Modes of Operation - Computerphile

Sdílet
Vložit
  • čas přidán 11. 06. 2024
  • You don't just 'run a cipher' - you need a mode of operation. Dr Mike Pound explains some relative to the Feistel cipher.
    *This video was filmed before any social distancing guidelines came into effect*
    EXTRA BITS: • EXTRA BITS: Feistel Mo...
    Feistel Cipher Video: • Feistel Cipher - Compu...
    Mike's code:
    github.com/mikepound/feistel
    / computerphile
    / computer_phile
    This video was filmed and edited by Sean Riley.
    Computer Science at the University of Nottingham: bit.ly/nottscomputer
    Computerphile is a sister project to Brady Haran's Numberphile. More at www.bradyharan.com

Komentáře • 232

  • @Ribby00
    @Ribby00 Před 4 lety +483

    More. Mike. Pound.

    • @ifusubtomepewdiepiewillgiv1569
      @ifusubtomepewdiepiewillgiv1569 Před 4 lety +5

      100 agree

    • @LandoCalrissiano
      @LandoCalrissiano Před 4 lety +16

      There's never enough Mike Pound.

    • @thomasre8073
      @thomasre8073 Před 3 lety +1

      someone has listened to the podcast. :)

    • @FrankHarwald
      @FrankHarwald Před 3 lety +1

      I legit read that as "More Mike Pondsmith" for a second...
      guess I've been playing to much Cyberpunk 2077

    • @MS-sv1tr
      @MS-sv1tr Před 2 lety +1

      I was gonna like your comment but it has 420 likes so I'm not allowed

  • @wandersgion4989
    @wandersgion4989 Před 4 lety +289

    I like how Dr. Pound says “woight” after explaining something.

    • @gooball2005
      @gooball2005 Před 4 lety +19

      Please refer to Tom Scott's video called "Why Jonathan Ross Can't Pronounce His Rs"

    • @mos6507
      @mos6507 Před 4 lety +2

      @@gooball2005 Seems to have become epidemic in the UK in recent times. Everyone's gonna sound like a brit Elmer Fudd eventually.

    • @marksusskind1260
      @marksusskind1260 Před 4 lety +2

      Right. Why keep do they keep the CC inactive?

    • @Jamie-st6of
      @Jamie-st6of Před 4 lety +4

      tbh i hear the "r" in "right" pretty clearly

    • @Dth091
      @Dth091 Před 4 lety +3

      @@mos6507 That and pronouncing 'th' as 'f' seems to be common too

  • @Axman6
    @Axman6 Před 4 lety +146

    “ECB, almost never” unless you’re Zoom...

    • @Axman6
      @Axman6 Před 4 lety +23

      Philipp Blum not only did they, they still do. AES-GCM is due to be released soon apparently but they have no clue when it comes to security. At least they brought on a bunch of people who do know a lot security to help them out very quickly.

    • @lawrencedoliveiro9104
      @lawrencedoliveiro9104 Před 4 lety +40

      That, and the fact that their “end-to-end” encryption wasn’t end-to-end at all, it was end-to-middle, middle-to-end.
      They were also criticized for using AES-128 instead of AES-256, but really AES-128 is fine.

    • @enochliu8316
      @enochliu8316 Před 4 lety +3

      @@PhilippBlum Now it is. Used be not.

    • @ricecake1228
      @ricecake1228 Před 4 lety +11

      Ok zoomer.

    • @whuzzzup
      @whuzzzup Před 4 lety +2

      @@enochliu8316 Skype was always encrypted end to end with them being p2p in the beginning (with caveats). When MS bought them they switched from p2p to server and also gave state perpetrators wide access to the network.

  • @wp5355
    @wp5355 Před 4 lety +87

    Excellent presentation - Mike always does a great job of explaining his ideas!!

  • @PauxloE
    @PauxloE Před 4 lety +53

    6:44 "If I'm watching a streaming movie, and I've decided the first half is pretty boring, I want to jump through, so you can't do that because you got to chug through the decryption of everything first" - Actually, while *encryption* of CBC is serial, *decryption* of CBC can be parallelized, you don't need any previously plaintext data, just the ciphertext.
    8:57 "And we don't want that weird attack where you fiddle about with ciphertext and it effects other message blocks". Counter mode (without a MAC) is even more attackable by fiddling with the cipher text. For CBC, you get one plaintext block modified (bit-flipped) exactly as you wish, and one block garbled, for CTR (as explained in 11:40) you just get all your bits flipped around (just as for any XOR stream cipher), without anything else affected - so it's a an a lot less noticeable attack. So this is not really an argument for counter mode. If you use a MAC (on the ciphertext) with CBC, it's also pretty save against those attacks. (The other arguments for counter mode are better.)

    • @BBeret
      @BBeret Před 4 lety +10

      Thanks, I had the same thoughts as I watched the video and was hoping to find a comment that would confirm them.

    • @jackawalmsley
      @jackawalmsley Před 4 lety

      Don't you still need to XOR the result of decryption with the previous block's plaintext in CBC?

