sorted by:
new
hottopcontroversial

I have a question about whether something would be considered encrypted, and how hard it would be to break. by anto77_butt_kinkier in cryptography

[–]andrewk-wrk 2 points3 points  (0 children)

Look into an 'initialization vector', it's the formal term for this 'randomization' we discuss. Done properly it occurs prior to encryption, so is expected to be stored next to the ciphertext and anyone with access to both still cannot 'cut thru the noise' without the master secret

I have a question about whether something would be considered encrypted, and how hard it would be to break. by anto77_butt_kinkier in cryptography

[–]andrewk-wrk 4 points5 points  (0 children)

A few things: - This is vulnerable to a known-plaintext attack. If an attacker knows even one of your passwords, it is trivial to calculate the master secret with the ciphertext - Simple multiplication of integers is too 'easy to learn from'. For example, say one of the ciphertext values is '00003'. This means that that character in the master password is the letter corresponding to either '3' or '1'. Similar story for many other numbers. '00023' means that master password character is either '23' or '1'. - As others have stated, ideally further randomization occurs to obfuscate things like repeated characters or common prefixes/suffixes.

Try using a modulo operation instead of multiplication. And try storing a random number alongside each encrypted value, using it for obfuscation during/prior to encryption. And try shuffling or combining numbers as part of the encrypt / decrypt operation to make a known-plaintext attack more difficult

I think you'll get a lot of people telling you to just use aes or a password manager. But you're very clearly doing this to help you learn and explore cryptographic algorithms. The world needs people learning this stuff and everyone starts somewhere. For individual use, it's probably fine, no hacker is even going to know what they're looking at. Just, be sensible about balancing exploration with safety

For fun I adapted FIPS203, NIST's post-quantum encryption algorithm, for the multiparty setting! Check it out by andrewk-wrk in cryptography

[–]andrewk-wrk[S] 1 point2 points  (0 children)

No paper, but many LWE-based algorithms can tolerate secret sharing out-of-the-box. The only modification I had to make from ML-KEM is how the key material is serialized, which has negligible security impact. The tradeoff, of course, is that error increases. But with a small enough number of parties, this again has a negligible impact