Questions tagged [cryptanalysis]
Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).
1,562
questions
5
votes
2
answers
249
views
In a PGP like Application , would compress and encrypt leak information
would compress and encrypt on data comromise security for PGP like application, would it be secure for use in Encrypted Messaging?
I have heard its safe for data at rest encryption , i have heard ...
6
votes
1
answer
266
views
A modern rotor machine, could it be any safe?
I wonder if a rotor machine similar to enigma can be considered secure by today's standards under four conditions:
A rotor machine which consists of 50 rotors picked out of a set of 100.
A rotor ...
2
votes
1
answer
79
views
Significance of theoretical weaknesses?
What is the significance of theoretical weaknesses?
Any real life incident where a theoretical weakness was ignored and later it compromised the system? Whats the dividing line between theoretical and ...
- 2,427
1
vote
1
answer
240
views
What are the best known cryptanalytic attacks against AES-128 with 9 rounds?
What are the best known cryptanalytic attacks against AES-128 with 9 rounds?
I found many such attacks on AES-192 and AES-256 with 9 rounds, but not for AES-128 with 9 rounds.
Are there any ...
- 47
1
vote
0
answers
58
views
By using a block cipher multiple times in a row is a 128-bit BC as secure as a 256-bit BC which uses his 128-key only as part of the message?
For given 128-bit numbers $S$ and $E$ we want to find a series of keys $k_i$ with
$$ E = BC(BC(BC(.....BC(S, k_1),k_2) ..k_n)$$
We can either use a 128-Bit blocksize block cipher similar to AES (ECB ...
- 453
1
vote
1
answer
92
views
How does the security of AES change if we allow multiple uses in a row? How does it change if we limit the key space? And introduce a filter function?
$$f_0 = A$$
$$f_{n+1}=AES(f_n,k_n)$$
$$f_i = B$$
For given 128-bit values $A, B$ we want to find a chain of suitable 128-bit keys $k_1$ to $k_i$.
The total length $i$ is undetermined. Every valid key ...
- 453
3
votes
1
answer
530
views
Why is the best way to solve LWE (and Cryptographic related Systems) with SVP (approx)?
Community,
I'm new into lattice based cryptography, and I'm interested about the security of cryptography schemata like Kyber and why the focus of solving this problem lead into solving approx. SVP.
...
- 65
1
vote
1
answer
310
views
Best attack estimates on AES
The wikipedia article on the Advanced Encryption Standard claims an attack against AES-128 with complexity $2^{126.1}$. The NIST call for proposals for post-quantum cryptography (table on page 18) ...
- 845
0
votes
0
answers
85
views
Security proof of the Schnorr Signature
How Schnorr signature security can be proved for signature forgery, replacement, and Replay attacks?
- 1
1
vote
0
answers
69
views
Non-uniform plaintext distribution -- AES attack
Are their any attacks on AES (any mode) in which before the attack is mounted, the adversary is aware that the input distribution is non-uniform?
Most of the work assume that the plaintext is ...
- 31
2
votes
0
answers
105
views
Automated Security Protocol tool that models algebraic operations
Are there any automated security protocol verification tools that model algebraic operations; specifically addition.
I am familiar with AVISPA and Verifpal, and they are both great and user-friendly ...
- 197
1
vote
2
answers
99
views
How fast does revealing parity bits leak information?
I've got a scheme where I XOR a secret key value with a public (but random) value, XOR together all the bits of the result, and publish that bit (0 or 1), which is the parity of the result of the XOR. ...
- 111
5
votes
0
answers
609
views
How the mimc bug from circomlib was safely exploited to fake the merkle root in the witness in practice?
Several years ago, there was an unenforced constraint on verification in the cirmcomlib library : a tool for building projects using ZsNarks. The error allowed to forge cryptographic nullifiers/proofs ...
- 240
2
votes
1
answer
138
views
How bad exactly are repetitions in the plaintext?
When the last n bytes of the plaintext are themselves suitably random, but predictably repeat m times in the same message - how bad is that? I'm convinced it is detrimental, but I am uncertain how ...
- 144
1
vote
0
answers
93
views
RSA decryption problem knowing public key and ciphertext [closed]
new member here.
I am taking a course in computer security, and we just got introduced in Cryptography and especially in RSA Algorithm. Although i got the 'basic idea' behind the RSA algorithm and the ...
2
votes
1
answer
184
views
Info AES cryptanalysis
I have some doubts regarding AES weakness and AES cryptanalysis. While it is relatively simple to find Cryptanalysis info on previous ciphers, I get confused about understanding various types of ...
- 71
1
vote
1
answer
32
views
Statistical closeness of distributions and time-unbounded distinguisher
If two ensembles are statistically indistinguishable, we all know that they are also computationally indistinguishable, i.e., for any PPT algorithm, the probability to distinguish them is negligible.
...
- 113
0
votes
2
answers
87
views
What is the standard checklist for designing a Key Derivation Function?
What kinds of properties does a KDF need to have in order to be considered secure? What steps should be taken during analysis to test for flaws?
In particular, I mean a KDF that is going to be used as ...
- 33
2
votes
1
answer
320
views
How to solve this Baby Bleichenbacher Attack?
I am trying to solve this problem from https://toc.cryptobook.us/book.pdf.
