Slashdot Mirror
Intro to Encryption
An anonymous reader submitted a Techworld story which is a sort of encryption primer. The difference between codes & cyphers, and what all those acronyms like RSA and DES actually mean. This is good primer material for newbs, and a good refresher for fogeys.
Certificates are 1024 or 2048 bit with SSL. On the other hand, once the key is sent and shared, a 128 bit symmetric form of encryption is used. The only thing RSA is used for is sending / receiving the symmetric encryption key, yes?
Correct me if I'm wrong.
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
I would strongly recommend the Code Book by Simon Singh over that short article. It takes the reader from the Ceaser cipher all the way to quantum codes and is a very enjoyable read. The Codebreakers by David Kahn is also an excellent though somewhat lengthier volume
http://shit.slashdot.org/article.pl?sid=04/11/15/1 935233
The Handbook of Applied Cryptography: http://www.cacr.math.uwaterloo.ca/hac/ is a very detailed guide to some cryptographic algorithms and theories. This is not for newbies at all. For those wanting to implement a particular cipher, this book is the place to refer to. On top of everything, it is free.
a b c d e f g h i j k l m n o p q r s t u v w x y z
n o p q r s t u v w x y z a b c d e f g h i j k l m
first post!
Bruce Schneier's Applied Cryptography is another excellent resource for all you crypto-geeks out there. It goes from the basics (including the substitution cipher presented in the article) through basic crypto (ENIGMA, DES) all the way up through state-of-the-art (don't think AES was in my 1st ed., but I believe it's in there now). He talks about everything from the theoretical to the practical, hash collisions to rubber-hose cryptography.
It comes with source too! You know you love source....
I'd point people here first, then to a few other links that other people have pointed out. The article linked is a bit terse for a newbie.
>>The present generation of web browsers use 128-bit keys
_ ________
>> so cannot be considered secure against a determined
>> and sufficiently well-resourced attack.
The 128-bit there is the symmetric cipher key length, RSA is
used for signature authentication and not encryption, key
exchanges occur via hand-shake algorithms ie: diffie-hellman
and derivatives there of...
a 128-bit symmetric cipher is actually very strong, for temporary
transit data ie: purchase data, cc numbers etc.
Arash Partow
_________________________________________
Be one who knows what they don't know,
Instead of being one who knows not what they don't know,
Thinking they know everything about all things.
http://www.partow.net
Arash Partow's Philosophy: Be a person who knows what they don't know, and not a person who doesn't know.
Random pads with truly random data is unbreakable. The few times it has been broken has been due to human error (reusing the same random data stream). The US tracked some russian spies with this, they reused pads, and we found out there was a mole in the atomic bomb program.
That said, paddign with pseudo-random data is very unsafe. Breaking this type of encryption is typically one of the first homework assignments in cryptography courses. The article is either very fuzzy on this distinction, or plain out wrong, depending on how you read it.
If after reading the intro to encryption you are so inspired to try to crack one, I highly recommend this list...
The problem with challenges like "crack this uncracked cipher" is that the challenge is not realistic.
Most of these codes/ciphers give you no idea the process behind how they were generated. That's unrealistic: usually an analyst will have the algorithm that does the encryption (if not the key itself), either via open-source, reverse engineering of a public binary, legitimate purchase, or espionage.
Most of these challenges only give you a tiny piece of ciphertext. That's not realistic: if you're trying to break, say, SSL, you'll be able to get your hands on megabytes of transcripts, and you'll even be able to generate ciphertexts that correspond to plaintexts of your choice.
Most of these "ciphers" don't generalize to arbitrary messages. That's unrealistic. Sure, someone can design some ad-hoc cipher to encrypt the location of his buried treasure using landmarks, clever puns, and weird symbols. That's a far cry from being able to efficiently encrypt an arbitrary TCP/IP stream.
Cryptography Decrypted by H. X. Mel and Doris Baker is a good intro to crypto. I found it entertaining and the topics went from elementary to, uh, more than I cared to know. The appendices explaining the mathematics of crypto were interesting as well.
"If you're not passionate about your operating system, you're married to the wrong one."
It talks about the origins of crypto a little, and leads into public key encryption, a field I have been trying to learn a little more about. Much better article than the parent!
You can have my one-button mouse when you pry it from my cold, dead fingers.
Actually its not. There is an efficient algorithm out there for factoring numbers into primes. The only problem is that it requires technology (quantum computers) which doesn't exist yet, but which is on the horizon.
"And why is my article modded flamebait?!"
Because mods are jackasses.
Mathematics is made of 50 percent formulas, 50 percent proofs, and 50 percent imagination.
Didn't they use to do the same thing with vinyl records? (except for the seti part...)
Pay no attention to that man behind the curtain.
Won't supply a link here, but Simon Singh's excellent "The Code Book" provides a large level of detail about the Polish contributions to breaking Enigma.
Ahh, what the hell, I _will_ supply a link here. Or, just google "Rejewski Enigma".
About RSA: Current hardware means key lengths should be 1024 bits for complete security. The present generation of web browsers use 128-bit keys so cannot be considered secure against a determined and sufficiently well-resourced attack.
Firstly, directly comparing symetric and asymetric key lengths shows that the authour has no knowledge of encryption. They are not directly comparable since they are used in different ways and have different meanings.
Secondly, claiming 128-bit keys are insecure shows that the authour has no knowledge of encryption. 80-bit keys are widely considered infeasible to break.
I like the primer PKE here.
No one has ever broken PGP. No one has ever broken GPG.
Correction: No-one has ever admitted to having broken PGP or GPG. Unless you know something those of us outside the NSA don't, you can never be so sure.
Remember, the Nazi's thought no-one had broken Enigma...
---- Den ene knappen er powerknapp, den andre er Bender voice knapp "Bite My Shiny Metal Ass"
Even if you reuse it it is hard
No. If you reuse it, it's easy to break. The Rosenberges went to the electric chair because some Russian spy reused a pad.
That's it. Now, put N and e together in a file and call it your "private key", and put N and d together and call it your "public key". To use them:
In practice RSA takes too much time, so you make yourself a random key, encrypt that using RSA, and you and your recipient communicate using a symmetric cipher.
As to why ((n^e mod N)^d mod N) = n, that's where it helps to know some math. Mathweb or Wikipedia can help you, but having a bit of background in abstract algebra will help.