Home Switchboard Unix Administration Red Hat TCP/IP Networks Neoliberalism Toxic Managers
May the source be with you, but remember the KISS principle ;-)

Symmetric Crypto Algorithms Links


See Also Recommended Books Recommended Links Tutorials FAQs and References
AES DES RC5 Differential Cryptanalysis Compression and security eBooks
Steganography One-Time-Pad Magazines History Humor Etc

  1. Operations performed in converting encrypted messages to plain text without initial knowledge of the crypto-algorithm and/or key employed in the encryption. [NIS]
  2. The study of encrypted texts.

Traditional two areas of cryptography are symmetric ciphers and public key cryptosystems. See SSH - Tech Corner - Cryptographic Algorithms for an excellent introduction.

Breaking cipher refers to finding a property (or fault) in the design or implementation of the cipher that reduces the number of keys required in a brute force attack (that is, simply trying every possible key until the correct one is found). For example, assume that a symmetric cipher implementation uses a key length of 128 bits: this means that a brute force attack needs to try up to all 2^128 possible combinations to convert the ciphertext into plaintext, which is way too much for the current and foreseeable future computers or computer farms. However, a cryptanalysis of the cipher with 16 bit key allow the plaintext to be found in 2^16 rounds, which is feasible.

There are several classic techniques for performing cryptanalysis, depending on what level of access the cryptanalyst has to the plaintext, ciphertext, secret key or other aspects of the cryptosystem. Below are some of the most common types of attacks:

  1. Known-plaintext analysis: With this procedure, the cryptanalyst has knowledge of a portion of the plaintext from the ciphertext. Using this information, the cryptanalyst attempts to deduce the key used to produce the ciphertext. The famous brute force is essentially a know-plaintext attack although it can be extended to ciphertext-only attacks by using heuristics for detecting the plaintext. 
  2. Chosen-plaintext analysis (also known as differential cryptanalysis): The cryptanalyst is able to have any plaintext encrypted with a key and obtain the resulting ciphertext, but the key itself is not known. The cryptanalyst attempts to deduce the key by comparing the entire ciphertext with the original plaintext. Older RSA algorithms has been shown to be somewhat vulnerable to this type of analysis.
  3. Ciphertext-only analysis: here we need to work only from the ciphertext. This requires accurate guesswork about the style of the document and how a message could be worded. It helps to know as much as possible about the subject of the message. It its extreme such knowledge might bring this case closer to known plaintext analysis.

A known plaintext attack vs. a chosen-plaintext attack

In addition to the above, other techniques are available. Even more important, the boundaries between a ciphertext-only attack, a known plaintext attack, and a chosen-plaintext attack are not necessarily rigid in practice. One of the techniques used to mount a ciphertext-only attack on a message is the probable word method, where a guess about possible plaintext is tried as a hypothesis. This was how Enigma messages were decrypted despite the fact that Enigma was a very secure stream cipher machine of its time. So in this case human negligence and excessive bureaucracy of reports (standard header and hooter were used by Germans) was successfully exploited by British.  This trick, in effect, at the cost of some wrong guesses and additional trials, turns the ciphertext-only case into the known plaintext case. In case of Enigma, the guessed plain text of the intercepted cipher message was called a crib. 

In 1939-40 Alan Turing and another Cambridge mathematician, Gordon Welchman, designed the most famous deciphering machine of all times, the British Bombe. The basic property of the Bombe was that it could break any Enigma-enciphered message, provided that the hardware of the Enigma was known and that a plain-text 'crib' of about 20 letters could be guessed accurately.

Similarly, if a sufficient amount of known plaintext is available, that quantity will include plaintexts with different properties, including some that are desirable to the cryptanalyst; hence, at least in extreme cases, the known plaintext case blurs into the chosen-plaintext case.

Compression of the plaintext text with salt and no standard headers before encryption destroys the notion of the plaintext and this makes braking the cipher more difficult, or even impossible and "known plaintext notion is no longer valid. 

Compression of the plaintext text with salt and no standard headers before encryption destroys the notion of the plaintext and this makes braking the cipher more difficult, or even impossible and "known plaintext notion is no longer valid. 

Making plaintext fuzzy as a defense from decryption

It is important to understand that plaintext should not necessarily represent just the message you need to transmit. Very important way of increasing security of messages is adding random noise or changing the language in which the message is written or the alphabet used (for example, using digrams instead of a regular letters this increasing the size of the alphabet dramatically) 

Using mixture of two languages, or alphabets (for example Latin+Cyrillic) you weaken statistical properties of the text which is an important way to increasing message security. One important weakness of German communication during WW2 was formal structure of messages which should be avoided at all costs. Compression is perfect way to file and formal structure and should be the the  standard preprocessing technique in such cases.

