Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

learn more… | top users | synonyms (1)

3
votes
1answer
297 views

Deciphering “easy” ciphers without hints

I've been keen on IT Security for a long time now and I've learned a lot about networking & security. However trying a "decryption challenge" I'm lacking what I think is basic ...
2
votes
1answer
62 views

Output of using the same key in all 3 boxes of 3DES

I am trying to figure this one out: What would be the encrypted output for an input x if the same key K is used in all three boxes of 3DES? The encryption scheme for 3DES with three different keys, ...
41
votes
7answers
33k views

Taking advantage of one-time pad key reuse?

Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel. Alice and Bob have a shared key $k$; however, both messages are the same length as the ...
4
votes
0answers
128 views

Statistical saturation attack on block ciphers

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack against the Block Cipher ...
6
votes
1answer
170 views

Can it ever be impossible to invert a PRNG?

I've read about the possibility of inverting the Mersenne Twister after 624 numbers of output. 624 matches the state size of my implementation of the Twister. Coincidence? If the generator only ...
4
votes
2answers
251 views

Why calculate pi to estimate randomness?

Why do testing suites calculate $\pi$ (pi) using the Monte Carlo method to determine if a series of numbers are random? As far as I can tell, the Monte Carlo method can be used to estimate $\pi$ ...
3
votes
1answer
72 views

Is there any benefit of changing the AES-CCM encryption key periodically even if the Nonce space is not exhausted yet?

I would like an answer that could be sustained by a mathematical proof. Let's say I'm using AES-CCM to encrypt a lot of messages, and I always use a different nonce. I know that when the nonce space ...
1
vote
1answer
101 views

How to prove that the Permutation cipher is not CPA secure?

Encryption scheme is called a permutation cipher if every plaintext string with letters $a_1,\ldots, a_n$ is encrypted as $a_{\pi(1)}, \ldots, a_{\pi(n)}$ for some (not necessarily uniform) ...
2
votes
1answer
40 views

Data Switching and Information Leakage

Hypothesis: Let $z,a$ be uniformly random elements of a field $\mathbb{F}_p$ where $p$ is a large prime number. Also, let $(-z)$ be additive inverse of $z$. I have a fixed secret value $x$. I mask ...
32
votes
10answers
7k views

Now that quantum computers have been out for a while, has RSA been cracked?

D-wave systems has released a commercially viable quantum computer. This means in theory, that all asymmetric encryption algorithms — such as RSA — are now useless due to the speed at which quantum ...
4
votes
2answers
82 views

Weakness of SRP after server compromise

From SRP section 3: The host stores user passwords as triplets of the form { <username>, <password verifier>, <salt> } Password entries ...
2
votes
1answer
60 views

Weaknesses of RFC6628

In RFC6628 section 2.2, they say: w = The password remembered by the user. W = The password verifier registered in the ...
4
votes
1answer
188 views

Is it possible to find a Mersenne Twister seed given only the first output?

Suppose I have a Mersenne Twister seeded with some unknown value, and I’ve been given the first output. Given only this first output, and no other information, is it possible to derive the unknown ...
3
votes
1answer
102 views

Avalanche effect sample size

With a fixed key size – key has 128 bits, while block size is 8 byte – how do I calculate how many different keys and texts I have to test for an cryptanalytic statistics study? Differently worded: ...
14
votes
3answers
2k views

Why does SHA-1 have 80 rounds?

Why does SHA-1 algorithm have exactly 80 rounds? Is it to reduce collisions? If yes, then why do SHA-2 and SHA-3 have a lower number of rounds?
1
vote
1answer
86 views

Hypothetical encryption technique, is it secure?

This to me, sounds like a great idea, but with all rosy-tinted ideas it needs some grounding in reality. Here are the steps of the hypothetical system (with the hypothetical part highlighted): User ...
2
votes
0answers
89 views

RSA: special parameters construction

I have to show that the following construction of $q$ allows to factorize $N$ : $p \in \mathbb{P}$, the set of primes $q \gets p \cdot \left((p - 1)^{-1} \bmod e\right) \bmod e$ $k=1$ while $q \not ...
5
votes
0answers
135 views

How to break a columnar transposition cipher?

I'm currently studying for a cryptography exam. I've been given ciphertext that has been encrypted by a columnar transposition cipher. I've been given no shift key length or key word, the only thing I ...
2
votes
0answers
20 views

Does the length of the keyword used for keytable for Playfair matter?

