Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 63 guests and 1 member online
 
Free Business and Tech Magazines and eBooks

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Otherarrow Cryptography Algorithms Choices
EH-Net
May 24, 2013, 06:04:27 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Cryptography Algorithms Choices  (Read 3870 times)
0 Members and 1 Guest are viewing this topic.
tntcoda
Newbie
*
Offline Offline

Posts: 16



View Profile
« on: October 18, 2008, 01:40:59 PM »

Hi,

I am making some crypto software for a uni project, I'm using symmetric encryption (block ciphers), and I need to make informed decisions that i can back up with facts on which algorithms to include in the software.

I have decided to offer more that one choice, because if the ciphertext is intercepted it would not be 'as easy' to determine the algorithm associated with it if there's multiple possibilities.

Off the top of my head, I can think of performance and keysize as reasons to pick one algorithm over another. Is there anything else I can use to decide? Are there any tools or papers on algorithm performance?

Off the top of my head I would like to use AES-256, Blowfish-448 and maybe RC6-2040? Im basing that purely off the fact they have decent key size options, and have had been in the public domain for a fair while. Is there anything else that I can use in a report to back up my reasoning? Like why I chose Blowfish over Twofish or say CAST-256? There are no end of options anyway.

Thanks for any pointers,
Logged
unicityd
Full Member
***
Offline Offline

Posts: 156

Bored IT Manager, Crypto Nerd


View Profile WWW
« Reply #1 on: October 21, 2008, 11:48:42 AM »

AES is the U.S. Standard and is the safe choice.  The runners up for the standard were Twofish and Serpent and both are considered to be very strong.  Twofish is the successor to Blowfish and is probably a better choice than that algorithm. 

RC6 was evaluated as a candidate for the U.S. standard but was not selected as a finalist.  I don't know if that was due to flaws in the systems or because of other concerns such as performance, code size, etc.

Triple-DES is still a good choice, but it's slow.  Triple DES uses 168-bit keys, but carries only 112-bit security (because you can do a time-memory tradeoff when triple encryption is used.) DES was the old U.S. standard.  Regular DES uses only 56-bit keys and is not recommended for new products.

Key size is important, but algorithm strength is equally important.  Try to find a copy of Applied Cryptography by Bruce Schneier.  The book is out of date so it won't talk about AES or Twofish, but it will give you a little insight into the types of concerns that go into selecting a cipher.  At a minimum, read the chapters on DES, block ciphers (there are two) and the chapter on key size.  As an alternative, you can find the Handbook of Applied Cryptography online for free in pdf form.  It's by Alfred Menezes et al.

Wikipedia is probably a good place to get some background on the algorithms.

If you want to find papers on the cryptanalysis of these algorithms, look at the proceedings to IACR's Crypto and Eurocrypt conference as well as the Fast Software Encryption Conference.  Unless you have a heavy math background, and until you've read up on block ciphers, you'll probably just want to skim the papers for the results and conclusion.

I hope this helps.
Logged

BS in IT, CISSP, MS in IS Management (in progress)
tntcoda
Newbie
*
Offline Offline

Posts: 16



View Profile
« Reply #2 on: October 21, 2008, 06:21:20 PM »

Thanks very much, very helpful, I will have a read through the sections of Applied Cryptography you mentioned.
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.065 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.