Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

learn more… | top users | synonyms (1)

0
votes
1answer
32 views

A5/2: Ciphertext Only Attack

A5/2 could be attacked with cipher-text only, using the Error Correction Code, in order to retrieve the session key. For the purpose of simplicity suppose that the error correction code copy the ...
1
vote
3answers
141 views

Any benefit to writing a message as a mix of 2 languages before encryption?

For example, imagine a message that is a mix of Japanese and English words; Japanese in unicode, English in ASCII. Japanese doesn't use spaces between words. The sentence structures, anything ...
0
votes
0answers
40 views

Found weil pairing. Index Calculus method on the results of weil pairing

Consider Elliptic curve with p = 59, A = 1, B= 0, P = (25,30) and Q=(35,31). So I tried to solve this using MOV attack. The torsion point for them E[5] is R(-25,30i) where is sqroot -1 Chosen two ...
2
votes
0answers
59 views

Are analog quantum computers a threat to RSA and DLP?

We already know that D-WAVE's "quantum computers" can't really run the Shor's algorithm, because the way they're built doesn't qualify them as universal quantum computers. Now researchers actually ...
-1
votes
0answers
20 views

How do we compare two hash functions / cryptographic functions [closed]

I know what hash functions are but as my research project I am comparing two cryptographic algorithms so I am a bit confused about on what bases should I compare the two algorithms as these are ...
0
votes
0answers
26 views

Error Detection/Correction Code-Then-Encrypt

I've just studied about the error correction schemes and encryption. First rule when using EDC/ECC is to first encrypt and then calculate them, and the major motivation we were told is that "EDC/ECC ...
2
votes
1answer
86 views

Reversing a known encryption algorithm (4-byte repeating key XOR)

I've been practicing for an upcoming CTF competition, and I've finally reached the cryptography stage. I'm a complete newbie in this field (my knowledge is essentially that bcrypt is awesome and md5 ...
1
vote
1answer
33 views

How can I determine key length for message encrypted by many-time-pad?

For message $ m $ and key $ k $ I get encrypted message $ c $ ($ m \oplus k = c $) where $ length(k) < length(m) $. Additionally I know that message $ m $ is English text. Instead of using pure ...
0
votes
0answers
30 views

Has this forum been compromised by the NSA BULLRUN programme? [migrated]

Today, this site shows 24 thousand users in Cryptography. It runs in parallel with and is associated with StackOverflow boasting 6 million users. This site then clearly creates some leverage and ...
1
vote
0answers
39 views

Countering Cryptographic Attacks

By reading Camellia Design and Analysis document following is my understanding about few cryptographic attacks from designer point of view. Differential and Linear Crypt-analysis. Number of Active ...
3
votes
1answer
38 views

Concept of “guessed ID” in Authenticated Identity-Based Encryption

In Authenticated Identity-Based Encryption by Ben Lynn, in Proof of Integrity (section 4.3) and Proof of Security (section 4.4), I cannot grab the concept of "guessed ID" . Because encryption differs ...
3
votes
1answer
59 views

Plotting Running Times of SAT solver

In the the paper "Efficient Methods for Conversion and Solution of Sparse Systems of Low-Degree Multivariate Polynomials over GF(2) via SAT-Solvers" there is a Figure that I can not understand and I ...
1
vote
0answers
18 views

How to calculate how many trials I need to guess the plain text if a simple P-Box is used to make the cipher text

If I have 64 bit as input for a straight box that use a transposition process to encipher the plain text and the given 64 bits contains 60 bits as (1s), then how many trial I should do?
2
votes
1answer
57 views

Are transposition ciphers insecure?

Given plaintext: P[i], i = 1..N Given stream of cryptographic numbers S[i, j], i = 1..N, S[i, j] in [1, j] generated by RC5 for example We encrypt using Fisher-Yates shuffle algorithm: ...
4
votes
1answer
88 views

Is this a better involution S-Box for the Anubis cipher?

After swapping random indexes of trivial involution $S[x] = ¬x$, I found the following involution S-Box with a non-linearity of $98$ and a differential uniformity of $6$. Is there an upper limit to ...
1
vote
1answer
62 views

Factorization of RSA modulus using a qubic residue

Suppose that someone uses RSA with $n = pq$, exponent $3$, also $3$ divides $\varphi(n) = (p-1)(q-1)$ and $2$ different roots $y$ and $z$ of the equation: $$x \equiv c \ (mod \ n)$$ are known (for ...
1
vote
1answer
34 views

Security Strength of Double Substitution Ciphers

I am wondering why people are using RSA keys when some types of double substitution ciphers seem to be just as secure if not better off. By some types of double substitution ciphers I mean one Which ...
2
votes
1answer
61 views

Why is it that most messages seem to be expanded?