    • @BBeret
      @BBeret Před 4 lety +7

      @@jackawalmsley No, you XOR it with the last ciphertext block, without having to decrypt it.

    • @jackawalmsley
      @jackawalmsley Před 4 lety

      @@BBeret ahh I didn't catch that thanks

  • @Tw0ify
    @Tw0ify Před rokem +1

    In the first f****** minute I learned more of encryption than in hours of lessons at the uni.
    Thank you Mike, you make it easy for learnes to understand the topics and what it's all about!

  • @DantalionNl
    @DantalionNl Před 4 lety +28

    Next video on Galois Fields lets go!

  • @Saiga12308
    @Saiga12308 Před 4 lety +20

    Ok, that nonce thing caught me off guard cos that's not what it means in British slang...

  • @Austin_Sky
    @Austin_Sky Před 4 lety +32

    Mike does such a clear and great job explaining cryptographic definitons! I always enjoy the videos of this field!

  • @blablubb1234
    @blablubb1234 Před 4 lety +9

    Writing a university exam about encryption on Monday. This is the perfect for a video like this 👍

  • @AJMansfield1
    @AJMansfield1 Před 4 lety +12

    Nice, I'd love a video with more detail about how this Galois counter mode works, as well as detail about the other AES modes like CFB and OFB.

  • @ganyrehs
    @ganyrehs Před 2 lety +2

    I spent a whole day reading my textbook and listening to my professor's video lecture yesterday and couldn't understand what the heck were the functions of the modes because it was all given to me without diagrams. After watching this video, it makes it simpler for me to understand! Holy smokes!

    • @CyberMachine
      @CyberMachine Před 2 lety

      Even on the internet it is addressed like this. It makes it difficult to conceptualize.

  • @IP1kachuI
    @IP1kachuI Před rokem +1

    exactly what i need for my course on network security! great as always

  • @kebman
    @kebman Před 4 lety +16

    Quote from Github: "I've paid absolutely no attention to safe memory use, cache timings etc. So it's conceivable that the cipher is vulnerable while it's running - possibly after too since it doesn't wipe the key from memory."
    Python has design issues that makes it hard to stamp those out anyway, though it's feasible to mend _some_ of those problems. In the end, the question remains: Can you trust the hardware your code is running on, and is it sufficient that some parts of the code is still visible to that hardware, or to its operating system. If those things do not pose a problem for you, then cryptography with Python is probably ok for _your_ use case. That isn't to say that it should ever be implemented in a bigger corporation, or on hardware that is exposed to the public.

  • @maomxesoax2471
    @maomxesoax2471 Před 4 lety +12

    I've been working on this today with my RCSOTP (random character set one time pad) program. Then I came on YT and saw this vid !!!! Nice one, good vid, all helps.

    • @AnoNymInvestor
      @AnoNymInvestor Před 3 lety

      Do you use it for letter or E-Mail encryption or for other applications (authentication of persons, access, messages, ...)?

    • @maomxesoax2471
      @maomxesoax2471 Před 3 lety

      @@AnoNymInvestor It can be used for all of those. The encrypted text can also be embedded into the TRGB of glyphs from special fonts that have been used to create a picture (Not at pixel level but at glyph level).

  • @user-fd9hh7wp7u
    @user-fd9hh7wp7u Před rokem

    WOW! thanks for the simplified explanations, makes it easy to understand.

  • @DrGeoxion
    @DrGeoxion Před 4 lety +9

    Ah, so it's the counter mode that LoRaWAN uses. I've implemented that protocol myself before.
    It uses some ECB code to do it. And at the time I was reading up on it what the different modes meant. I was a bit confused why LoRaWAN, generally considered a secure protocol, would use ECB. Then I found out what it was actually doing and thought it was quite smart.
    Today I've learnt that it actually has a name! Cool :D

  • @krisr3868
    @krisr3868 Před 4 lety +5

    Liked the video, and I'm looking forward to hearing about the GCM mode of operation next time. Are you going to continue after that with AEAD ciphers?

  • @eldaiblol1492
    @eldaiblol1492 Před 4 lety +2

    Please make an extra bits or so on GCM and how it works/ benefits :) Awesome video!

  • @Nors2Ka
    @Nors2Ka Před 4 lety +22

    Why in CBC can't you continue decrypting from the middle? You just take Cn+1 decrypt it and XOR it with Cn. Was there some simplification in the video?

    • @vamPierchen0
      @vamPierchen0 Před 4 lety +17

      Indeed. That as my thought as well. The video-decryption pointed out @6:45 is contradicted @7:55 where it is pointed out that only two packets are useless if one is corrupted during transmission.
      The encryption cannot be parallel, the decryption can be parallel though.

    • @Nors2Ka
      @Nors2Ka Před 4 lety +2

      @@vamPierchen0 I realized that as well. I think it was just either a wrong word or encryption sounded like decryption.

