analysing cryptographic algorithms, potentially uncovering weaknesses in them (e.g. "breaking" them or casting doubts on their actual security)

learn more… | top users | synonyms

3
votes
1answer
135 views

Twisted curves in protocol

I've come to understand that twisted curves, as for instance defined in the Brainpool specifications, are $F(p)$-isomorphic to their regular $F(p)$ equivalents. So brainpoolP256r1 is isomorphic to ...
-1
votes
2answers
273 views

Shamir Secret sharing - Can share generator keep x values secret?

I'm wondering, in Shamir secret sharing, can generator of the shares, keep the x values which are used in evaluating the polynomial to obtain y values (i.e., the shares) secret, and whenever the ...
5
votes
1answer
288 views

Is it a requirement to understand mathematics when implementing (or breaking) cryptography?

Related: What is the lowest level of mathematics required in order to understand how encryption algorithms work? and Recommended skills for a job in cryptology In the context of putting crypto into ...
2
votes
1answer
327 views

Precomputation attacks on RSA

Are precomputation attacks - such as outlined in RFC 3610 chapter 5 - possible on RSA PKCS#1 v1.5 signature generation? If yes, are such attacks taken into account when calculating the cryptographic ...
2
votes
1answer
136 views

Security of the iterated Hill Cipher

I can understand that the basic Hill Cipher is susceptible to known plaintext attacks, but suppose the Hill Cipher is modified into the Iterated Hill Cipher. For a plaintext $x_0=m_0$ and an ...
1
vote
0answers
40 views

Autocorrelation in Autokey

I know that Vigenère can broken using auto-correlation (as explained at cryptool-online.org). Now my question is: Why does this also work with autokey (tested it using crypttool)? To prove that I ...
10
votes
5answers
335 views

Tactics available to help prove security of a new system?

I believe that the accepted tactic to "prove" a system as secure is to allow the crypto-community to review it and if no vulnerabilities are found over a long period of time (5 or 6 years), then a new ...
7
votes
1answer
267 views

Is TEA considered secure?

Wikipedia claims that the best attack on the surprisingly simple TEA block cipher, that isn't a related-key attack, has a time complexity of $2^{121.5}$. So despite how unsophisticated the cipher ...
-4
votes
2answers
194 views

Any techniques for evading frequency based crypt analysis without encrypting?

Are there any general techniques for evading frequency based crypt analysis without using any encryption techniques?
1
vote
0answers
81 views

(n,n) Shamir secret sharing [duplicate]

In (n,n) Shamir secret sharing if n shareholders do not have the public values (X values) can they still obtain the secret with only Y values?
1
vote
1answer
623 views

The use of cribs [closed]

I'm looking to incorporate more crib usage in breaking ciphers in unknown enciphering schemes, or at least to gleam what information I may. This seems to be a big hurdle to me, and I'm looking for ...
-1
votes
1answer
84 views

Reverse engineering a single checksum byte [closed]

I am working to understand a system which saves a few bytes of data together with what appears to be a single checksum byte that provides a very naive guarantee that the data has not been tampered ...
2
votes
0answers
104 views

SIMONs Cryptoanalysis

I'm reading Cryptanalysis of the SIMON Family of Block Ciphers. In Section 3.1, it says: For SIMON, consider an n-bit input difference $\alpha= x\oplus x'$ to $F$ of Hamming weight one. As the ...
4
votes
1answer
178 views

How to solve cipher encrypted with Vigenère + Columnar Transposition?

Vigenère's weakness is Kasiski's test and index of coincidence. However, if you put columnar transposition on top of Vigenère, that weakness is gone. The text is now shuffled and you can't search for ...
10
votes
1answer
2k views

Security strength of RSA in relation with the modulus size

NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits: ...
2
votes
3answers
238 views

Problems with using AES Key as IV in CBC-Mode

I'm a pentester and currently analysing a web application which are using some strange encryption scheme. The point is: They encrypt using AES-128, generate a (not cryptographic secure) key and use ...
1
vote
0answers
69 views

How to decrypt a text which is ciphered same length key? [duplicate]

I have ten piece of ciphered texts. I know that they ciphered with a same-length key. Any idea how I can decrypt the ciphertexts? What kind of algorithms should I use? What are the points of taking ...
16
votes
6answers
10k views

Are there two known strings which have the same MD5 hash value?

Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?
2
votes
2answers
174 views

DES with actual 7 byte key

Do we have any library or any mechanism where we can use true 7 byte key for DES instead of 8 byte key. I need it for keys analysis in DES and 8 byte key requirement for associated library is creating ...
3
votes
1answer
92 views

Is ISAAC Cipher Cryptographically Secure?

http://en.wikipedia.org/wiki/ISAAC_(cipher) This question was asked before but the answers seem vague, and I want to know about ISAAC specifically, not ISAAC+. It seems some cryptanalysis was ...
2
votes
2answers
160 views

What is the limit of plaintext required to break the Vigenère encryption?

A theoretical question about the Vigenère cipher: Without any knowledge about the key (not even it's length) can we tell how much known or chosen plaintext is needed for the adversary to completely ...
0
votes
1answer
54 views

find $x$, given $\{c_ix = k_i + y_i\}_{i=[1,n]} $

Given $$c_1x = k_1 + y_1 $$ $$c_2x = k_2 + y_2 $$ $$\vdots $$ $$c_nx = k_n + y_n $$ where the values of $\{c_1 \ldots c_n \}$ and $\{ k_1 \ldots k_n \}$ are known, and $x, \{y_1 \ldots y_n \}$ are ...
27
votes
7answers
16k views

Taking advantage of one-time pad key reuse?

Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel. Alice and Bob have a shared key $k$; however, both messages are the same length as the ...
4
votes
4answers
1k views

Assistance Cracking Classical Cipher

Below is the cipher text I am trying to break and as you can see its rather short which is why I am having so much trouble. ...
1
vote
1answer
87 views

How do you test the security of your cipher? [closed]

I got asked this question and I didn't know what to answer. How do you test the security of your cipher? What comes to my mind now would be to test it with famous attacks: padding attacks, ...
2
votes
1answer
138 views

Can I make a PRNG that is secure even when state can be modified by user?

I am interested in making a PRNG which, after being initially seeded, can accept and incorporate client data as the only ongoing source of "entropy". It is not directly for a cryptographic purpose, ...
6
votes
4answers
314 views

How to forge Schnorr signatures if you can guess the challenge

Underlying the Schnorr signature is an identification protocol: let $G$ be a cyclic group where discrete log is "hard" and choose $g$ as a generator of $G$. Now have Alice pick a random (secret) ...
1
vote
1answer
55 views

Why does knowing the number of points on a curve help solve ECCDLP?

Perhaps, this is a really obvious question, but I am still having trouble understanding how this all fits together. Why is knowing the number of points on an Elliptic Curve helpful in cracking it? ...
1
vote
0answers
18 views

Cryptography — with a semi-priveleged user in the middle — to prevent request-tampering with another server

I'm working on a chat server for a mobile app I am writing. I would like to use a different application server for non-chat related operations and another application for chat operations. I would ...
10
votes
1answer
576 views

Security of N bit HMAC

Lets say that I am using 128 bit HMAC. How many operations are needed to find a "non secure" message. Is a birthday attack possible?
14
votes
2answers
773 views

Are AES-256's related-key weaknesses exploitable if it is used to build a hash?

Assume it is made a hash based on AES-256 encryption (perhaps because this is hardware-accelerated, but no standard hash is); and it is used the Merkle–Damgård structure, that is padding of the ...
6
votes
4answers
2k views

Simply put, what does perfect secrecy means?

I would like to ask for a clear (but maybe not so deep) explanation of what the term "perfect secrecy" means. As far as I have researched and understood, it has to do with probabilities of assuming ...
-1
votes
1answer
157 views

cryptography and use of python programming language [closed]

why is it recommended to write cryptography programs ,for example crypt-analysis projects with python programming language? what is the advantages of python? why not use c or any other language?
2
votes
0answers
139 views

An example of Knapsack Cryptosystem cracks/attacks?