Whenever I have seen a more secure version of a message, the message seems to be expanded by some factor. One example is RSA encryption, but whenever a message does not appear to be expanded it is ...
0
votes
0answers
94 views

Example of Software Security (White Box Cryptography) is not strong as Hardware Security?

I have been reading about White Box Cryptography in the last 2-3 days but I was wondering what are the example of White Box Cryptograhy that are quickly broken by Cracker / Hacker? Would the fact ...
4
votes
0answers
47 views

On a proposition in NTRU original paper: $\gamma_1 |f|_2 |g|_2 \leq |f \circledast g|_\infty \leq \gamma_2 |f|_2 |g|_2$

In the original paper of NTRU cryptosystem, we have the following proposition (that is said to be suggested by Don Coppersmith): For any $\epsilon > 0$, there are constants $\gamma_1,\gamma_2 &...
1
vote
0answers
39 views

Issue Factorization Quadratic Sieve

Good evening, I'm about to write my own quadratic sieve implementation in C using GMP library for large numbers. I'm facing an issue while attempting to do the last factorization step for the number: ...
1
vote
1answer
49 views

How to brute force sqlcipher encrypted file with MD5 hash of a 7 bit key?

I have a database file that is encrypted using sqlcipher and MD5 hash. Sqlcipher to my understanding provides 256 bit AES encryption. The key is 7 bits long. How do I brute force it?
4
votes
1answer
55 views

Not-So-Simple Substitution Cipher?

The first go-to weakness when talking about substitution ciphers is frequency analysis. It assumes that there's a simple 1 to 1 character mapping between the plain text and the cipher text. Could a ...
2
votes
2answers
64 views

Is this approach able to protect against padding oracle attacks?

I know that a protection against the padding oracle attack is to encrypt-then-mac. This is to avoid trying to decrypt a modified ciphertext, and leak information about padding errors. Suppose that we ...
0
votes
0answers
34 views

RC4 using a key without nonce's or IV's [duplicate]

I'm researching RC4 and I am trying to recreate a condition where RC4 is crackable. However I can't quite find the article/resource I need to find the weakness for an implementation like this (python):...
2
votes
2answers
34 views

How to find the keyword of the Playfair text knowing/not knowing the plaintext and having decrypted text?

I know how the Playfair cipher works. I would like to know how can I find the keyword of the play fair cipher in two cases: 1) knowing the plaintext 2) not knowing the plaintext? Some examples: <...
0
votes
1answer
90 views

Derive $x$ when given $g,g^x$ and $g^{(1/x)}$?

If an adversary has access to the generator g of a group G and is given access to $g^{x}$ and $g^{(1/x)}$, will it make it any easier to derive the value of $x$ compared to when he had access to only $...
5
votes
1answer
81 views

Correlation Immunity Of 4 bit S Box

I have a 4 bit S Box byte[] S = new byte[16] { 0x9, 0xE, 0x5, 0x6, 0xA, 0x2, 0x3, 0xC, 0xF, 0x0, 0x4, 0xD, 0x7, 0xB, 0x1, 0x8 }; How can i calculate Correlation ...
1
vote
2answers
88 views

How to break a 32 bit block cipher without key?

From what I know Skip32 is the only 32 bit block cipher and I heard its not secure. What do I do or which tool do I use to break a 32-bit block cipher? I did search for this but all I find is attacks ...
4
votes
1answer
136 views

differential cryptanalysis cipher for the final round

I have a problem to find the sub-key. The system is… For each round, we make the following stage: We add the round key $K_i$. Substitution : we have 8 blocks of 4 bits, and an S-box ...
2
votes
1answer
67 views

Cryptanalysis of XOR cipher with repeated key phrase

My assignment is to cryptanalyze cipher text that we know was encrypted with a stream cipher (bitwise XOR of plain text and key stream), and decrypt to plain text. We know the key stream is a repeated ...
1
vote
1answer
80 views

How is the block size of a block cipher related to how susceptible the block cipher is to a birthday attack?

For example what can you say about how susceptible Triple-DES is to a birthday attack due to the fact that it has a block size of 64-bits.
1
vote
0answers
38 views

How to break a Quagmire 3 cipher?

What would be a good way to go about attacking a Quagmire 3 cipher? I understand that it is polyalphabetic with a key and an indicator. I have started by taking the cipher text, taking every n-th ...
2
votes
0answers
45 views

Is this PRG secure?