    • @arshia.sasson
      @arshia.sasson Před 4 lety +18

      Because if the recipient wants to jump ahead to the middle of the file, the sender still needs to generate the cyphertext all the way to that point

    • @Tony-cg5it
      @Tony-cg5it Před 4 lety

      Yep, it can be parallel decryption

    • @arshia.sasson
      @arshia.sasson Před 4 lety

      @@Tony-cg5it you can do the parallel decryption as described in the video, but only if the sender does the entire encryption and transmits it without error

  • @dwardo8478
    @dwardo8478 Před 2 lety

    Fantastic explanations, thank you!

  • @__mk_km__
    @__mk_km__ Před 4 lety +20

    6:44 Wait, I think CBC _decryption_ is both parallelizeable and random-access. Just decrypt the current block, and XOR it with the previous one.

    • @ninjafish1504
      @ninjafish1504 Před 4 lety

      Mk Km how is it parallelizeable if you need the result of the previous one to decrypt the current one?

    • @__mk_km__
      @__mk_km__ Před 4 lety +9

      @@ninjafish1504 You need the previous _ciphertext_ block. Unless you use another layer of encryption, these blocks are what is sent over the wire and what you have in the receive buffers. And in that case finding a previous block is just a matter of decrementing a pointer.

    • @pele7208
      @pele7208 Před 3 lety +1

      But isn't the bottleneck with the encryption? Since you have to wait for all the previous blocks to be encrypted and sent, right?

  • @Furiends
    @Furiends Před 4 lety +1

    For the counter mode once you have your keys this is running exactly like one-pad. The key size is the same as the entire message steam. But you are generating key material on the go.

  • @CrabSpy
    @CrabSpy Před 4 lety +3

    Great video! Esecially considering that it's relevant for my next exam. Also, I'd like to request a playlist for these cryptology videos as I can't seem to find an existing one.

  • @OmerBoehm
    @OmerBoehm Před 8 měsíci

    As always - brilliant explanation ;)

  • @gelred7625
    @gelred7625 Před rokem

    Great explanation! Thank you

  • @ragilmalik
    @ragilmalik Před 4 lety +10

    Amazing video! i understand absolutely nothing but your videos have been helping me to sleep since when i get confused, my brain is disoriented and everything seems impossible to do so i am able to do nothing but sleep.

  • @wojtalkex
    @wojtalkex Před 10 měsíci

    Perfect explanation

  • @AnoNymInvestor
    @AnoNymInvestor Před 3 lety +3

    I analyzed software serial numbers "protected" by AES-256 ECB. I think it took less than 15 Minutes to find the original 128-bit key. This was on a PowerPC 750 processor (Mac OS X 10.2), IIRC. Fun times. 😉

  • @jonathanswanepoel6908
    @jonathanswanepoel6908 Před 2 lety

    So engaging - Thank you!

  • @davidgillies620
    @davidgillies620 Před 4 lety +2

    Note that rolling your own code to do this is almost always a bad idea. With Galois/Counter mode the additional complexity of operating in a finite field (GF(2^128) is usually used, with a 128th-degree irreducible polynomial over that field) means that the scope for errors to creep into your code is much bigger. You're much better-off using an open source library (these can be written to make use of some new hardware CPU instruction codes specifically intended to do multiplications over finite fields).

  • @mgerber59
    @mgerber59 Před 4 lety +1

    One important detail that I missed in the video is that for CBC mode you need to include the IV (initialization vector) in the ciphertext.
    The same goes for the nonce in CTR/GCM mode; it has to be transmitted to the receiver so they can actually encrypt the message. You can just send it as plaintext, though.

    • @JivanPal
      @JivanPal Před 4 lety +5

      5:35 - *_"[The IV] is_** not **_a secret. That just gets put on the message"_* 🙂

    • @mgerber59
      @mgerber59 Před 4 lety +1

      @@JivanPal Ah alright, thanks for pointing this out. Still it's important to note the same for the nonce, which may not be 100% obvious.

    • @JivanPal
      @JivanPal Před 4 lety

      @@mgerber59, yeah, I totally agree that it could've been clarified and discussed further.

    • @randomgeocacher
      @randomgeocacher Před 4 lety +1

      Not all CBC variants include the IV in the ciphertext, if there are other protocol mechanisms. For example you can have an implicit IV derived using secrets from the protocol handshake, e.g. IV=KDF(key: master secret, label: “IV”, context: packet counter) or such.

  • @adamcone6856
    @adamcone6856 Před 3 lety +4

    I am studying for the SSCP exam I am taking in a week from now. I took Security+ and passed, but I am always confused by the block cipher modes. This video helps alot because you really explained it well while putting it into examples on paper for me. Still....while being fascinated by encryption and all the nuances of it, I am just not able to really get it because I haven't worked a day in the field. What would you say I should do to help me expand my knowledge of encryption in a way that I can actually get in real world experience? I want to eventually get a job in cybersecurity and have working knowledge and skills of doing this stuff on my own. I am in college and trying to get off of disability to return to working status. Cybersecurity is the field I have chosen to get in to when I hopefully get back to being able to work again. I am at a huge disadvantage because I haven't been able to work in the IT field for years, so I need to get practice in at home. Thanks in advance.