Transformation of text before encryption is another was to make ciphertext less "breakable".  There are several major text transformation methods:

Compression as a cheap method of increasing the difficulty of decryption

The cryptanalysis of single-key cryptosystems depends on one simple fact - that some traces of the original structure of the plaintext may be preserved or somehow reflected in the ciphertext. For example, in a monoalphabetic substitution cipher where each letter in the plaintext is replaced by a letter in the ciphertext which is the same each time, a simple statistical analysis of a sizeable portion of ciphertext can be used to retrieve most of the plaintext due to the difference in frequencies of letters in the natural languages. That's why block ciphers are generally preferable.

Compression is a classic method of defeating cryptanalysis by statistical properties of the text.  When using standard compression algorithms, you need to add salt and rearrange the parts of compressed text before applying cipher (to avoid compressed text starting with the header. for example zip file header).

But the beauty of compression is that you can use non-standard algorithms based on some classic published dictionary. In this case words are replaced to indexes to this dictionary and then standard compression  algorithm  is applied to sequences of numbers.

By destroying the notion of plaintext compression dramatically increases the strength of even weak ciphers making them close tot he strangth of one-time pad

Using a different, or multiple alphabets

Instead of standard alphabet you can use codes for digrams, as number of digrams in a natural language is pretty limited.  In this case the text will have difference statistical properties.

Another simple trick is doubling of alphabet happens when, for example, you transliterate odd words or sentences Russian in Latin. In this case a same latter (say "a") is represented by two symbols instead of one in plain text submitted to the crypto algorithm.


Striping involved splitting the text into stripes (for example each n-th character method produces n stripes) and then encoding each stripe separately, possibly using a different key. Striping reduces the effective length of the ciphertext and distorts statistical properties of the plaintext that are present and thus makes cryptanalysis a lot more difficult.  But again in most cases compression is so effective in obscuring plaintext that the need for other methods became much less.

Inclusion of noise

Deliberate inclusion of noise in the plain text is very effective method of distorting statistical properties of the text. Also gibberish at the beginning and end of  plaintext makes detection of the start of plaintext more difficult and is a simple and effective way to defeat attempts to get "know plaintext" at the beginning due to the nature of header and footer in a given communication.  

Here is a nice illustration of the classic striping technique with  the "plaintext" consisting of each second (odd) line that is obfuscated by "noise" in even lines.

Jokes Magazine

Employee Review January 25, 2000

My boss asked me for a letter describing my partner Bob Smith, and this is what I wrote:

Bob Smith, my assistant programmer, can always be found

hard at work in his cubicle. Bob works independently, without

wasting company time talking to colleagues. Bob never

thinks twice about assisting fellow employees, and he always

finishes given assignments on time. Often Bob takes extended

measures to complete his work, sometimes skipping

coffee breaks. Bob is a dedicated individual who has absolutely no

vanity in spite of his high accomplishments and profound

knowledge in his field. I firmly believe that Bob can

be classed as a high-caliber employee, the type which cannot

be dispensed with. Consequently, I duly recommend that Bob

be promoted to executive management, and a proposal will

be executed as soon as possible.

S.D. - Project Leader

Shortly afterward I sent the following follow-up note: That bastard Bob was reading over my shoulder while I wrote the report sent to you earlier today. Kindly read only the odd numbered lines (1, 3, 5, etc.) for my true assessment. Regards,

This actually also can be viewed as an example of Steganography so steganography methods are applicable here. 

Battle of brains

Successful cryptanalysis is a combination of mathematics, inquisitiveness, intuition, persistence, powerful computing resources, availble human interlligence data against  the adversary - and more often than many would like to admit - luck. It's often a strictly  government's three letter agencies game: enormous resources and long term focus are usually required. Breaking of the German Enigma code during WWII, for example, was probably the most famous of such cases. Venona project  is most probably (at least partially ) is PR attack as much information about it is very contradictory.

Today, cryptanalysis is practiced by a wider range of organizations that includes companies developing security products, etc. It is this constant battle between cryptographers trying to secure information and cryptanalysts trying to break cryptosystems and invent approaches that moves the cryptology forward. My impression is that cryptographers are now in much better position then ever before to defeat attempts of cryptanalysts to break their ciphers.

The reader needs to be very careful in judging the security of algorithms. IMHO weak keys problem is especially important, much more so than resistance to differential crypto attacks -- the currently fashionable area. One needs to understand that people are probably is the weakest link and many attacks were possible because of poor selection of keys or other blunders (Enigma).

But with a good (or even decent) cipher even in this case you need a genius working on the problem (Alan Turing) and huge resources (those of UK government) to succeed. Having spies in the enemy camp does not hurt either.