So for Playfair, we choose a keyword and put that in the keytable with no duplicates. Then, we fill the rest of the table with alphabets in order that are not in the keyword without 'J'. Does the ...
2
votes
1answer
91 views

What is the difference between CPA and IND-CPA?

I am writing a paper and I got comments from the reviewer that I don’t really understand. Is there any difference between a CPA (Chosen Plaintext Attack) and IND-CPA (Indistinguishability under ...
8
votes
1answer
275 views

Quantum on hash

Perhaps this has been answered before. Grover's algorithm should result in a 256 bit hash being complexity 128 bits to crack. I was wondering, what if you had a 512 bit hash , and xor'd the lower 256 ...
1
vote
0answers
65 views

Powerline password conversion [closed]

I read this post from Ben Tasker describing how to take control of a powerline network. Since I am interested in security, I tried to do the same thing, to see if it was possible. I used Devolo ...
1
vote
1answer
143 views

Shared modulus attack on RSA

Consider a scenario in which a group of people use a common modulus $n$ in the textbook RSA crypto system, where $n=pq$, $p$ and $q$ are large distinct prime numbers. Is there any chance for an ...
8
votes
3answers
32k views

Possible ways to crack simple substitution ciphers

We had a quiz in class today where we had to break the ciphertext with the key given, but not the algorithm. Suffice to say that I wasn't able to decrypt it within the allotted time of 12 mins and ...
5
votes
2answers
71 views

Does $(u_1=r_1\cdot x,\ \ w_1=r_1\cdot z, \ \ u_2=r_2\cdot x,\ \ w_2=r_2\cdot z)$ Leak Information?

Consider we have a fixed value $x$. We pick values $ r_1,r_2,z\leftarrow \mathbb{F}_p$, where $p$ is a large prime number, and it is public. So $r_1,r_2,z$ are uniformly random values. We compute ...
4
votes
1answer
578 views

True Random Number Generator by milliseconds per keystroke (TRNG-Kms)

The simplest way to generate truly random numbers for OTP keys is to measure the time in milliseconds between each keystroke on a keyboard. The randomness depends on the user typing in various speeds. ...
-1
votes
1answer
83 views

How To prove Any Change to $v=a\cdot y+b$ maks $y=(a)^{−1}\cdot (v−b)$ Uni. random value [closed]

This question is related to data integrity. Let a finite field be $\mathbb{F}_p$, where $p$ is a prime number. I have a fixed value $y$ and two uniformly random values $a$ and $b$. Hypothesis: ...
4
votes
2answers
823 views

Is there a security analysis of CryptDB?

It's interesting to see critical thinking being applied to CryptDB in contrast to all the hoopla around it here. CryptDB is not a major theoretical breakthrough but potpourri of technologies to make ...
2
votes
2answers
46 views

(Uniformly) Random Value when an element is picked with $\frac{1}{p-1}- \frac{1}{(p-1)^2}\ $ probability

Let's $\mathbb{F}_p$ be a finite field where $p$ is a large prime number(e.g. 256-bit) I know if the probability that an element picked from the field is $\frac{1}{p-1}$ we say the element is picked ...
17
votes
1answer
6k views

Security strength of RSA in relation with the modulus size

NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits: ...
2
votes
3answers
125 views

How much processing power should you assume an attacker has?

The answer to this question says that you should assume an attacker can do one billion operations per second: Key Size for Symmetric Homomorphic Encryption Over the Integers Is that a single attacker ...
3
votes
1answer
51 views

Do $v_1=\alpha\cdot r_1$ and $v_2=\alpha\cdot r_2$ leak information about $\alpha$

Please consider we have finite field $\mathbb{F}_p$ for large prime number $p$. We have a fixed field element $\alpha$. By $r_i\leftarrow \mathbb{F}_p$ we mean we pick $r_i$ uniformly random from the ...
2
votes
0answers
31 views

Hash-values's length in identification schemes

I am trying to understand the impact of applying a hash function in an identification scheme. It makes reference to the publication "On the length of cryptographic hash-values used in identification ...
2
votes
1answer
158 views

Straightforward method for hampering frequency analysis on deterministic encryption

I'm brainstorming some different ways of making deterministic encryption more secure. I want to use deterministic encryption to preserve searchability over the keywords in a document set. However, I ...
4
votes
1answer
39 views

Given occasional LFSR samples can the next sample be computed?