    • @AyushMo
      @AyushMo Před 2 lety +1

      Well how'd you fare in the exam mate? And how'd the job hunt pan out? I hope it's been fine

  • @fabiocosta4365
    @fabiocosta4365 Před 4 lety

    Amazing video!

  • @olivierbegassat851
    @olivierbegassat851 Před 4 lety

    Great video!

  • @tggasser
    @tggasser Před 3 lety

    As far as i understood, the decryption is parallelizable in CBC, as well as random read access. 6:45 Correct me if im wrong

  • @aquarium778
    @aquarium778 Před 4 lety +2

    Can you do a video on how key schedulers work?

  • @user-ej3iw8lw3w
    @user-ej3iw8lw3w Před 2 lety

    speaking of modes of operation
    MMC has two operating modes: author mode and user mode. In author mode, you can create and modify a console's design by adding or removing snap-ins and setting console options. In user mode, the console design is frozen, and you cannot change it.

  • @user46346bdtgry
    @user46346bdtgry Před 4 lety

    i have a question about the counter mode encryption.
    if the nonce+counter is not private, only single use, that means it is theoretically known to the attacker. if we also assume that the method of encryption is known to the attacker because security through obscurity is foolish, then what prevents the attacker from encrypting the nonce+counter themselves and xor'ing this key with the cyphertext to crack the message? surely the encryption system must be asymmetrical (ie rsa) to ensure that only those with a private key can encrypt. am i correct?

  • @sunday87
    @sunday87 Před 4 lety +4

    So in counter mode, if i don't even need a decryption method, couldn't I just use a a hash function to create the block key from the counter and key? What's the problem with that idea?

    • @dataminetk
      @dataminetk Před 4 lety +2

      the function used needs something secret to be secure, the nonce is public, the counter is easily calculated. an encryption function takes a secret key, a hash function does not.
      using a hash function would be trivially easy for anyone to decrypt.

    • @sunday87
      @sunday87 Před 4 lety

      @@dataminetk Yeah that is why the counter should be combined with secret key before hashing. Only with the correct key should you be able to recover the stream key for any given block.

    • @dataminetk
      @dataminetk Před 4 lety +4

      @@sunday87 that'd be turning the hash into a HMAC, which would be secure (I think - haven't thought on that in depth).

  • @Yupppi
    @Yupppi Před 3 lety

    How do you transfer the key or iv or whatever securely when they can't yet open the encryption?

  • @TechMetalPenguin
    @TechMetalPenguin Před 2 lety

    I have the exact same arm-armpit tic as Dr. Pound, and each time I watch one of his videos I have to do my best not to inadvertently imitate him 🤣

  • @nihonam
    @nihonam Před 4 lety

    Watching this videos the question does not leave me alone: is it usual practice of all computer science faculties to use line printers paper for explaining ideas. When I was a student here in Moscow our professor who taught programming course did just the same. And I've been wonder if there is lack of usual A4 paper in our University or there is excess of line printer paper here.

  • @Yvtq8K3n
    @Yvtq8K3n Před 4 lety +1

    I love this man

  • @birzhanamirov8715
    @birzhanamirov8715 Před 3 měsíci

    6:43 Isn't CBC decryption of a block possible with just ciphertext from the previous block (and encryption key ofc)? In that's the case, why can you jump to the middle of that movie without decrypting everything in between?

  • @AttitudeGames
    @AttitudeGames Před 4 lety

    The thing is AES CTR is AES ECB but used in a different way like you encrypt NONCE (32bits) + IV (64bits) + COUNTER (32bits) and you then XOR each block of 128bits and then increment COUNTER after each block.
    So ECB is CTR but used a different way.
    But yeah I agree that there is no way to detect any bits being changed, unless you use something like HMAC-SHA etc, but that increases your data size.

  • @reynaudkwit131
    @reynaudkwit131 Před 3 měsíci

    quite helpful!

  • @yassertoor
    @yassertoor Před rokem

    I am confused why the CBC mode can't be parallelized during decryption?

  • @nirki
    @nirki Před rokem

    So in counter mode. Is there even a reason to use AES? We are not decrypting at all, can't we just do something with the nounce and key and put it to SHA256? I'm assuming SHA256 is faster and even harder to recover the key

  • @user-kw9cu
    @user-kw9cu Před 4 lety +1

    Mike looks so serious on this thumbnail

  • @PvblivsAelivs
    @PvblivsAelivs Před 4 lety +1

    Cipher block chaining has the weakness that you can manipulate individual bits in a controlled manner. So you switch to counter mode, which has this weakness on steroids. It seems more effective to use Electronic Codebook, but make a trivial modification to input blocks to make repeats less likely. Instead of encrypting the counter, XOR the plaintext with the counter before encrypting.