Generally attacks on well-studied crypto algorithms are very difficult and in this sense popular papers often distort the truth hinting that if algorithms contain a particular weakness it is easy to break it. Not true.

Moreover even a slight variation of the classic scheme of application of a cipher (one secret key to a monolithic non-distorted plaintext) completely changes the rules of the game and may substantial increase the security of even a very simple algorithm. That means that restrictions of exporting of a product that contain cryptographic algorithms are not as effective as one can think.

For example if the key is artificially limited to say 56 bits to make brute-force attack possible there are still multiple cheap ways to foil such attempts. The compression of ciphertext before applying DES (with rearranging of header and tail to avoid exploitation of standard header for archives like zip) makes this weak cipher by-and-large unbreakable for a very simple reason -- you no longer can easily guess what the unencrypted plaintext looks like.  

Attacks on DES

Many software and hardware systems are using DES and there are multiple suspicions that a regular DES can be broken by state players (which actually never operate without a layer of human intelligence to guide the decoding efforts). As of 2012 for private players DES is still probably a challenge.

Please note that brute force attack on plain vanilla DES is not an easy task and the cost of specialized computer is substantial (one million dollars in 1998, probably around $100K now). As RSA FAQ states:

No easy attack on DES has been discovered, despite the efforts of researchers over many years. The obvious method of attack is a brute-force exhaustive search of the key space; this process takes 255 steps on average. Early on, it was suggested [DH77] that a rich and powerful enemy could build a special-purpose computer capable of breaking DES by exhaustive search in a reasonable amount of time. Later, Hellman [Hel80] showed a time-memory tradeoff that allows improvement over exhaustive search if memory space is plentiful. These ideas fostered doubts about the security of DES. There were also accusations the NSA (see Question 6.2.2) had intentionally weakened DES. Despite these suspicions, no feasible way to break DES faster than exhaustive search (see Question 2.4.3) has been discovered. The cost of a specialized computer to perform exhaustive search (requiring 3.5 hours on average) has been estimated by Wiener at one million dollars [Wie94]. This estimate was recently updated by Wiener [Wie98] to give an average time of 35 minutes for the same cost machine.

The first attack on DES that is better than exhaustive search in terms of computational requirements was announced by Biham and Shamir [BS93a] using a new technique known as differential cryptanalysis (see Question 2.4.5). This attack requires the encryption of 247 chosen plaintexts (see Question 2.4.2); that is, the plaintexts are chosen by the attacker. Although it is a theoretical breakthrough, this attack is not practical because of both the large data requirements and the difficulty of mounting a chosen plaintext attack. Biham and Shamir have stated they consider DES secure.

More recently Matsui [Mat94] has developed another attack, known as linear cryptanalysis (see Question 2.4.5). By means of this method, a DES key can be recovered by the analysis of 243 known plaintexts. The first experimental cryptanalysis of DES, based on Matsui's discovery, was successfully achieved in an attack requiring 50 days on 12 HP 9735 workstations. Clearly, this attack is still impractical.

Most recently, a DES cracking machine was used to recover a DES key in 22 hours; see Question 2.4.4. The consensus of the cryptographic community is that DES is not secure, simply because 56 bit keys are vulnerable to exhaustive search. In fact, DES is no longer allowed for U.S. government use; triple-DES (see Question 3.2.6) is the encryption standard until AES (see Section 3.3) is ready for general use.

With minor additional pre-processing it's not that easy to break even very weak ciphers, algorithms that are often dismissed by a popular press as insecure.  This is even more true about DES. Let's assume that it is incorporated into some hardware of black-box program and you need to enhance the security of the communication. You can use one (or combination) of the following very simple methods 

  1. Triple DES. To use the two additional rounds of software DES encryption converting DES into Triple DES.
  2. Bijective Huffman encoding. Preprocess the plaintext with, say, bijective Huffman encoding. This is probably the most logical way to enhance the strength of stream ciphers. What you lose in speed of encoding you get back in speed of transmission. Moreover any type of compression  effectively shorten the message and this increases the ratio length of plaintext/length of  the password. 

  3. Use a salt for each block. The second simple way that is the most logical for block ciphers like DES is to add a random first byte to each block (salt) to invalidate "chosen plaintext" attacks. During the decryption those first bytes can be easily discarded at almost no computational cost. The only penalty is a slight increase of the length of the ciphertext (1/8 or ~12% for 64 bit blocks).  This method is used to encode Unix passwords.
  4. Block-length-based striping. The other possibility for clock ciphers is to use block-length-based striping (eight way striping for DES) with the simple transposition of each stripe as the extension of the secret key (random letters should be added to the stripes to make the length mod 8. In this case the content of each block depends on the plaintext. 
  5. Limit usage of the key, changing the key each N bytes. Yet another method is to use for each text block on N bytes a new key generated by pseudorandom generator with the actual key acting as the seed.  This way by knowing the initial key, pseudorandom generator and the value of N are two additional elements of the secret key. This way still provide an easy way to recover the message even if some part of the  messages was lost. That also to a large extent invalidates "chosen plaintext" attacks.