$G$ is a safe PRG in range $\{0,1\}^n\rightarrow\{0,1\}^{n+1}$. Let us define $G'(S)=G(S\oplus G(S)_{1,...,n})$, s.t. $G(S)_{1,...,n}$ is the first n bits of $G(S)$. Is $G'(S)$ a secure PRG? ...
7
votes
2answers
72 views

Conditions for a successful Differential Power Analysis attack

From this paper, there are two conditions for a successful DPA attack: i) there exists an intermediate variable in the implementation that is correlated with the power consumption and ii) ...
2
votes
1answer
111 views

How much weaker is AES-64 than AES-128?

It's hard to say exact QC specs, but let's assume we have decent a quantum computer using Grover's algorithm that is able to half AES-128 keyspace to that of AES-64. How long will a bruteforce attack ...
7
votes
2answers
218 views

Should HMAC-SHA3 be preferred over H(C(k,M))?

If I understand correctly SHA-3 (Keccak) is resistant against more attacks than SHA-2. This would make it possible - again if I understand correctly - to use SHA-3 with a simpler scheme than HMAC. ...
0
votes
0answers
39 views

MD5 - Length extension

I am currently trying to get a working understanding of MD5 length extension. I have been following the first exercise located here: https://www.cis.upenn.edu/~cis331/proj1.pdf (it looks like the ...
0
votes
1answer
529 views

Are there attacks on AES with 16-bit keys? [closed]

Are there known attacks on AES that uses a 16-bit key? Assuming the data can be 95MB size, and that I can request the same data over and over. For example, can someone explain to me how this code ...
1
vote
1answer
48 views

What kind of analysis can I perform on my implementation of Salsa20 and Rabbit ciphers?

I've implemented both the Salsa20 and Rabbit ciphers in C#. My implementation is for academic purposes and I've tested both of them against the test vectors. I implemented a system that encrypts a ...
4
votes
2answers
664 views

Is this simple PRNG secure?

$G$ is a PRNG used in a stream cipher and defined in the following way: G receives $s_0$ as an input, which is a random string drawn from a uniform distribution. The output of step $i$ is $s_i = (s_{...
0
votes
1answer
47 views

CPA on theoretical OTP with CBC mode

Body of question Note: this is THEORETICAL exercise. I understand OTP and CBC does not get along. I have to find a CPA on CBC enc-mode using OTP as the encryption algorithm, s.t a new key is ...
9
votes
1answer
260 views

Algorithm for Boneh and Durfee attack on RSA

I am trying to understand various attacks on RSA and I believe that they only way to fully understand the algorithm is to implement it. I am trying to implement the code in this paper (pdf) (Private ...
5
votes
1answer
107 views

Backdoor in NIST elliptic curves

Let $E$ be an elliptic curve defined over a finite field $F_q$ with prime order $n$ and $P,Q \in E$ and $k$ be private key such that $kP=Q$. Since $n$ is prime, $E$ is isomorphic to $Z_n$. Suppose $\...
0
votes
1answer
54 views

Best known attack

I always have listened the term best known attack but I have doubts respect to this term, becase there are several kinds of attacks for example structural attacks, inversion attacks. It is possible to ...
1
vote
2answers
50 views

Using what we already know about the data to decrypt it?

Are there any methods or tools out there that let us use what we know about the data in order to crack the encryption? For example let's say I get access to an encrypted database file but I know ...
0
votes
1answer
63 views

Is AES-CTR or ChaCha20 vulnerable to a time-memory trade off?

Is AES-CTR or ChaCha20 vulnerable to a time-memory trade-off attack? According to this paper it seems to be, which would put AES-CTR at a clearly breakable $2^{64}$ security level (for AES-128-CTR). ...
3
votes
1answer
83 views

Known Plaintext Attack against 3-round SPECK48/96

I am attempting to break 3-round SPECK48/96 using a known-plaintext attack, provided with 10 PT-CT pairs. Here is a diagram: I have seemed to almost figure this out, but I cannot figure out how the ...
1
vote
3answers
103 views

Will the contents of a password protected Zip 2.0 file be safe for a week

I will need to distribute a file to people for a challenge and I need them to open the file at the same time. The file will be provided a couple of days before the challenge. For maximum compatibility ...
4
votes
1answer
111 views

Calculation of the avalanche effect coefficient

Given a strict avalanche criterion matrix/dependence matrix for a hash function,how do I calculate the avalanche coefficient for it. I want to calculate a single parameter(value) which represents the ...