    • @RedwoodRhiadra
      @RedwoodRhiadra Před 4 lety

      Flipping bits of the ciphertext in counter mode affects decrypting *only those bits.* Whereas flipping bits in ECB or CBC mode affects decryption of the entire block or that *and* the next block.

    • @softwarelivre2389
      @softwarelivre2389 Před 2 lety

      Then you have another problem: on EBC with a plaintext-XORed counter, if you get the same cyphertext twice, you know they are equal by an offset, which is the distance between the blocks. So the ideal is to use the counter twice: one for XORing your plaintext data, and other which gets encrypted and XORed with the cyphertext, which solves those problems quite nicely.

  • @yorickdewid
    @yorickdewid Před 4 lety +5

    There is another problem with counter mode based operations and that's the maximum message size. The counter will flip at some point

    • @RedwoodRhiadra
      @RedwoodRhiadra Před 4 lety

      How many messages are 2^128 bits long... Total computer storage of the world is expected to be 175 zettabytes by 2025, which works out to about 2^80 bits if I did my math correctly. (log(10^21 * 175 * 8) / log(2))

    • @yorickdewid
      @yorickdewid Před 4 lety

      @@RedwoodRhiadra why should the counter be 2^128? More often 32 or 64 bits and the problem with 32 bits is self explanatory

    • @ondrejkarbas7287
      @ondrejkarbas7287 Před 4 lety

      I suppose he was refering to the fact that they are non-reusable, so after sending many messages, the counter will be the same as for the first one. I don't see that as a real problem either though.

    • @PauxloE
      @PauxloE Před 4 lety +1

      @@yorickdewid If you are using a too short counter, that's an implementation problem, not a problem with the mode. The mode itself allows 2^128 different input values (for each key) before you get conflicts, so you can encrypt up to 2^128 blocks with the same key - either in one really large message, or as multiple smaller messages. (And with CBC, you should only use it for ~2^64 blocks, before you get a high probability of repeated ciphertext blocks).

    • @RedwoodRhiadra
      @RedwoodRhiadra Před 4 lety

      @@yorickdewid Assuming a 128-bit block, you need the input to be 128 bits if you don't want to pad it.

  • @ChaCha26
    @ChaCha26 Před 4 lety +1

    Helloooo anyone gonna mention that we just got delivered the first 4K Computerphile video ? today can't be a bad day not matter what.

    • @Computerphile
      @Computerphile  Před 4 lety +1

      Aside from the current remote videos Computerphile has been 4k since Jan 2017 :) HTH >Sean

    • @ChaCha26
      @ChaCha26 Před 4 lety +2

      @@Computerphile That's odd, the max quality for me on those videos is 1080p, maybe part of the pandemic related measures from CZcams to limit data flow. Thank you for the awesome content as always!

  • @adammercer9679
    @adammercer9679 Před 4 lety

    Is the initial vector similar to a salt that you'd use with a hash before you put it through a hashing algorithm?

    • @rlamacraft
      @rlamacraft Před 4 lety

      Adam Mercer It’s a very similar idea, yeah. Neither need be secret, though the attacks they’re defending against are slightly different

  • @kyrond
    @kyrond Před 4 lety

    Why not XOR the counter before encryption? It would no longer be vulnerable to bit flip attacks, and would have all the positives, am I wrong?

    • @BBeret
      @BBeret Před 4 lety

      Then you would get a problem almost as bad as with ECB: Say you have two plaintext blocks that differ in just one bit, and their respective counters also differ in that same bit. Then the XOR cancels the bits out, two copies of the same block get encrypted, and you get two ciphertext blocks that are exactly the same.

  • @aperson6187
    @aperson6187 Před 4 lety +9

    Where is the camera that it looking over his shoulder? I feel like i should be able to see it :)

    • @Computerphile
      @Computerphile  Před 4 lety +20

      I seem to remember I used a sucker and stuck it at the top of Mike's whiteboard :) >Sean

    • @aperson6187
      @aperson6187 Před 4 lety +1

      @@Computerphile ha ha, i was thinking that hanging it from the roof seemed a bit much! I didn't think of a suction cup!

  • @Eletronicafg
    @Eletronicafg Před 4 lety

    Using counting mode doesn't require implementing decryption at the cipher level. It made me think that using this techinique we can implement a symetric encryption algorithm using a secure hash function such as SHA256 or SHA512 and using the counter initializer as the key.
    It would work like this:
    - Apply a random salt to the user supplied password and take the hash of the result (save the salt);
    - Use this hash as the counter's initial value and increment it for each block;
    - Take the hash of the counter for each block;
    - XOR the input message with the resulted hash of each block.
    My question is: Is this secure?

    • @JohnDoe-td2qf
      @JohnDoe-td2qf Před 4 lety

      Where would you store the salt? At the beginning of the cipher text?
      I don't know about secure, but it's not nearly as bad as the other suggestions in the comments about using a hash algorithm. The IV/nonce/counter is supposed to be public. A better scheme would be to use an hmac (keyed hash function) as your irreversible function, and put the IV as is at the beginning of your cipher text (where it belongs).

