analysing cryptographic algorithms, potentially uncovering weaknesses in them (e.g. "breaking" them or casting doubts on their actual security)

learn more… | top users | synonyms

5
votes
1answer
316 views

Is it a requirement to understand mathematics when implementing (or breaking) cryptography?

Related: What is the lowest level of mathematics required in order to understand how encryption algorithms work? and Recommended skills for a job in cryptology In the context of putting crypto into ...
14
votes
2answers
835 views

Are AES-256's related-key weaknesses exploitable if it is used to build a hash?

Assume it is made a hash based on AES-256 encryption (perhaps because this is hardware-accelerated, but no standard hash is); and it is used the Merkle–Damgård structure, that is padding of the ...
10
votes
2answers
1k views

How does the MOV attack work?

What exactly is the MOV attack, how does it actually work, and what is it used for? It's explained briefly here and I'd like to know what it is more / what is it fully used for.
10
votes
5answers
341 views

Tactics available to help prove security of a new system?

I believe that the accepted tactic to "prove" a system as secure is to allow the crypto-community to review it and if no vulnerabilities are found over a long period of time (5 or 6 years), then a new ...
8
votes
4answers
751 views

Predicting PRNG given some of its previous output

I a have a question about PRNGs and this is my very first experience with them. I have the following generator that takes a 56-bit seed $p$ during initialization and then chooses both $X$ and $Y$ ...
8
votes
3answers
293 views

Is there an algorithm to find the number of intersections of two sets?

Suppose both I and my friend have a set of integer numbers. We want to know the number of common elements in our two sets but without knowing elements of the sets of each other. So I don't want my ...
7
votes
3answers
2k views

How to attack a classical cipher using known partial plaintext?

I have a ciphertext generated by a classical cipher. I do not know what was cipher used to generate it. I do however have the beginning of the plaintext. What are the cryptanalysis approaches for ...
6
votes
4answers
286 views

Is there a proof for showing any cryptogram is crackable?

I commonly hear statements along the lines of "all cryptograms are crackable - it's only a matter of time". Is there a proof to show that any cryptogram is "crackable"? The proof may be of a more ...
6
votes
3answers
424 views

Is there some way to generate a non-predictable random number in a decentralised network?

Is there a way to generate a random number with given restrictions: It will be used in a decentralised network with a big number of peers (no central authority to generate it) Its generation should ...
6
votes
4answers
219 views

Changing algorithms during encryption

Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption. For ...
5
votes
1answer
967 views

Example of CHI Square test on Caesar Cipher?

I am trying to get my head round the chi square test, when used with the Caesar cipher. I started off using this formula, $$ X = \sum_{i = 1}^k \frac{f_i · f'_i}{n · n'} $$ Where ...
5
votes
1answer
628 views

If the PSK is known, is it possible to decrypt traffic from other clients in a WPA2 wlan network?

If in a public WLAN WPA2-PSK is used, but the PSK is more or less publicly available, does this mean that an attacker with that PSK can easily decrypt wlan traffic from/to other clients of that WLAN? ...
4
votes
4answers
463 views

Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?

For RSA cryptography, we know that the modulo $n$ is a product of two big prime numbers(say $p$ and $q$). However, in some documents I see an extension of $p=2p'+1$ and $q=2q'+1$ with $q'$ and $p'$ ...
4
votes
2answers
1k views

Brute forcing CRC-32

I'm working on a cryptosystem which uses IDEA. The designer made the mistake of including a CRC-32B hash of the password unencrypted in the header, so that the system can quickly reject bad ...
3
votes
2answers
1k views

Cryptanalysis of Linear Feedback Shift Registers

It is well known that simple m-sequence linear feedback shift registers have a linear algebraic structure and therefore the generator seed can easily be deduced using the Berlekamp-Massey algorithm. ...
3
votes
2answers
366 views

Can I build a secure tweakable block cipher from a normal one by adding key and tweak?

Let (E,D) be a secure block cipher. Consider the following tweakable block cipher: ...
3
votes
2answers
1k views

Difficulty of breaking RSA for a given key size

Is it true that breaking a 1024-bit RSA key is as difficult as breaking a 128 bit symmetric key (e.g. AES)? I know that breaking a RSA key is equivalent to factoring the modulus $N$. To factor it, you ...
3
votes
2answers
1k views

How can I break REDSHIRT / REDSHIRT2 encryption?

Recently, a user on Gaming.SE asked a question about whether the user password in the video game Uplink could be modified after being initially set. The game does not contain an option to change the ...
2
votes
1answer
362 views

Break double encryption

Let $E_k$ : {0,1}$^l$ be a block cipher encryption function with block-size $l$ and key-length $n$. In class, we saw that a double encryption with two independent keys $E{}'_{k_1k_2}(x)$ = ...
-2
votes
3answers
1k views

How can I find the prime numbers used in RSA?

I got this question in a local hacking event, but I couldn't solve it. Problem Statement ---- Continuing their snooping habit, NSA kept bugging Alice's communication. Resorting to the age old ...
7
votes
1answer
367 views

Exposing RSA private-key data… bad?

We know that exposing $p$, or $q$ or $\phi(n)$ results in trivial attacks on RSA since they allow us to factor $n$ and to compute the private exponent $d$. In OpenSSL (and most RSA implementations) ...
5
votes
5answers
484 views

Is there a technique to confirm that a given large integer value is a product of two primes?

