Tagged Questions

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

50 views

5k views

RSA with small exponents?

Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
4k views

Cryptanalysis to reverse engineer a hash?

I understand this may not be the best place to ask a question like this, but I believe that this community may be the best/only place I can ask such a question. I have inputs and outputs from an in-...
53 views

How to create and validate potential grids when attacking a Playfair cipher?

First up: I am not asking you to decypher anything. This question is about attacking a Playfair cipher; more specifically – how to create potential grids when doing so. I'm currently working on a ...
14k views

How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?

If cryptanalysts today were to crack the original Enigma machine, “how fast” or “how easily” could they do it? What methods would they use? The original cracking was significantly helped by operator ...
4k views

What is a “freestart collision”?

In their work on SHA-1 collisions (cf. the EUROCRYPT-2016 paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ...
100 views

How to break a 32 bit block cipher without key?

From what I know Skip32 is the only 32 bit block cipher and I heard its not secure. What do I do or which tool do I use to break a 32-bit block cipher? I did search for this but all I find is attacks ...
148 views

differential cryptanalysis cipher for the final round

I have a problem to find the sub-key. The system is… For each round, we make the following stage: We add the round key $K_i$. Substitution : we have 8 blocks of 4 bits, and an S-box ...
81 views

Cryptanalysis of XOR cipher with repeated key phrase

My assignment is to cryptanalyze cipher text that we know was encrypted with a stream cipher (bitwise XOR of plain text and key stream), and decrypt to plain text. We know the key stream is a repeated ...
197 views

Cryptanalysis of Marvin32 compared to SipHash

So I am curious about the security analysis of Marvin32, the randomized hash algorithm used in .NET (to prevent hash-table DoS). I found the source code here: ...
40k views

Possible ways to crack simple hand ciphers

We had a quiz in class today where we had to break the ciphertext with the key given, but not the algorithm. Suffice to say that I wasn't able to decrypt it within the allotted time of 12 mins and ...
37k views

Are there two known strings which have the same MD5 hash value?

Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?
48 views

CPA on theoretical OTP with CBC mode

Body of question Note: this is THEORETICAL exercise. I understand OTP and CBC does not get along. I have to find a CPA on CBC enc-mode using OTP as the encryption algorithm, s.t a new key is ...
93 views

How is the block size of a block cipher related to how susceptible the block cipher is to a birthday attack?

For example what can you say about how susceptible Triple-DES is to a birthday attack due to the fact that it has a block size of 64-bits.
42 views

How to break a Quagmire 3 cipher?

What would be a good way to go about attacking a Quagmire 3 cipher? I understand that it is polyalphabetic with a key and an indicator. I have started by taking the cipher text, taking every n-th ...
48 views

Is this PRG secure?

$G$ is a safe PRG in range $\{0,1\}^n\rightarrow\{0,1\}^{n+1}$. Let us define $G'(S)=G(S\oplus G(S)_{1,...,n})$, s.t. $G(S)_{1,...,n}$ is the first n bits of $G(S)$. Is $G'(S)$ a secure PRG? ...
80 views

Conditions for a successful Differential Power Analysis attack

From this paper, there are two conditions for a successful DPA attack: i) there exists an intermediate variable in the implementation that is correlated with the power consumption and ii) ...
225 views

Should HMAC-SHA3 be preferred over H(C(k,M))?

If I understand correctly SHA-3 (Keccak) is resistant against more attacks than SHA-2. This would make it possible - again if I understand correctly - to use SHA-3 with a simpler scheme than HMAC. ...
541 views

Are there attacks on AES with 16-bit keys? [closed]

Are there known attacks on AES that uses a 16-bit key? Assuming the data can be 95MB size, and that I can request the same data over and over. For example, can someone explain to me how this code ...
119 views

How much weaker is AES-64 than AES-128?

It's hard to say exact QC specs, but let's assume we have decent a quantum computer using Grover's algorithm that is able to half AES-128 keyspace to that of AES-64. How long will a bruteforce attack ...
265 views

Algorithm for Boneh and Durfee attack on RSA

I am trying to understand various attacks on RSA and I believe that they only way to fully understand the algorithm is to implement it. I am trying to implement the code in this paper (pdf) (Private ...
666 views

442 views

Security of tokenization of plain text conversations - cryptanalysis

I came across a marketing video here. They claim to perform AES encryption and tokenization of sensitive data, at the corporate gateway, before it leaves the company firewall destined for the public ...
55 views

Best known attack

I always have listened the term best known attack but I have doubts respect to this term, becase there are several kinds of attacks for example structural attacks, inversion attacks. It is possible to ...
2k views

Webcam random number generator

I have a question about random number generators. I have read from a real random number generator, based on a webcam ("randcam"). My problem is, that I do not really understand how the generation of ...
84 views

Known Plaintext Attack against 3-round SPECK48/96

I am attempting to break 3-round SPECK48/96 using a known-plaintext attack, provided with 10 PT-CT pairs. Here is a diagram: I have seemed to almost figure this out, but I cannot figure out how the ...
4k views

Is 80 bits of key size considered safe against brute force attacks?

I came across KATAN Family of Ciphers for small domain input blocks . They cipher arbitrary block lengths 32,48,64 but their key size 80 bits only. Is 80 bits of key size considered safe with ...
82 views

Can we use merely permutation to hide a message?

This question is related to this: When all shares of a secret are given to adversary as a permuted matrix I think the below question is a simplified version of that. Assume we have a 40-bit ...
89 views

How does the split mask countermeasure work on AES?

I am trying to understand the split mask countermeasure which is a masking method to avoid side channel attacks. Let's first describe the principle and then try to apply it to AES. I found this paper ...