  • @ivahardy4885
    @ivahardy4885 Před 4 lety

    But where does mike get those jumpers from?

  • @ddaauuvviidd
    @ddaauuvviidd Před 4 lety +1

    Would be awesome to know what how random in a computer actually works. Can it be broken?

    • @Demonslay335
      @Demonslay335 Před 4 lety +1

      Depends on the algorithm. In most cases, short answer is yes. But there's tons of factors.

  • @Mythilt
    @Mythilt Před 4 lety

    What about just prepending each message with a simple salt header of unknown size? e.g. message is length 120-127 bytes in length, gets pre-pended with a header that's first byte is a 4 bit header length value, 4 bit random, and then 1-7 bytes of random data. That means all encrypted messages are dissimilar, and can be decrypted independently.

    • @BBeret
      @BBeret Před 4 lety

      @@henrikoldcorn You are confusing 7 bytes with 7 bits.

  • @ericsbuds
    @ericsbuds Před 4 lety

    fantastic

  • @linternetsansfil4152
    @linternetsansfil4152 Před 4 lety

    I found a method for remembering less passwords : if you can remember n strings, you can create n - 1 + n - 2 + ... + 1 passwords by combining a diferent pair of strings for each passwords. for exemple if you can remember 4 strings, you have 6 passwords :
    s0 = cat
    s1 = dog
    s2 = tortoise
    s3 = fly
    p0 = catdog
    p1 = cattortoise
    p2 = catfly
    p3 = dogtortoise
    p4 = dogfly
    p5 = tortoisefly
    (dont use those strings but you get the idea) and if you have 5 strings, you have 10 passwords, 6 = 15, 7 = 21, 8 = 28, 9 = 37... Each password either countains half of the infomation of half of the other passwords or no information. It is also possible to use a combination of more than tow strings to create more passwords with the same amount of strings.
    What do you thin about that ?

  • @madblah4158
    @madblah4158 Před 4 lety

    Could you explain zero cleare malware and how it works?

  • @Elite7555
    @Elite7555 Před 3 lety

    11:45 But doesn't CBC and ECB also need message authentication? And obviously CTR needs to produces a lot more authentication tags than CBC.

  • @MachtFisch
    @MachtFisch Před 4 lety

    12:32 so with counter mode you don't even need to stick to reversible encryption and could use irreversible methods e.g. hashing as well?

    • @JohnDoe-td2qf
      @JohnDoe-td2qf Před 4 lety +1

      Yes but... you need to use keyed hashing otherwise it's trivial to decrypt since the input to the encrypted blocks IS the IV/counter/nonce. Lookup "hmac" it's a method for hashing with a key.

  • @Denverse
    @Denverse Před 4 lety

    I literally just received a mail saying computerphile just uploaded a video with title "Modes of Operation", I definitely knew it is by Dr. Mike Pound and here I am.

  • @hayden.A0
    @hayden.A0 Před 4 lety

    I still don't understand the last part, if the nonce is not secret can't it be used by an attacker since the encryption algorithm is also known?

    • @JivanPal
      @JivanPal Před 4 lety

      Everybody knows the encryption algorithm, but not everybody knows the specific key used to encrypt a particular message. That is, everybody knows _E_ in terms of some generic key _k,_ but the specific _k_ we use should be a secret, so that not everybody knows the specific _Ek_ that is used to encrypt our message.
      If the encryption function itself is secure (e.g. because the key space is sufficiently large and cannot be brute-forced), then decrypting the ciphertext into _M_ ⊕ _IV_ is not feasible unless the key is known. As such, it does not matter if _IV_ is publicly known, since it is only useful if decryption can be successfully performed.

  • @TylerDurden_420
    @TylerDurden_420 Před 3 lety

    Please tell us about XTS mode.

  • @oneofthenorth
    @oneofthenorth Před 4 lety +2

    This is a really great video. Can I suggest that someone puts a request in to change the moniker ‘nonce’....... how has no one noticed this before?!

    • @kgm1000uk
      @kgm1000uk Před 4 lety +3

      They have. Problem is it’s uk slang and us jargon.

    • @oneofthenorth
      @oneofthenorth Před 4 lety +1

      Kevin Melling I really didn’t want to be ‘that’ guy. But this is too weird to ignore as a Brit! And the video is British, after all.

    • @WmSrite-pi8ck
      @WmSrite-pi8ck Před 4 lety

      here in the US, where almost all things cultural are hijacked, the word has no pejorative value. it's just a word.

    • @cannaroe1213
      @cannaroe1213 Před 4 lety

      For a very long time Carbon Nanotube science was all about detecting and enriching for CNTs.
      To be honest, it's digital perl-clutching isn't it. nonce derives from "N" (any number) + "once".

