analysing cryptographic algorithms, potentially uncovering weaknesses in them (e.g. "breaking" them or casting doubts on their actual security)
20
votes
2answers
951 views
How do I apply differential cryptanalysis to a block cipher?
I've read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are, for example, vulnerable to differential cryptanalysis.
I ...
19
votes
10answers
2k views
Now that quantum computers have been out for a while, has RSA been cracked?
D-wave systems has released a commercially viable quantum computer. This means; in theory, that all asymmetric encryption algorithms, such as RSA are now useless, due to the speed at which quantum ...
19
votes
4answers
2k views
Is AES-256 weaker than 192 and 128 bit versions?
From a paper (via Schenier on Security's Another AES Attack) (emphasis mine):
In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. ...
16
votes
5answers
7k views
Taking advantage of one-time pad key reuse?
Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel. Alice and Bob have a shared key $k$; however, both messages are the same length as the ...
13
votes
2answers
2k views
Why does nobody use (or break) the Camellia Cipher?
If Camellia is of equivalent security and speed to AES, concerns arise.
First of all, assuming the above, why is Camellia so rarely used in practice?
Why aren't there any breaks in Camellia? Does ...
13
votes
3answers
1k views
Reverse engineering a hash?
I understand this may not be the best place to ask a question like this, but I believe that this community may be the best/only place I can ask such a question.
I have inputs and outputs from an ...
13
votes
4answers
541 views
Is Wiener's attack on RSA extendable to larger keys with low hamming weight?
Using small private exponents with RSA improves performance.
However, it has been shown (Wiener, 1990) that if $\log d \leq \frac14 \log N$, the private exponent $d$ can be reconstructed from the ...
13
votes
1answer
377 views
Is this password migration strategy secure?
I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
12
votes
2answers
948 views
How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world.
How can we reason about the symmetric ciphers cryptanalysis ...
12
votes
2answers
329 views
What is the general justification for the hardness of finding preimages for cryptographic hash functions?
Since most cryptographic hash functions are simple, compact constructions does this simplicity impose a limit on the complexity and the size of a function that can generate preimages? That is, given a ...
10
votes
8answers
844 views
RSA with small exponents?
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
10
votes
4answers
473 views
About Cryptography in a Character Language
Suppose I had a message in Chinese (or another non-phonetic language) and I wanted to encipher it.
Some of the simplest encryptions in English are substitution ciphers, but such ciphers don't seem ...
10
votes
2answers
391 views
How long would the 100 Year Cryptography Project have secured its data had it been started 100 years ago?
The goal of the Tahoe-LAFS 100 Year Cryptography project is to "enhance Tahoe-LAFS's cryptographic system so that Tahoe shipped today/next year might remain safe from cryptographic attacks for a 100 ...
10
votes
3answers
533 views
How practical are side-channel attacks and how much of a concern are they?
I see a lot of research in very sophisticated side-channel attacks on crypto systems. Most (but definitely not all) seem to follow a trend, namely, the crypto system does something very dumb like ...
10
votes
1answer
336 views
Security of N bit HMAC
Lets say that I am using 128 bit HMAC. How many operations are needed to find "non secure" message. Is birthday attack possible?
9
votes
3answers
398 views
Are these emerging threats against AES affecting your designs?
Recentally, an attack on AES was discovered which reduces its computationally complexity, by a very slight amount.
The first key recovery attack on the full AES-128 with computational
complexity ...
9
votes
2answers
251 views
Why is the salt used only once in PBKDF2, while the password is used often?
The purpose of PBKDF2 is to create a derived key (DK) from a master password (PW) and a salt, often using a function like HMAC-SHA256. I have read that the salt should be as random as possible. But ...
8
votes
2answers
752 views
Can two different pairs of RSA key have the same modulus?
Can $n=pq$ be part of two different pairs of RSA keys?
If such keys exist, say $(e_1,n)$ and $(e_2,n)$, how are they related?
What will be the security concerns for the two users?
8
votes
2answers
6k views
How does one attack a two-time pad (i.e. one time pad with key reuse)?
My question might appear the same as the question Taking advantage of one-time pad key reuse?, but actually I did read all the answers and none of them helped me with the details I need.
I am new to ...
8
votes
3answers
2k views
What is the difference between known-plaintext attack and chosen-plaintext attack?
I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not.
Can anyone explain to me how ...
8
votes
3answers
454 views
Can I use a one time pad key twice with random plaintext?
I understand the basics of OTP: $|\text{key space}| = |\text{plaintext space}|$ implies perfect security, key reuse destroys this.
Cryptanalysis on the $N$-Time Pad for $N > 1$ involves finding ...
8
votes
4answers
189 views
Tactics available to help prove security of a new system?
I believe that the accepted tactic to "prove" a system as secure is to allow the crypto-community to review it and if no vulnerabilities are found over a long period of time (5 or 6 years), then a new ...
8
votes
3answers
446 views
What is the best way to put a backdoor in an encryption system?
How can you put a backdoor into an encryption algorithm? Are there any techniques that can be used to reduce the time it takes to break a key?
I am looking for practical examples encryption schemes ...
8
votes
1answer
556 views
Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?
I am considering attacks on Two-Key Triple-DES Encryption assuming $2^{32}$ known plaintext/ciphertext pairs (that's a mere 32 Giga Bytes of ciphertext) by the method devised by Paul C. van Oorschot ...
7
votes
4answers
1k views
What is the effect of the different AES key lengths?
How does a changing key length affects the ciphertext, not only in case of AES, but in general? I know that the key spaces become much larger and the number of rounds in case of AES changes, but is ...
7
votes
2answers
400 views
How does the MOV attack work?