This is just random thoughts and there are definitely other simple ways to enhance any well studied cipher like DES or GOST.  The area is definitely more complex and I am not a specialist in this area, but still the level of hype and distortions is enough to raise red flags even for me.

My impression is that even in best case brute force attacks on DES are mostly impractical. So "other" methods are typically used. An infection of computers with a sniffing Trojan recently became the method of choice for three letter agencies who want to get access to secret documents. See discussion of Trojans (Duqu,  Flame ) that were detected in attacks on Iran enrichment activities as an example of methods used.  

Limiting the length of plaintext encrypted with a single key

As many attacks depend on the length of cyphertext encrypted with a single key, generally the length of encrypted plaintext with a given key should be limited. That dictates the necessity of some formal method of generating  sequence of "good" keys.  

Did availability of computers shifted the balance between encryption specialists and cryptanalysis specialists

All-in all I feel that the availability of powerful computers radically changed this field not in favor of cryptanalysis specialists, but in favor of those who want the protect the text from decryption. Such methods like compression, steganography, new types of one-time pads, code-length manipulation (with Huffman encoding the length of the letter became a variable) generally favor the defender not the attacker of the encrypted text.  All these methods provides a lot of interesting opportunities and IMHO can significantly enhance the level of security of ciphers used. Unfortunately those areas are usually ignored in the traditional cryptography textbooks.

I would like to reiterate my impression that with the current level of sophistication of  crypto algorithms, the chances that a particular message will be decrypted are very small and outside of well known three letter agencies are minimal even with ciphers that are considered "weak" (e.g. DES).  All discussions of a weaknesses of DES assume that it is a single level of defense and that the party involved does not understand the limitations of the technology used. The reality is more complex and it is more realistic to assume that in all practical cases the relative weakness of DES with short keys (as for example implemented in export version of Lotus Notes) is known to both parties. 

Computers raised the profile of steganography

And it might well be that further progress can be achieved not by a creating a stronger cipher, but by using new capabilities provided by computers including but not limited to striping (multiple pipelines encoding), compression, steganography (with adding noise as the simplest form)

While compression of the plaintext (with its rearranging to hide the prefix of compressed file if standard compressing utilities like zip are used) is the most simple and effective method to increase the strength of the cipher, steganography generally allows to avoid using cipher at all.

It is very attractive method when the length of  the transmitted text is not critical and can be at least doubled. The simplest examples include:

Bijective Huffman encoding

Please note that while compression is a powerful method to increase the security of the messages the usage of of-the-shelf compression utilities is a mixed blessing: they reduce the overall redundancy of the text, but they often put a predictable header at the beginning of the compressed stream, which facilitates known-plaintext attacks. That problem can be solved by several different methods and on several different levels, but even a simplest communication device now contains enough memory and CPU power to use bijective Huffman encoding that was designed to nullify this disadvantage. For more information, see

It has been argued that the prevention of brute force attacks is actually one of the purposes of compression. As for chosen plaintext attacks compression does not add much: you can always compress the chosen plaintext and compare results not with known plaintext but with the compressed encoding. But the limitation is that all plaintext needs to be known, partial knowledge is problematic and applies only to initial bytes of the message as compressed image of  "internal text" depends on previous context. Also compression can be based not on bytes but on larger entities for example digrams. Another classic defense is replacing any frequently used word with randomly chosen from a set of languages or (for articles) a random letter combinations that does not occur in a given natural language and due to this can be automatically eliminated.  In the paper Compression and Security the author aptly summarized the advantages of this method:

It has long been appreciated that there are advantages to eliminating regularities in the plaintext before encrypting.

The primary advantages to doing this are:

The advantage of the first point should be obvious enough: the less data the enemy has to analyze, the fewer clues the have about the internal state of your cipher, and thus its key. The advantage of the second point is that it hinders cryptanalytic attacks. "Fewer redundancies and regularities" may be translated into more formal terms as "greater entropy per bit". The more closely the statistical properties of the file approach that of a random data stream, the fewer regularities the cryptanalyst has to go on. All this should be uncontroversial.