  • @forty_tu
    @forty_tu Před 8 měsíci

    At 06:44 (the example with a movie encrypted with CBC) it is stated that one cannot easily jump through the movie, because one needs to decrypt all predecessing blocks. This is incorrect. With CBC, encryption indeed cannot be parallelized, however, decryption can be parallelized very easily. One always needs only two succeeding blocks of ciphertext to get the plaintext of the second block (just decrypt the second block and xor it with the still encrypted first one).

  • @sidd065
    @sidd065 Před 4 lety +2

    Link to the Feistel Cipher video czcams.com/video/FGhj3CGxl8I/video.html

  • @tomvleeuwen
    @tomvleeuwen Před 4 lety

    13:47 With an IV of 96 bits, you can encrypt at least 2^96 blocks of information before you need to change your key (More if your messages are longer), which is much more than any data center can contain. The limit that the IV puts of the amount of messages you can encrypt with one key is thus purely theoretical, and other limits are reached much quicker, like the recommendation to only encrypt 4 GiB with one key.

    • @iabervon
      @iabervon Před 4 lety

      It could still be an issue if you use your IV space sparsely. Like if you have multiple streams in the same session and don't give enough bits to the separation between streams, or somehow run through separate streams fast enough to use up the bits allocated to that.

    • @softwarelivre2389
      @softwarelivre2389 Před 2 lety

      You're forgetting about the birthday paradox

    • @tomvleeuwen
      @tomvleeuwen Před 2 lety

      @@softwarelivre2389 If you simply increment the IV by 1 every time you use it, the birthday paradox is not applicable. With a random IV, you should indeed change it way more often.

    • @softwarelivre2389
      @softwarelivre2389 Před 2 lety

      @@tomvleeuwen yes, but then you can use the IV to count the amount of requests/encryptions, which is a data leak by itself

    • @tomvleeuwen
      @tomvleeuwen Před 2 lety

      @@softwarelivre2389 In some cases it can be, but in many cases the attacker already knows that, for example if you want to have a packet counter for replay protection that you want to check before decryption.
      Incremental IVs are very common in VPNs for example (both OpenVPN and ESP use incremental IVs for GCM). I was triggered by the words "hard limit" in the video, implying that they are all used.

  • @Jiftoo
    @Jiftoo Před 7 měsíci

    What if you just append random salt to every block and discard it after decryption?

  • @Garbaz
    @Garbaz Před 4 lety +1

    Why do we even need something like AES for counter mode? Couldn't we just have the nonce be the key and use some hash function for the "encryption"?

    • @yorickdewid
      @yorickdewid Před 4 lety +1

      Block ciphers are amongst the fastest cryptograpic operations, it just substitution and shifts. It's not uncommon to build a cryptograpic hash function from a block cipher

    • @MikelNaUsaCom
      @MikelNaUsaCom Před 4 lety

      explained at the end of the video... you need to have the key shared but secret... nonce is not secret, and has a pattern to it... incremented for each block... encryption removes that pattern.

    • @INT41O
      @INT41O Před 4 lety +2

      @@MikelNaUsaCom Garbaz is actually right, use the key instead of the nonce, and keep it secret obviously, then you can use a hash function instead of a block cipher in counter mode. Salsa20 and ChaCha20 are two stream ciphers that kind of work like that.

    • @randomgeocacher
      @randomgeocacher Před 4 lety +1

      You’d need a hash that is fast and is appropriate to be used as a keyed hash. It need to to behave as a perfect pseudo random function to someone without knowledge of the key. Hash based key derivation schemes does something similar; generates an arbitrary long array of perfectly random bits using hash operations. You should stick to some preexisting approved scheme though, as many hashes (md5, sha1, sha2) have weird behaviors you don’t want to to get into (for example, length extension attacks where attacker can add data to hash without knowing the original plaintext)

  • @thecloudstrief
    @thecloudstrief Před 4 lety

    My question is how does the receiver know what the nonce is... They will need to know in order to xor it with the block.

    • @yorickdewid
      @yorickdewid Před 4 lety +6

      Nonce is always send in the clear with the message

  • @joschkagoes9167
    @joschkagoes9167 Před 4 lety

    In counter mode why is the xor done after encrypting the counter and not before?

    • @joschkagoes9167
      @joschkagoes9167 Před 4 lety

      @@Gorzoid That makes sense somehow I assumed the number would be used to generate pseudo random numbers but rewatching the video I must have made that up in my head.

    • @yorickdewid
      @yorickdewid Před 4 lety

      There are modes that do both, xor before and after the block operation

  • @Elite7555
    @Elite7555 Před 3 lety

    When the IV isn't a secret anyway, why exactly does it have to be random?

  • @rodolfopk
    @rodolfopk Před 4 lety

    Just dont really understand how the nonce is echanged/syncronized between the parts.

    • @mrmimeisfunny
      @mrmimeisfunny Před 4 lety

      The nonce is public. Just gets sent as is.

  • @ilonachan
    @ilonachan Před 3 lety

    9:04 Hoo-ray!