Suppose I have access to an LFSR generator output used in a radio communications system, with the LFSR being used to authenticate devices. The system cycles an internal unknown length LFSR (greater ...
0
votes
1answer
85 views

How secure is this modified Bazeries Cylinder?

This device is a modification of the Bazeries cylinder, it has two stacks of 5 rotors which each bear two alphabets plus numbers 0-9, one in correct order and one in random order ( 36 characters in ...
10
votes
1answer
444 views

Does Curve25519 only provide 112 bit security?

In a recent mail on the IETF CFRG mailing list it was claimed that: The (currently missing) security considerations (or somewhere) should describe why Curve25519 is ok when used in contexts where ...
-2
votes
1answer
177 views

Having plaintext and ciphertext, how can I learn more about key/encryption?

I have an OLD work database that seems to have a simple encryption on the PW. I have one users whose pw is 7777 the cipher text is ...
4
votes
4answers
118 views

Shamir Secret Sharing: Why cannot we recover polynomial's root if we have $t-1$ shares?

Imagine we have $t-1$ shares in $(t,n)$ shamir secret sharing. So at least $t$ shares are needed. Question: Why cannot we use $t-1$ shares to find a root of the polynomial and then recover the ...
1
vote
1answer
97 views

Cryptanalysis of Marvin32 compared to SipHash

So I am curious about the security analysis of Marvin32, the randomized hash algorithm used in .NET (to prevent hash-table DoS). I found the source code here: ...
7
votes
1answer
2k views

Knowing pre-encryption data, can we find the private key CryptoLocker used?

One of our users seems to have been hit by CryptoLocker. As a result, he has a hard drive full of encrypted files. The ransom-ware claims to have used public key encryption on the files. If we know ...
0
votes
0answers
37 views

Is double encryption using AES using different key lengths (128 bit and then 256 bit) vulnerable? [duplicate]

I know that AES 256 bit is far more than enough to secure a file. I just want to know if there are any vulnerabilities or known attacks which can make such this combination less secure "double ...
2
votes
1answer
171 views

Recovering key length from transposition block cipher ciphertext

First of all I would like to say hello to all StackExchange users. So far I've been stalking the forum for some time, now it's time to leave the shadows. In my master thesis I'm writing about ...
3
votes
2answers
106 views

Combine two sha512 hashes to a single hash

Assume I have two data fragments: $Frag_1$ and $Frag_2$. I can build sha512 hashes the usual way with $SHA512(Frag_1)$ and $SHA512(Frag_2)$ and then hash the two fragments appended to each other: ...
2
votes
0answers
39 views

Is it possible to generate backdoored DH parameters?

I know it has been already asked and answered whether it's possible to generate weak DH parameters. But "recentely" we experienced the Logjam attack, which makes use of the pre-computation ...
4
votes
1answer
105 views

Hashing a Diffie-Hellman result

In many implementations, the result of the Diffie-Hellman algorithm is hashed. I read that: Hashing the shared secret point prevents an attacker from gaining more information about the EC private ...
3
votes
0answers
122 views

Small subgroup attack on Diffie-Hellman

I am trying to understand the small subgroup attack on Diffie-Hellman. I will present the attack and try to explain why it works. Let be a group $\mathbb{Z}_p^*$ where $p$ is a large prime, so the ...
4
votes
1answer
478 views

Understanding a Blowfish cryptanalysis

I'm reading a cryptanalysis on Blowfish, and I've come across something that I don't quite get. Let's denote $$\delta = a \oplus a'$$ where a and a' are bytes that cause a collision in some S-box ...
0
votes
0answers
32 views

how many pairs of plaintext-ciphertext are needed before we break AES? [duplicate]

Imagine a set of words ($plaintext$) each are encrypted using AES-ECB mode and due to some leakage in the system an attacker could gain access to some pairs of $plaintext$ and $ciphertext$. But once ...
4
votes
0answers
106 views

Would the encryption of bigrams and trigrams weaken the code?

Supposing a rotor machine of the 1940s or 50s, with 36 characters instead of 26. Would the encryption of the ten additional characters as the most frequent bigrams or trigrams weaken the code? What ...