys, public key or PV?
can anyone get real data or do some thing if the encryption algorithm is known
If the attacker knows the encryption algorithm, it's a start, because now all they need to do is to find out what was the key used to encrypt it. But established encryption algorithms like AES have no known weaknesses. Thus an attacker would be forced to bruteforce it to gain access to the data.
If you are using keys of an appropriate size (eg: AES 256 bits or more), this would be a very difficult task. DES also has no known weaknesses, but its small key size (56 bits) allows for a bruteforce attack to succeed in a reasonable timeframe, (eg: days). That's why DES is not widely used any more.
even though the hacker doesn't know about the private keys, public key or PV?
Note that public keys are only relevant in the context of asymmetrical encryption. In this case, the public key is usually publicly available (hence, the name "public key"). But asymmetric encryption is designed so that even if you know the public key, you can't decrypt it unless you have the private key.
In summary, encryption algorithms like AES have stood the test a time and proven to be secure enough. As David Schwartz points out in his answer, if you have a problem, (usually) your implementation is the thing to blame, not the encryption algorithm.
Almost by definition, if the encryption is implemented properly and part of a sensibly-designed system, no. That's the whole point of encryption.
Note that encryption is not magic. It must be used precisely correctly to provide useful security. There are a lot of ways to do it wrong.
If you're not using a widely respect product (like TrueCrypt, Firefox, or GPG) and using it precisely how it's intended to be used, there's a very good chance you aren't getting real security. For example, Dropbox used AES, but a security flaw in another part of their system allowed one user to decrypt another user's data. So it didn't help that it was encrypted.
Yes, keeping the algorithm secret helps security marginally. If an attacker knows that you used DES (which isn't terrifically hard to break) they may be more likely to try to break it.
I think the core of your question is about statistical attacks, which tries to see through the encryption to decipher the nature of the data. Any reasonably modern algorithm is mathematically designed to thwart any attempts to guess what the data is.
However David makes a very good point. Even perfect encryption (if it existed) would be vulnerable to the human factor. These algorithms are worthless if you don't dot your i's and cross your t's, and have absolute (and justified) faith in those who can decrypt the data.
I have a question relating to the use of an Initialization Vector in AES encryption. I am referencing the following articles / posts to build encryption into my program:
[1] Java 256-bit AES Password-Based Encryption
[2] http://gmailassistant.sourceforge.net/src/org/freeshell/zs/common/Encryptor.java.html
I was originally following erickson's solution from the first link but, from what I can tell, PBKDF2WithHmacSHA1 is not supported on my implementation. So, I turned to the second link to get an idea for my own iterative SHA-256 hash creation.
My question comes in how the IV is created. One implementation ([1]) uses methods from the Cypher class to derive the IV where are the other ([2]) uses the second 16 bytes of the hash as the IV. Quite simply, why the difference and which is better from a security standpoint? I am kinda confused to the derivation and use of IVs as well (I understand what they are used for, just not the subtler differences), so any clarification is also very welcome.
I noticed that the second link uses AES-128 rather than AES-256 which would suggest to me that I would have to go up to SHA-512 is I wanted to use this method. This seems like it would be an unfortunate requirement as the user's password would have to be 16 characters longer to ensure a remotely secure hash and this app is destined for a cell phone.
Source is available on request, though it is still incomplete.
Thank you in advance.
The IV should not be generated from the password alone.
The point of the IV that even with the same key and plaintext is re-used, a different ciphertext will be produced. If the IV is deterministically produced from the password only, you'd get the same ciphertext every time. In the cited example, a salt is randomly chosen, so a new key is generated even with the same password.
Just use a random number generator to choose an IV. That's what the cipher is doing internally.
I want to stress that you have to store either the IV (if you use the first method) or a salt (if you use the second method) together with the ciphertext. You won't have good security if everything is derived from the password; you need some randomness in every message.
Cryptographers should generate IVs using a secure pseudo-random random number generator.
Application developers should use existing, off the shelf cryptography. I suggest that you use SSL with certificates to secure your network traffic and GPG to secure file data.
There are so many details that can make an implementation insecure, such as timing attacks. When an application developer is making decisions between AES 128 and AES 256 it is nearly always pointless since you've likely left a timing attack that renders the extra key bits useless.
My understanding is that Initialization Vector is just random input to encryption algorithm, otherwise you would always get same result for same input. Initialization Vector is stored together with cipher text, it's not secret in any way. Just use secure random function to generate initialization vector. PBKDF* algorithms are used to derive secret keys of desired length for encryption algorithms from user-entered passwords.
First implementation that you link to simply lets Cipher object to generate Initialization Vector. Then it fetches this generated IV to store it together with cipher text.
Second one uses part of hash bytes. Any approach that generates non-repeating IVs is good enough.
Most important property of IV is that it doesn't repeat (very often).
The IV is just a consequence of the use of block chaining. I presume that this is more than a simple API design question. I assume that you know that the reasoning for using it is so that the same plaintext will not show up as the same ciphertext in multiple blocks.
Think about recursion from the last block where the Nth ciphertext block depends in some way on the (N-1)th block, etc. When you get to the first block, 0th block, you need some data to get started. It doesn't matter what that data is as long as you know it before you attempt to decrypt. Using non-secret random data as an initialization vector will cause identical messages encrypted under the same key to come out as completely different ciphertext.
It's similar in concept to salting a hash. And that source code looks a little fishy to me. An IV should simply be fresh-at-encryption-time random bits dependent upon nothing, like a nonce. The IV is basically part of the encrypted message. If you re-encrypt identical data with identical key, you should not be able to correlate the messages. (Hey, think about the consequences of correlating by ciphertext length as well.)
As with everyone else here, I've always known IVs to be just chosen randomly using the standard algorithms for doing so.
The second reference you provided, though, doesn't seem to be doing that. Looks like he salts a password and hashes it. Then takes that hash and splits it up into halves. One half is the encryption key, one is the IV. So the IV is derived from the password.
I don't have any strong breaks for such a method, but it's bad design. The IV should be independent and random all on its own. Maybe if there's a weakness in the hashing algorithm or if you choose a weak password. You don't want to be able to derive the IV from anything else or it's conceivable to launch pre-computation attacks.