That compression aids encryption was realized by those who first employed "code-words" in their ciphers. By replacing frequently-used words like "the" and "and" with otherwise little-used symbols before encrypting they succeeded in reducing the volume of the text based on known regularities in the English language. This type of cipher was employed, for example, by Mary Queen of Scots.

That eliminating patterns in the frequency of the occurrence of particular symbols in the text before enciphering is desirable was clearly realized by the time homophones were employed in conjunction with mono alphabetic-substitution ciphers.

Dr. Nikolai Bezroukov

Top Visited
Past week
Past month


Old News ;-)

Cryptology ePrint Archive Complete Contents

2002/185 ( PDF )
Turing, a fast stream cipher
Greg Rose and Philip Hawkes
2002/182 ( PS PS.GZ )
Oblivious Keyword Search
Wakaha Ogata and Kaoru Kurosawa
2002/142 ( PDF )
On the Applicability of Distinguishing Attacks Against Stream Ciphers
Greg Rose and Philip Hawkes
2002/131 ( PS PS.GZ PDF )
An Improved Pseudorandom Generator Based on Hardness of Factoring
Nenad Dedic and Leonid Reyzin and Salil Vadhan

AES Home Page

Cryptography Technology

Since graduating in theoretical physics and electrical engineering some 30+ years ago I have had an interest in cryptography and this has developed with the advent of progressively more powerful home computers. In recent years I have played with a number of algorithms where I have taken a particular interest in the techniques involved in making algorithms go as fast as possible.

The Rijndael Page -- new standard cypher.

The Limits of Cryptanalysis

Classical Cryptography Course (Lanaki)

CSE207C Lattices in Cryptography and Cryptanalysis

Cryptanalysis of CipherSaber-1

Cryptanalysis of Contents Scrambling System

Links to papers about cryptanalysis of block ciphers

FM 34-40-2 Basic Cryptanalysis

Cryptography, Encryption and Stenography

Springer LINK Lecture Notes in Computer Science 2133

Public-Key Crypto-systems Using Symmetric-Key Crypto-algorithms

Bruce Christianson, Bruno Crispo, and James A. Malcolm

Abstract. The prospect of quantum computing makes it timely to consider the future of public-key crypto-systems. Both factorization and discrete logarithm correspond to a single quantum measurement, upon a superposition of candidate keys transformed into the fourier domain. Accordingly, both these problems can be solved by a quantum computer in a time essentially proportional to the bit-length of the modulus, a speed-up of exponential order.

At first sight, the resulting collapse of asymmetric-key crypto-algorithms seems to herald the doom of public-key crypto-systems. However for most security services, asymmetric-key crypto-algorithms actually offer relatively little practical advantage over symmetric-key algorithms. Most of the differences popularly attributed to the choice of crypto-algorithm actually result from subtle changes in assumptions about hardware or domain management.

In fact it is straightforward to see that symmetric-key algorithms can be embodied into tamper-proof hardware in such a way as to provide equivalent function to a public-key crypto-system, but the assumption that physical tampering never occurs is too strong for practical purposes. Our aim here is to build a system which relies merely upon tamper-evident hardware, but which maintains the property that users who abuse their cryptographic modules through malice or stupidity harm only themselves, and those others who have explicitly trusted them.

LNCS 2133, p. 182 ff.

Full article in PDF (35 KB)

AES and Beyond- The IETF and Strong Crypto Nortel slides about some crypto issues in networking. Pretty basic, but still useful.

Crypto Scientists Crack Prime Problem

Recently, a group of Indian scientists made news by announcing an algorithm that appears to be able to tell quickly whether a number is prime or not.

If you're mathematically minded, the actual downloadable primality.pdf is worth reading.

So what does this actually mean for cryptography? First, a little background.

Many of the popular common crypto algorithms work because of "something to do with prime numbers". Most security books are about that vague. So math research about primes could have interesting effects on our field. But is being able to determine whether a number is prime quickly going to be able to help or hinder us? Let's look at the RSA algorithm as an illustrative example. (It lost its patent a few years back, so it's okay to discuss now.)

... ... ...

Public key crypto algorithms such as RSA depend on there being two keys used to encrypt and decrypt a message. (Hence, the "generate a key pair" step you see when setting up many applications that use cryptography.) Every user has a complimentary set made up of a private key and a public key. Anything encrypted with the private key can be decrypted with the public key, and anything encrypted with the public key can be decrypted with the private key. Only you should have a copy of your private key, but anyone can have your public key because it's, well, public. If someone encrypts traffic with your public key, it doesn't matter to you because only you can decrypt it.