What exactly is the MOV attack, how does it actually work, and what is it used for?
It's explained briefly here and I'd like to know what it is more / what is it fully used for.
7
votes
1answer
3k views
How does the index of coincidence work in the Kasiki test?
I'm starting to learn about cryptanalysis and I am having a bit of difficulty understanding the Kasiski test's index of coincidence. I have a book (Cryptography Theory And Practice by Douglas Stinson) ...
6
votes
4answers
484 views
Is compressing data prior to encryption necessary to reduce plaintext redundancy?
As explained in William Stallings' Book, in PGP encryption is done after compression, since it reduces redundancy.
I couldn't relate encryption strength with redundancy. Could anyone explain more on ...
6
votes
2answers
1k views
Definition of Textbook RSA
What is the definition of Textbook RSA?
What are some of the properties of textbook RSA?
How does it differ from other RSAs?
6
votes
3answers
2k views
Encryption/ciphers/codes in Chinese
I am quite curious as to how you can perform simple encryption for the Chinese language.
Saw a similar question related to encryption/Chinese here: About cryptography in a character language, ...
6
votes
2answers
2k views
How does a chosen ciphertext attack work, with a simple example?
Can someone please explain - using a simple example - how a chosen ciphertext attack works?
6
votes
1answer
248 views
How exactly would someone attempt to analyse ciphertext produced by popular encryption products such as Truecrypt/PGP?
I am interested in understanding what the process would be if an attacker wished to attempt to decrypt data secured by common tools such as OpenPGP, Truecrypt or the like. Are there any documented ...
6
votes
2answers
1k views
Predicting values from a Linear Congruential Generator
I have learnt that Linear Congruential Random Number Generators are not cryptographically secure - my understanding is that given an LCG of the form:
...
6
votes
2answers
297 views
For public-key encryption, why does COA resistance imply CPA resistance?
My professor told me:
If a public-key crypto-system is secure against ciphertext-only attacks,
then it is also secure against a chosen-plaintext attack.
Why is this true? Is there a proof that ...
6
votes
1answer
124 views
Message space in security definitions
What is the message space in the following example and how does a message space relate to a security definition?
I mean, what difference does it make to such a definition if your message space is ...
6
votes
3answers
159 views
Number of intersections of two sets
Suppose both I and my friend have a set of integer numbers. We want to know the number of common elements in our two sets but without knowing elements of the sets of each other. So I don't want my ...
6
votes
1answer
151 views
How would one crack a weak but unknown encryption protocol?
I asked a question on security.stackexchange, but was told it would be a better fit here:
http://security.stackexchange.com/questions/32779/how-would-one-crack-a-weak-but-unknown-encryption-protocol
...
6
votes
1answer
119 views
Are there any tools for expressing the cipher operations as a system of equations?
The first step In Algebraic-attack is expressing the cipher operations as a system of equations. Is there an automated tool to do this?
6
votes
2answers
235 views
Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?
Consider a common practically-collision-resistant Merkle–Damgård hash function $\mathcal{H}$ (e.g. SHA-1, RIPEMD-160, SHA-256, SHA-512). We define a Message Authentication Code $\mathcal{C}$
$$(k,m) ...
6
votes
1answer
366 views
How to deduce enigma settings given a partial plaintext?
Assuming some large block of text is encrypted with an enigma machine and I only know a small subset of letters before and after encryption, how do I go about figuring out the enigma settings from ...
6
votes
1answer
436 views
Implementation of Tao Xie and Denguo Feng's MD5 attack
It is well known that MD5 is completely broken today - however, to understand the theory behind the attacks I am looking for an implementation of the collision attacks described in the 2009 paper A ...
5
votes
4answers
238 views
How to forge Schnorr signatures if you can guess the challenge
Underlying the Schnorr signature is an identification protocol: let $G$ be a cyclic group where discrete log is "hard" and choose $g$ as a generator of $G$. Now have Alice pick a random (secret) ...
5
votes
2answers
688 views
Why do block ciphers need a non-linear component (like an S-box)?
Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)?
How does it make the cipher more secure?
The only intuition I have ...
5
votes
2answers
843 views
How to attack a classical cipher using known partial plaintext?
I have a ciphertext generated by a classical cipher. I do not know what was cipher used to generate it. I do however have the beginning of the plaintext.
What are the cryptanalysis approaches for ...
5
votes
2answers
2k views
Rijndael vs. Serpent vs. Twofish: General comparison
Can anyone explain (or give a link to document about) why Rijndaal won the AES, especially comparing it to other finalists (Serpent and Twofish)? What criteria were used to make decision?
Or is there ...
5
votes
4answers
172 views
Changing algorithms during encryption
Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption.
For ...
5
votes
3answers
1k views
Cracking Pre-Paid Cards
Is it possible to deduce the original function that used to generate those pre-paid cards number that are used for charging your mobile phone credits?
For Example, If I've collected about 1000 of ...
5
votes
1answer
296 views
Exposing RSA private-key data… bad?
We know that exposing $p$, or $q$ or $\phi(n)$ results in trivial attacks on RSA since they allow us to factor $n$ and to compute the private exponent $d$.
In OpenSSL (and most RSA implementations) ...
5
votes
3answers
536 views
Understanding CRC
There are zillions of articles describing CRC. What can I ready to understand more deeply what's really going on? Both from an algebraic perspective and a bit-manipulation perspective, I'd like to ...
5
votes
1answer
347 views
Would RSA-encrypting a private key for itself constitute a vulnerability?
I'm planning to encrypt some individual files for storage, using the GnuPG implementation of RSA. If I happened to encrypt the private key corresponding to the public key used for encrypting -- either ...
