# Tagged Questions

A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

190 views

### Can a commutative block cipher be indistinguishable from a random one, assuming a random permutation of keyspace?

Define a commutative block cipher with keyspace the finite set $K$, and message space the finite set $S$, to be an application \begin{align} E:K\times S&\mapsto S\\ (k,x)&\mapsto E(k,x)\text{...
42 views

### Finding differentials and space complexity

Most of article about differential cryptanalysis present the generic method, the way to find sub keys. But I can't find a clear explanation about how to find the differentials used in examples. In ...
52 views

### What is the correct definition of the blowfish F-function?

The Blowfish cipher uses a so called F-function which uses S-Boxes (S[i], i=0,1,2,3) to ...
149 views

### Statistical saturation attack on block ciphers

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack against the Block Cipher ...
110 views

### How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
33 views

### Breaking linear blockcipher - expanding recursive formula

I am trying to break a block cipher that can be defined as follows: We have 12 rounds and at each round we perform the following operation. We split 64 bit data into 2 parts each 32-bits, $\ x_r$ ...
189 views

### Are there key collisions in AES-192, AES-256?

Suppose we have a single, fixed plaintext block $p$ of 128 bits. Call the set of all possible 128 bit blocks $B$. We could define fixed plaintext AES-128 as a function $f(k) \to B$ that takes a 128 ...
25 views

### Security of randomized data dependant key schedules?

An example to demonstrate the point with two Feistel networks: Cipher A: \begin{align} roundkey = hash(key || counter)\\ roundkey = hash(key || roundkey)\\ left = left\oplus hash(roundkey || right)\\...
46 views

### Differential Cryptanalysis

How do I find the differential characteristics using techniques Shrinking ? How do I extract the key on Differential Cryptanalysis using the technique Shrinking in Blockcipher Algorithm? Shrinking ...
118 views

I am working on a problem found in my Cryptography textbook that goes as follows: Let F be a pseudorandom function such that for $k \in \{0,1\}^n$, function $F_k$ maps $l_{in}(n)$-inputs to $l_{... 0answers 29 views ### Quantitatively measure the private information revealed by a matrix? Suppose I have a private matrix$A$that I want to conceal. I do the matrix multiplication$A^\prime =AK$and$A^\prime$is public. How can I quantitatively measure "how well" the matrix$A$is ... 0answers 90 views ### What is the fixed point attribute of DES (when used with weak-keys) I've heard in some lecture that the weak keys in DES implies the existence of$2^{32}$fixed points in the algorithm, i.e. that$DES_k(x)=x$for$2^{32}$such$x$'s. I couldn't find anything about ... 0answers 63 views ### Why the same characteristics cannot be used to recover all FEAL4 keys I am trying to understand how differential Cryptanalysis works. Here I read how to use differential cryptoanalysis for cracking FEAL4 cipher. The big gotcha with this process is that you cannot ... 0answers 322 views ### How to perform benchmark of block/stream ciphers? I would like to perform some benchmarking of different block and stream ciphers for general data (lossless and lossy data) encryption and decryption (with focus on power consumption). To get general ... 0answers 127 views ### How well analyzed are giant block length ciphers? I have heard about ciphers that have a block length of 256 megabytes... That is huge. How well are they understood by the encryption community? I'm referring to PMC Ciphers. Has anyone used such a ... 0answers 43 views ### Countering Cryptographic Attacks By reading Camellia Design and Analysis document following is my understanding about few cryptographic attacks from designer point of view. Differential and Linear Crypt-analysis. Number of Active ... 0answers 59 views ### Is 3 rounds more secure than 2 in this simplified DES? Consider the following simplification of DES: a plaintext message block of$2n$bits of length is divided into two blocks of length$n$(left half$L_0$and right half$L_1$). In other words, the ... 0answers 50 views ### Is it possible to create a detection oracle for all block cipher modes? — ciphertext-only cryptanalysis I have made an ECB/CBC detection oracle, and am now trying to make a detection oracle that can differentiate between CBC/CFB/OFB/CTR/etc. I can already tell ECB apart from the others due to this ... 0answers 33 views ### Reykeyed AES in CTR mode as a stream cipher Suppose one uses AES in CTR mode to generate a keystream, but every$l$bytes the$n$bits that would follow are used as a new AES key. Assuming that AES is a secure PRP: Is this a secure stream ... 0answers 31 views ### Does extra encryption improve the security of CBC and CTR? I am learning about cryptography and during my research and reading I had a question. When looking at information leakage and CBC mode, I asked if there is a way to improve this with by using the ... 0answers 44 views ### Is this a better GCM? Using the keystream from the block cipher for both parts of the GMAC key (initialization and encrypting the auth tag) seems to produce a better mode of operation than GCM, as successful forgeries and ... 0answers 43 views ### Algebraic relationship between Original Key and Sub Key of DES Does there exist any sorts of algebraic relationship between Original and Sub Key of DES? I understand that by solving K-Maps of 64-bit Input/48-bit Output, I can get 16 algebraic relationships ... 0answers 57 views ### 2 round GOST_28147-89 cipher distinguisher So, here is the scheme of how this will look graphically: The deal is to present distinguisher for this cipher. First of all here is my drafts: Way 1 Assume that distinguisher displays in ... 0answers 173 views ### CAST-256 (CAST6) versions or S-Boxes Are there different versions of CAST-256 - also known as CAST6 - available? Are there different S-Boxes available for CAST-256? If there are different versions or S-Boxes what identifier should I use ... 0answers 22 views ### Cryptography — with a semi-priveleged user in the middle — to prevent request-tampering with another server I'm working on a chat server for a mobile app I am writing. I would like to use a different application server for non-chat related operations and another application for chat operations. I would ... 0answers 58 views ### 1-1 trapdoor function mapping the set of$n$-bit numbers to themselves I am looking for a trapdoor one-to-one function$f : \{0,1\}^n \rightarrow \{0,1\}^n$(that is, mapping the set of$n$bit numbers 1-1 onto itself [any$n$is OK]). I was considering the use of ... 0answers 228 views ### Pohlig-Hellman exponentiation block cipher Let$G$be a group of order$n$and let$e,d$be integers such that$ed\equiv 1 \pmod{n}$. Then the exponentiation maps$x \mapsto x^e$and$y \mapsto y^d$are inverse maps on$G\$. These maps give us ...
98 views