So, you're probably thinking, if I have a message to send to Jane, I want to encrypt it. I can't encrypt it with my public key, because she doesn't have my private key to decrypt it. So I'll encrypt it with my private key, and she can decrypt it with my public key. Right? Not quite, but this is a really common mistake. Sure, Jane can decrypt the message with your public key. But so can anyone else. What you need to do is encrypt the message with Jane's public key, so that only Jane's private key (which only Jane should have) can decrypt it.

So, the RSA algorithm says this:

8 and 9 are relatively prime. When broken down as much as possible,

8 = 2 x 2 x 2
9 = 3 x 3

Nothing in common.

8 and 20 are not relatively prime.

8 = 2 x 2 x 2
20 = 2 x 2 x 5

They have 2 in common, so they're not relatively prime.

If E and D are chosen correctly, then let's make C the ciphertext and P the plaintext.

C = M to the E power mod N
M = C to the D power mod N

So, something encrypted with N and E (the public key) can be solved for M -- decrypted into the plaintext. Something encrypted with N and D (the private key) can be solved for the ciphertext C. And since E and D fit together in a defined mathematical relationship as above, you cannot automatically deduce one from the other, but can encrypt and decrypt. The beauty of the modulus is that it's a one way operation. You know what the remainder is, but you'll have to try brute-forcing it to figure out whether it's C multiplied by one with a remainder of three, by two with a remainder of three... by forty thousand with a remainder of three... [grin] That takes a lot of time.

If you want to see an example of this worked out with numbers, there's a clear one at

So, back to our original point. Being able to quickly determine whether a number is prime -- what effect does that have on all this? Well, one of the weakest points about RSA and other public key algorithms is that their large prime numbers are only probably prime. It's really hard to tell whether a number with eight zillion digits is actually prime or not -- you have to try dividing it by every prime number up to half of its value or so. That's very time consuming. Since those of us that use PGP, etc., don't want to wait too long for our keys to be generated, the RSA algorithm picks values for P and Q that are very likely to be prime, but that's not known for certain.

If those numbers aren't actually prime, then there may be different solutions for the equations other than the ones that are supposed to work. So, someone might be able to decrypt a message without having the matching key -- they'd just need a matching key, if there were more than one. (That's what could happen if P and Q aren't prime.) If the new algorithm can determine whether P and Q are really prime and they're not for a given key pair, that could lead to a weakness in RSA. But if that's the case, RSA and other algorithm authors could modify their software to use the new algorithm to ensure that P and Q really are prime, and that would defeat that sort of attack.

There's a lot of sound and fury at the moment about this article, and many people are freaking out about it, but I don't think it's anything to worry about. Mathematicians haven't fully satisfied themselves yet that it's a good tester for primes -- I don't think we'll be seeing exploit code in the near future.

Lectures for Computer Security

These lectures contain the base introductory material used for this course. After these lectures, the student will be familiar with the underlying concepts of advanced operating systems.

Crypto Lectures

Information on cryptography useful collection of links:

[Oct 20, 2002] Crypto++ Library 5.0 - a Free C++ Class Library of Cryptographic Schemes

[Oct 20, 2002] Speed Comparison of Popular Crypto Algorithms

Here are speed benchmarks for some of the most popular hash algorithms and symmetric and asymmetric ciphers. All were coded in C++ or ported to C++ from C implementations, compiled with Microsoft Visual C++ 6.0 SP4 (optimize for speed, blend code generation), and ran on a Celeron 850MHz processor under Windows 2000 SP 1. Two assembly routines were used for multiple-precision addition and subtraction.