  • @superscatboy
    @superscatboy Před 4 lety +1

    Not gonna lie, I was hoping from the title this was gonna be about the work of Larry Tesler.
    (I missed the previous video so the context was unknown to me.)

  • @Longuncattr
    @Longuncattr Před 4 lety +1

    ECB, CBC, CTR, GCM
    Next level: CBT

  • @primarypenguin
    @primarypenguin Před 4 lety +1

    Mike Pound is cipher-daddy

  • @aameen951
    @aameen951 Před 4 lety

    I'm waiting for the GCM video

  • @olenielsen5852
    @olenielsen5852 Před 4 lety +2

    For a split second I seem to grasp something... but then its gone

    • @recklessroges
      @recklessroges Před 4 lety

      Watch the video again and write it in code.

  • @aayush_dutt
    @aayush_dutt Před 4 lety +4

    How can I use public-key cryptography to verify my identity if I happen to lose one of my online accounts (say twitter)?

    • @DomAviationChannel
      @DomAviationChannel Před 4 lety +1

      I comment here to get notified when some1 helpful answers here ...

    • @presorts
      @presorts Před 4 lety

      I think that there are some social recovery things going live on the Ethereum blockchain, they're early tho and idk much about them

    • @GuruEvi
      @GuruEvi Před 4 lety +2

      Very similar to SSH, you could always exchange a key with the provider in advance that establishes your identity but is not your login and password (basically a recovery method based on PKI). However the question is then, why don't you use the PKI to simply establish your identity all the time.
      You could make the same question about PKI in general, how do I re-establish my identity if I lose my private key. The answer is, you don't unless you have a method of regenerating your key (eg. a master key such as in LastPass).
      Short answer: Use a password/key manager like LastPass or KeePass to keep track of at least one of your regenerative identities.

  • @qm3ster
    @qm3ster Před 2 lety +1

    So GCM once again breaks the seek-ability of CRT :v
    Because you need the entire message to authenticate, not just arbitrary blocks from the middle?

  • @effmerunning
    @effmerunning Před 4 lety

    Good god he is a god

  • @randomgeocacher
    @randomgeocacher Před 4 lety

    Nonce vs block counter could have been a little bit better explained. You mention it very briefly but then example isn’t great. As nonce typically is e.g. 1,2,3,4... the block encrypted must not be nonce, nonce+1, nonce+2 etc because you’d have counter-reuse immediately, breaking counter mode. But eh, it gets a bit dirtier writing e.g. (nonce, 001), (nonce, 002) etc I suppose.

  • @bglezerson
    @bglezerson Před 4 lety

    Has anybody ever figured out exactly what paper is used on Computerphile?

    • @recklessroges
      @recklessroges Před 4 lety +1

      Its Continuous stationery green-bar (on white), landscape fan-fold printer paper.

    • @bglezerson
      @bglezerson Před 4 lety

      Reckless Roges thank you!

  • @mo99
    @mo99 Před 4 lety +3

    Someone knight this man

    • @recklessroges
      @recklessroges Před 4 lety +3

      I think Dr Pound is currently MBE material. (Give him something to aim for.)

  • @rdcfrdcf
    @rdcfrdcf Před rokem

    Block 45 Rotation?

  • @soejrd24978
    @soejrd24978 Před 4 lety

    More image processing stuff, like sharpening or such

  • @censacrof
    @censacrof Před 4 lety

    Since we don't need to decrypt, would it be safe if I was to use an hash function instead of an encryption function in conjunction with counter mode? The key would be a string to be concatenated to the nounce and then fed to the hash function

  • @grainfrizz
    @grainfrizz Před 4 lety +1

    Mike "The only professor who chose C#" Pound

    • @varkokonyi
      @varkokonyi Před 4 lety

      Interesting, for me too, he is the only one I remember from that video

  • @alexanderdavis1047
    @alexanderdavis1047 Před 2 lety

    Slowing the speed to .75 is extremely helpful

  • @wonderlife8918
    @wonderlife8918 Před 3 lety

    Be careful is nonce1 = nonce2 + x where x less than the number of total blocks

  • @qwertyking9627
    @qwertyking9627 Před 4 lety +1

    i got questions ,lets assume i've completed python course and made few projects. but others skills do u need in a working environment and what are the best resources to learn those because i never apply for job m afraid if i got job but not ready for it the fear come i learned English at the age 19 after whole new world opened up but m i think m really late to the game

    • @emilejetzer7657
      @emilejetzer7657 Před 4 lety +1

      qwerty king if you want to develop the skills related to programming in the workplace, I’d suggest participating in Hackathons and contribute to open-source projects.

  • @alexlandherr
    @alexlandherr Před 4 lety +2

    Not Mike ~0.45 kg?

  • @PikDerWaldspecht
    @PikDerWaldspecht Před rokem

    Didn't know that Frodo Baggins was such an expert in cryptography...

  • @kitty_gamer23
    @kitty_gamer23 Před 4 lety

    right