Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 23 guests and 2 members online
EH-Net Donations

Enter Amount:
$

Google Ads
EH-Net News Feeds
Latest Additions
Book Recommendations





 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Otherarrow Cryptography Algorithms Choices
Ethical Hacker Community Forums
January 08, 2009, 03:42:01 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: ChicagoCon 2-Day Ethical Hacking Conference with MS Blue Hats Oct 31 - Nov 1. Tickets Only $100! www.chicagocon.com/content/view/103/51/
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Cryptography Algorithms Choices  (Read 1303 times)
0 Members and 1 Guest are viewing this topic.
tntcoda
Newbie
*
Offline Offline

Posts: 14


View Profile
« on: October 18, 2008, 01:40:59 PM »

Hi,

I am making some crypto software for a uni project, I'm using symmetric encryption (block ciphers), and I need to make informed decisions that i can back up with facts on which algorithms to include in the software.

I have decided to offer more that one choice, because if the ciphertext is intercepted it would not be 'as easy' to determine the algorithm associated with it if there's multiple possibilities.

Off the top of my head, I can think of performance and keysize as reasons to pick one algorithm over another. Is there anything else I can use to decide? Are there any tools or papers on algorithm performance?

Off the top of my head I would like to use AES-256, Blowfish-448 and maybe RC6-2040? Im basing that purely off the fact they have decent key size options, and have had been in the public domain for a fair while. Is there anything else that I can use in a report to back up my reasoning? Like why I chose Blowfish over Twofish or say CAST-256? There are no end of options anyway.

Thanks for any pointers,
Logged

CEH, Linux+
unicityd
Newbie
*
Offline Offline

Posts: 14


View Profile
« Reply #1 on: October 21, 2008, 11:48:42 AM »

AES is the U.S. Standard and is the safe choice.  The runners up for the standard were Twofish and Serpent and both are considered to be very strong.  Twofish is the successor to Blowfish and is probably a better choice than that algorithm. 

RC6 was evaluated as a candidate for the U.S. standard but was not selected as a finalist.  I don't know if that was due to flaws in the systems or because of other concerns such as performance, code size, etc.

Triple-DES is still a good choice, but it's slow.  Triple DES uses 168-bit keys, but carries only 112-bit security (because you can do a time-memory tradeoff when triple encryption is used.) DES was the old U.S. standard.  Regular DES uses only 56-bit keys and is not recommended for new products.

Key size is important, but algorithm strength is equally important.  Try to find a copy of Applied Cryptography by Bruce Schneier.  The book is out of date so it won't talk about AES or Twofish, but it will give you a little insight into the types of concerns that go into selecting a cipher.  At a minimum, read the chapters on DES, block ciphers (there are two) and the chapter on key size.  As an alternative, you can find the Handbook of Applied Cryptography online for free in pdf form.  It's by Alfred Menezes et al.

Wikipedia is probably a good place to get some background on the algorithms.

If you want to find papers on the cryptanalysis of these algorithms, look at the proceedings to IACR's Crypto and Eurocrypt conference as well as the Fast Software Encryption Conference.  Unless you have a heavy math background, and until you've read up on block ciphers, you'll probably just want to skim the papers for the results and conclusion.

I hope this helps.
Logged
tntcoda
Newbie
*
Offline Offline

Posts: 14


View Profile
« Reply #2 on: October 21, 2008, 06:21:20 PM »

Thanks very much, very helpful, I will have a read through the sections of Applied Cryptography you mentioned.
Logged

CEH, Linux+
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.7 | SMF © 2006-2008, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.04 seconds with 22 queries.
 
Sponsors

cwnp_moto__120x90.gif

Polls
How many security events including conferences and training do you attend a year:
 
Support EH-Net


Support EH-Net by
Buying all of your
Amazon items using
the search bar above.

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics
Vote For EH-Net

progenic.com
Click here to Vote!

binarica.com
Binarica Logo

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2009 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.