Algorithm Bytes Processed Time Taken Megabytes(2^20 bytes)/Second
CRC-32 1073741824 8.682 117.945
Adler-32 2147483648 6.970 293.831
MD2 8388608 11.276 0.709
MD5 1073741824 10.165 100.738
SHA-1 536870912 10.565 48.462
SHA-256 268435456 10.345 24.746
SHA-512 67108864 7.761 8.246
HAVAL (pass=3) 536870912 7.922 64.630
HAVAL (pass=4) 536870912 12.337 41.501
HAVAL (pass=5) 268435456 7.090 36.107
Tiger 268435456 10.325 24.794
RIPE-MD160 268435456 8.332 30.725
Panama Hash (little endian) 1073741824 7.401 138.360
Panama Hash (big endian) 1073741824 11.797 86.802
MDC/MD5 268435456 9.884 25.900
Luby-Rackoff/MD5 67108864 8.402 7.617
DES 134217728 9.945 12.871
DES-XEX3 134217728 11.716 10.925
DES-EDE3 33554432 6.740 4.748
IDEA 134217728 11.286 11.341
RC2 33554432 7.912 4.044
RC5 (r=16) 536870912 12.988 39.421
Blowfish 134217728 7.091 18.051
Diamond2 67108864 11.086 5.773
Diamond2 Lite 67108864 9.403 6.806
3-WAY 201326592 12.728 15.085
TEA 134217728 12.799 10.001
SAFER (r=8) 67108864 10.565 6.058
GOST 134217728 12.829 9.977
SHARK (r=6) 268435456 12.878 19.879
CAST-128 134217728 7.090 18.054
CAST-256 134217728 9.995 12.806
Square 268435456 7.801 32.816
SKIPJACK 67108864 12.017 5.326
RC6 268435456 7.871 32.524
MARS 268435456 8.503 30.107
Rijndael 268435456 8.442 30.325
Twofish 268435456 9.974 25.667
Serpent 134217728 10.505 12.185
ARC4 536870912 8.122 63.039
SEAL 1073741824 8.672 118.081
WAKE 1073741824 13.029 78.594
Panama Cipher (little endian) 1073741824 8.512 120.301
Panama Cipher (big endian) 536870912 7.091 72.204
Sapphire 134217728 12.868 9.947
MD5-MAC 1073741824 12.078 84.782
XMACC/MD5 1073741824 11.096 92.286
HMAC/MD5 1073741824 10.254 99.863
CBC-MAC/RC6 268435456 8.713 29.381
DMAC/RC6 268435456 8.642 29.623
BlumBlumShub 512 524288 10.766 0.046
BlumBlumShub 1024 262144 12.668 0.020
BlumBlumShub 2048 65536 8.903 0.007

[Oct 20, 2002] Cryptographic Algorithms -- discussion of several popular algorithms

[Aug 3, 2002] Useful links

O'Reilly Java Center -- News -- An Interview with Jonathan Knudsen

Java Cryptography -- Sample chapter Authentication

The first challenge of building a secure application is authentication. Let's look at some examples of authentication from everyday life:

Authentication is tremendously important in computer applications. The program or person you communicate with may be in the next room or on another continent; you have none of the usual visual or aural clues that are helpful in everyday transactions. Public key cryptography offers some powerful tools for proving identity.

In this chapter, I'll describe three cryptographic concepts that are useful for authentication:

A common feature of applications, especially custom-developed "enterprise" applications, is a login window. Users have to authenticate themselves to the application before they use it. In this chapter, we'll examine several ways to implement this with cryptography.[1] In the next section, for instance, I'll show two ways to use a message digest to avoid transmitting a password in cleartext from a client to a server. Later on, we'll use digital signatures instead of passwords.

Index of -~timtas-aes

aesutil 1.0.1 (Stable)
by Tim Tassonis - Friday, July 19th 2002 13:20 EDT

About: aesutil is a small library and command line program to encrypt or decrypt data using the Rijndael algorithm in CBC mode.

Changes: A Windows port of the commandline utility, and better option handling.

Recommended Links

Google matched content

Softpanorama Recommended

Top articles


Ten most useful resources:

  1. International Association for Cryptologic Research
  2. Cryptography Pointers by Helger Lipmaa.(Finland)
  3. Counterpane Labs Index of Crypto Papers Available Online
  4. Ronald L. Rivest Cryptography and Security
  5. Cryptography and Information Security Group (CIS Group)
  6. Cryptography Resources
  7. UCL Crypto Group
  8. NetAction's Guide to Encryption

Directories and Portals

Best metalink collections:

Associations and public organizations




Prime numbers and random number generators:


FAQs and References


***** Cryptology an excellent introduction into cryptology

***** SSH - Tech Corner - Cryptographic Algorithms a very good intro text. The best I found on the WEB.

Lecture notes on cryptography

[packet storm]. -

Counterpane Labs Self-Study Course in Block Cipher Cryptanalysis


Cryptography tutorial from Australia (Peter Gutman)


The Cryptography API, or How to Keep a Secret

Learning about Cryptography by Terry Ritter


Encryption and Security Tutorial

Certicom - Online Tutorial

Welcome to the Elliptic Curve Cryptosystem Classroom. This site provides an intuitive introduction to Elliptic Curves and how they are used to create a secure and powerful cryptosystem. The first three sections introduce and explain the properties of elliptic curves. A background understanding of abstract algebra is required, much of which can be found in the Background Algebra section. The next section describes the factor that makes elliptic curve groups suitable for a cryptosystem though the introduction of the Elliptic Curve Discrete Logarithm Problem (ECDLP). The last section brings the theory together and explains how elliptic curves and the ECDLP are applied in an encryption scheme. This classroom requires a JAVA enabled browser for the interactive elliptic curve experiments and animated examples.

Elliptic curves as algebraic/geometric entities have been studied extensively for the past 150 years, and from these studies has emerged a rich and deep theory. Elliptic curve systems as applied to cryptography were first proposed in 1985 independently by Neal Koblitz from the University of Washington, and Victor Miller, who was then at IBM, Yorktown Heights.