The CAESAR candidate Deoxys is based on a tweakable block cipher that seems to be a strict improvement over AES, in that it is a tweakable cipher resistant to related-key attack. The mode proposed ...
19 views

### Problem with braking SASAS type of encryptions

I am reading the paper Structural cryptanalysis of SASAS. I understood it till the section Recovering of layers S1 and S3 on page 6. However because of my limited understanding of mathematics, I am ...
41 views

### Does encrypting with MGF1/SHA-512/1024-bit seed equal to a 1024-bit key block cipher?

Suppose: Alice uses SHA-512 with MGF1(as in PKCS#1 V2) and a 1024-bit random seed to generate a mask, XORs the mask with a message(M), gets a cipher text (CT), and sends the CT to her old friend ...
43 views

### Why does Rabin cryptosystem split the message into key blocks?

Why does Rabin cryptosystem split the message into key blocks and not into plain text blocks like in Merkle Damgard Construction? Is it because it acts in a way similar to IV? Probably not, it doesn'...
48 views

### Have ciphertext and key but need to figure out encryption method

So I have a block cipher (I think) that I need to break. I have the ciphertext and the key, but not the method of encryption, and was wondering if anyone could help me figure that out? The key is a 9 ...
108 views

### splitting the plaintext and ciphertext into blocks

Say I was to use RSA with a given value of n. I choose to split the plaintext and ciphertext written in a 27 letter alphabet into blocks with k and m characters resp. How would I find the largest ...
249 views

### Simple two round feistel chiffre

I am currently learning for a exam in cryptgraphy. I now try to understand the Feistel Cipher with two rounds. I do not have any information on what the functions are actually doing. The following ...
90 views

I've got an API spec that specifies NRPAD and FPAD as possible padding schemes. I see these being used together with the Korean SEED algorithm. The SEED specification however is void of any padding ...