Given a list of 2048 bit integer values in which one or few 2048 bit integer values may be product of two prime numbers and other values may be just 2048 bit odd integers numbers. My question is - ...
5
votes
1answer
271 views

S-box Cryptanalytic Resistance

In DES, different S-boxes were tested for cryptanalytic resistance and the most secure one was chosen for the algorithm itself. How do different S-boxes offer different levels of security against ...
4
votes
4answers
319 views

Why to try get key out of white box crypto? How can one protect WBC itself?

Help me understand the following. With WBC the question is mainly being stated as can one try to break WBC to identify the key. My question is: Why would one ever want to do that anyways? If one can ...
4
votes
1answer
508 views

Hill-cipher, disordered alphabet

I am going to apply a simple substitution cipher to my input, then encrypt the result with a Hill cipher. How can this be broken, in a chosen-plaintext threat model? In other words, instead of the ...
4
votes
1answer
524 views

Differential cryptanalysis - breaking the last round of FEAL4?

I've been trying to learn cryptanalysis. I've come across this resource which proved very helpful: http://theamazingking.com/crypto-feal.php So far I've been almost successful in breaking FEAL4 ...
3
votes
3answers
243 views

How feasible is word-level frequency analysis over English (or any language)?

Say I have some black box which, given any English word, deterministically outputs a token for that word. Assume our black box is implemented using strong cryptography, i.e. the hardness of reversing ...
3
votes
1answer
275 views

True Random Number Generator by milliseconds per keystroke (TRNG-Kms)

The simplest way to generate truly random numbers for OTP keys is to measure the time in milliseconds between each keystroke on a keyboard. The randomness depends on the user typing in various speeds. ...
3
votes
2answers
371 views

DES — Can I recover the key when I have both ciphertext and the plaintext?

Given a message and DES encrypted form of said message, is it possible to efficiently compute the key used to encrypt the data?
3
votes
1answer
98 views

What does “adaptively secure” mean?

In a paper it says "In the generic group model, the PRF is adaptively secure for inputs of $\mathbb{Z}_q^n$". Maybe a stupid question, but what does "adaptively secure" mean exactly?
3
votes
1answer
165 views

How can we determine if two discrete logarithms are equal?

Let $p$ be a prime number, and let $g_{1},g_{2},...,g_{n}$ be $n$ generator of $Z^{*}_{p}$. We have a list $y_{1},y_{2},\dotsc,y_{n}$ of elements in $Z^{*}_{p}$ such that for every $i\in ...
3
votes
2answers
287 views

If Bob steals Alice's private key, how exactly would he read her encrypted documents?

So Bob grabs Alice's secret key when she isn't looking and her encrypted files, doesn't he need to know her passphrase to read her files? What I am reading is that no he does not need it but as far ...
2
votes
1answer
117 views

Straightforward method for hampering frequency analysis on deterministic encryption

I'm brainstorming some different ways of making deterministic encryption more secure. I want to use deterministic encryption to preserve searchability over the keywords in a document set. However, I ...
2
votes
2answers
209 views

How does compression before encryption leak info about the input?

Apparently current best practices recommend that you do not compress before you encrypt. For example in this blog entry (*): http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ It ...
2
votes
2answers
381 views

Breaking Double Encryption

I am trying to understand how an attacker knows when he has successfully decrypted a ciphertext for an assignment. As such, some pointers/hints for the following questions would be greatly ...
2
votes
2answers
373 views

Computing p and q from private key

We are given n (public modulus) where n=pq and e (encryption exponent). Then I was able to crack the private key d, using Wieners attack. So now, I have (n,e,d). My question is, is there a way to ...
1
vote
2answers
425 views

Quadratic residue problem on composite integers

Its believed that the quadratic residue modulo $n=p·q$ for large primes $p$ and $q$ is intractable, which forms the basis of some cryptosystems. However, it is solvable if the factors of $n$ are ...
1
vote
2answers
299 views

Help me describe/identify this challenge-response protocol/algorithm?

My area of expertise is reverse engineering, specifically embedded systems. I do attack cryptographic systems, but this largely involves key recovery or exploiting the implementation. I was asked to ...
1
vote
1answer
2k views

decryption many time pad [duplicate]

I have eleven ciphertexts that were encrypted with the same key (which I don't know). I want to decrypt the last ciphertext. I read similar question like Many time pad attack but I can't solve my ...
1
vote
1answer
1k views

What is the probability of breaking the AES algorithm?

I am doing a project which requires the encryption to be done using AES. Is it really possible (technically) to crack AES? If yes, please tell me: What is the probability of breaking AES? How ...
1
vote
2answers
173 views

CPA distinguisher for matrix multiplication in GF(256) with randomized padding

What is the best CPA distinguisher for the function $F_k:\{0,1\}^{8n}\to\{0,1\}^{16n}$ described below? Let $E_k$ be a $2n\times2n$ matrix with elements in $GF(2^8)$, selected by generating bit ...
1
vote
0answers
79 views

Two untrusted party want to exchange data: how to ensure each one gets the data it needs? [duplicate]

Possible Duplicate: Two untrusted party want to exchange data: how to insure each one gets the data it needs? I am trying to come up with what could maybe be a novel algorithm for an ...
-3
votes
2answers
920 views

finding collision for truncated SHA1 hash output

Suppose we truncate only 40 bits of sha1 hash output.hence it is insecure.how can we find two message as input which gives first 40 bits of hash as same value i.e we have to find collision for first ...
-4
votes
1answer
160 views

Can someone tell if my Hand Cipher is secure? [closed]

In easy steps, this is how it works: Convert txt to numbers. mod 1-26. Generate random numbers (by my other cipher) equal to plain txt. Write random numbers under txt numbers. Like this: ...