Many cryptosystems often require the use of algebraic groups. Elliptic curves may be used to form elliptic curve groups. A group is a set of elements with custom-defined arithmetic operations on those elements. For elliptic curve groups, these specific operations are defined geometrically. By introducing more stringent properties to the elements of a group, such as limiting the number of points on such a curve, creates an underlying field for an elliptic curve group. In this classroom, elliptic curves are first examined over real numbers in order to illustrate the geometrical properties of elliptic curve groups. Thereafter, elliptic curves groups are examined with the underlying fields of Fp (where p is a prime) and F2m (a binary representation with 2m elements).

Quantum Cryptography Tutorial

Cryptography for encryption, signatures and authentication

Cryptography -- mainly PGP related...



Recommended Papers

Number theory

Prime Numbers - University of Tennessee


Block encryption



SSH - Tech Corner - Cryptographic Algorithms

Lecture Notes

Digital Code Signing

Digital Code Signing Step-by-Step Guide

English Language Letter FRQ tables

Differential Cryptanalysis

Differential cryptanalysis is a chosen-plaintext/chosen-ciphertext cryptanalytic attack. Cryptanalysts choose pairs of plaintexts such that there is a specified difference between members of the pair. They then study the difference between the members of the corresponding pair of ciphertexts. Statistics of the plaintext pair-ciphertext pair differences can yield information about the key used in encryption. Differential cryptanalysis should be seen as mostly a "white hat" method, since such an attack would be very hard to mount in a real-world situation. But a possible weakness may allow more practical attacks in the real world. Since differential cryptanalysis became public knowlege, it has become an essential tool of cipher designers. No cipher will be taken seriously unless there is reason to believe it has strong resistance to this attack

See also Differential cryptanalysis - Wikipedia

University Courses

Crypto and Security Courses


block cipher being developed as a successor to DES. Several interesting algorithms were submitted as candidates to become AES. The selected algorithm called Rijndael (one suggested pronunciation: "rain doll"), a variant of an algorithm called Square.




See also Humor

My boss asked me for a letter describing my partner Bob Smith, and this is what I wrote:

Bob Smith, my assistant programmer, can always be found

hard at work in his cubicle. Bob works independently, without

wasting company time talking to colleagues. Bob never

thinks twice about assisting fellow employees, and he always

finishes given assignments on time. Often Bob takes extended

measures to complete his work, sometimes skipping

coffee breaks. Bob is a dedicated individual who has absolutely no

vanity in spite of his high accomplishments and profound

knowledge in his field. I firmly believe that Bob can

be classed as a high-caliber employee, the type which cannot

be dispensed with. Consequently, I duly recommend that Bob

be promoted to executive management, and a proposal will

be executed as soon as possible.

S.D. - Project Leader

Shortly afterward I sent the following follow-up note: That bastard Bob was reading over my shoulder while I wrote the report sent to you earlier today. Kindly read only the odd numbered lines (1, 3, 5, etc.) for my true assessment. Regards,


Glossary of Encryption Terms

NSA declassifies crypto algorithms

The Metaphor Is the Key: Cryptography, the Clipper Chip, and the Constitution - HTMLized version of 180 page University of Pennsylvania Law Review Article by U. Miami School of Law Prof. A. Michael Froomkin.

Cypherpunks, Cryptography & Hackers


FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available in our efforts to advance understanding of environmental, political, human rights, economic, democracy, scientific, and social justice issues, etc. We believe this constitutes a 'fair use' of any such copyrighted material as provided for in section 107 of the US Copyright Law. In accordance with Title 17 U.S.C. Section 107, the material on this site is distributed without profit exclusivly for research and educational purposes.   If you wish to use copyrighted material from this site for purposes of your own that go beyond 'fair use', you must obtain permission from the copyright owner. 

ABUSE: IPs or network segments from which we detect a stream of probes might be blocked for no less then 90 days. Multiple types of probes increase this period.  


Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy


War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotesSomerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose BierceBernard Shaw : Mark Twain Quotes


Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law


Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOSProgramming Languages History : PL/1 : Simula 67 : C : History of GCC developmentScripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-MonthHow to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least

Copyright © 1996-2016 by Dr. Nikolai Bezroukov. was created as a service to the UN Sustainable Development Networking Programme (SDNP) in the author free time. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License.

The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.

This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

You can use PayPal to make a contribution, supporting development of this site and speed up access. In case is down you can use the at


The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the author present and former employers, SDNP or any other organization the author may be associated with. We do not warrant the correctness of the information provided or its fitness for any purpose.

Last modified: March 11, 2018