I have been studying papers on various ways to crack the knapsack cryptosystem, unfortunately the mathematics in these papers involves lattices and LLL which is over my head. The paper "New Attacks ...
6
votes
3answers
2k views

How to attack a classical cipher using known partial plaintext?

I have a ciphertext generated by a classical cipher. I do not know what was cipher used to generate it. I do however have the beginning of the plaintext. What are the cryptanalysis approaches for ...
7
votes
2answers
1k views

Cycle attack on RSA

I originally posted this question in the mathematics section, you can see it here. Let $p$ and $q$ be large primes, $n=pq$ and $e : 0<e<\phi(n), \space gcd(e, \phi(n))=1$ the public encyption ...
3
votes
0answers
135 views

Using the same private key for two ECC key pairs

Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private ...
1
vote
1answer
63 views

Perl DES PCBC as protection against decryption/crypt analysis

Is error propagation in DES PCBC a good method to prevent decryption/crypt analysis by third parties? If I had a very large file encrypted with Perl's DES with the PCBC option, and then removed the ...
2
votes
1answer
122 views

Explanations for the complexity values for second preimage attack on GOST?

I've been reading the article "A (second) preimage attack on the GOST hash function" by F. Mendel et al (link) and I'm having some difficulty to grasp some of the values of complexities/probabilities ...
4
votes
1answer
133 views

Cryptanalysis of AES on SSD with TRIM enabled

Attack scenario: SSD physically retrieved from a computer that is turned off. The entire disk is encrypted with AES 256-bit (GNU/Linux, LUKS). The SSD has had TRIM enabled for several years and the ...
4
votes
1answer
384 views

Is there a security analysis of CryptDB?

Its interesting to see critical thinking being applied to cryptDB in contrast to all the hoopla around it here . cryptDB is not a major theoretical breakthrough but potpourri of technologies to make ...
9
votes
4answers
7k views

What is the difference between known-plaintext attack and chosen-plaintext attack?

I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not. Can anyone explain to me how ...
7
votes
2answers
4k views

How does a padding oracle attack work?

I am unsure of how a padding oracle attack works. What I am not getting is how changing one bit at one time allows one to exploit(get keys) ASP.NET machines. Can anyone explain this?
1
vote
1answer
122 views

How to solve custom made ciphers? [closed]

How would you go about solving basic custom made ciphers - e.g. one generated from this website http://www.wikihow.com/Write-a-Custom-Cipher-Carefully? This is solving it without knowing the method ...
-1
votes
1answer
123 views

Hash Based Encryption (fast & simple), how well would this compare to AES? [duplicate]

First of all, I know it's a very bad idea to invent your own encryption algorithm. It's better to use existing known, trusted, extensively tested and studied algorithms with a proven track record. The ...
3
votes
3answers
271 views

Is it possible to work out the hash algorithm from a list of known message-hash pairs?

For example, in my situation I know hash(20) = 486e9638177faf1f34e49910491b77af. I also know the hashes for all values from 0 to 20. Is it possible to work out the ...
12
votes
3answers
1k views

Why does SHA-1 have 80 rounds?

Why does SHA-1 algorithm have exactly 80 rounds? Is it to reduce collisions? If yes, then why do SHA-2 and SHA-3 have a lower number of rounds?
1
vote
1answer
72 views

How does the key size per data bit influence the security?

The likelihood of breaking, for instance, an AES-128 cipher is 100% after $2^{128}$ tries in brute force, meaning that I've got to try $2^{128}$ keys to certainly break it. What if I (hypothetically) ...
2
votes
0answers
47 views

Why the same characteristics cannot be used to recover all FEAL4 keys

I am trying to understand how differential Cryptanalysis works. Here I read how to use differential cryptoanalysis for cracking FEAL4 cipher. The big gotcha with this process is that you cannot ...
12
votes
2answers
535 views

Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?

Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...