I am having trouble with this question :
(Baby Bleichenbacher attack). Consider an RSA public key (n, e), where n is an RSA
...
- 21
0
votes
1
answer
133
views
How do I know the most efficient image encryption algorithm?
I am familiar with any algorithm that is based on the number of bits in a key (n-bit) and how to restore a key, such as the Discrete Logarithm Problem or Factorization.
When I use any algorithm for ...
- 451
2
votes
1
answer
559
views
A probable attack for RSA (factorization): how to improve it?
A probable attack for RSA (factorization): how to improve it?
$N=8*G+3$ can be factored if there is a non-trivial negative $k$ such that
$\frac{(N*(9+24*k)-3)}{8}=-6*m^2 $
[to exclude the two trivial ...
2
votes
1
answer
334
views
Is it safe to initialize a random number generator with MD5?
The MD5 algorithm is no longer considered secure for most applications of a hash algorithm. However, is it safe to initialize a PRNG via a password?
If it is not, how could it be exploited?
0
votes
0
answers
63
views
What kind of special numbers are not suitable as RSA keys?
I have read that some integers are not appropriate to be chosen as the modulus in an RSA cryptosystem. Some of these numbers are those that, given a modulus $n=pq$, then $p-1$ or $q-1$ do not have ...
0
votes
0
answers
43
views
How to compute $x_0$ in Chaotic Logistic map in special method?
I know that the Chaotic Logistic map is $x_{n+1}=Rx_n(1−x_n)$. I read some articles about the Chaotic Logistic Map, but some things are not clear. Someone wrote in his article the following: The ...
- 451
1
vote
0
answers
59
views
Using multiple asymmetric keys as backups for one another
I've been thinking about ways to take advantage of multiple asymmetric encryption schemes so that each key could be a backup to the others in case of cryptanalysis of one given scheme.
Those public ...
- 11
2
votes
0
answers
56
views
Is there a way of mitigating weak states in the Spritz stream cipher algorithm?
The Spritz stream cipher algorithm has been shown to have a special class of states that can be used to do a full state recovery attack better than brute force.
While the authors of the paper clearly ...
- 307
2
votes
0
answers
114
views
Textbook RSA with $e=3$ and short random message
This is a simplified version of a question I made long ago, that never got an accepted answer.
It's given $N$ of $n=2048$ bit, assumed hard to factor, which two prime factors each are $\equiv2\pmod3$, ...
- 141k
2
votes
1
answer
646
views
Breaking RSA with P,Q LSB bits
Let's say we have a certain amount of LSB bits of P and Q and we want to fully reconstruct them given N=P*Q. I know this problem was studied in literature by Coppersmith and that Lattice methods are ...
- 31
0
votes
0
answers
97
views
Provably secure and Practical ciphers
Are there any ciphers that are
provably secure (reducable to a hard problem (including like factorization, not necessarily to NP-Complete or harder) )
are practical (not necessarily for too much ...
- 41
0
votes
2
answers
78
views
Recovering original bit vectors that constituted XORed binary vectors
I am trying to unscramble received data packets. Each packet is divided into 3 parts ($A$, $B$ and $D$) with equal lengths. In every packet, each of these parts are scrambled/encrypted with an unknown ...
- 109
2
votes
3
answers
318
views
LWE with a binary matrix A
In LWE, we know that given reasonable public parameter $A\in \mathbb{Z}_q^{n\times \lambda}$, secret $s\in \mathbb{Z}_q^{\lambda}$ and noise $e\in \mathcal{X}^{n}$, random $r\in \mathbb{Z}_q^{n}$, $(A,...
- 33
1
vote
1
answer
102
views
Do snapshots of Encrypted Disk Images weaken security?
I have read/write disk images encrypted with 128 AES using Mac's disk utility. If I snapshot the encrypted disk images daily (sometimes with changes other times without), and an attacker has access to ...
1
vote
2
answers
249
views
Problem with implementation of Enigma Machine
I'm having trouble making an implementation of Enigma Machine in VBA. My question is about implementing the rotors and their move.
To be more precise, I will show below the way that I code my Enigma ...
- 11
0
votes
1
answer
591
views
Is Mersenne Twister hard to break if it has a reduced output?
I was reading this challenge, which proposes to clone (or recover) the internal state of the MT19937 just by applying the inverse process to each output (624 consecutively words).
Mersenne Twister's ...
- 1
6
votes
0
answers
135
views
About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?
Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$
with
$$p=(p_1, p_2)$$
$$q=(q_1,q_2)$$
$$p_1,q_1 \in [0,s)$$
$$p_2,q_2 \in [0,s^2)$$
We want to find a path in between ...
- 453
3
votes
1
answer
82
views
Why would the same cipher structure have a different optimal attack for different bit widths?
I'm going to use the Simon Cipher as an example, but I want to frame the question to be more general. Why would the same cipher structure have a different optimal attack for different bit widths? I ...
- 4,820
0
votes
1
answer
270
views
Why is ShiftRow important in AES?
I came across a comment about AES 128 without ShiftRow. I want to use this weakness to perform an attack. So far, I get that It possible to divide in 4 independent blocks of 32 bits. So we can launch ...
- 1
1
vote
1
answer
566
views
Linear cryptanalysis resistance of AES Sbox
If you look at the AES Linear Approximation Table (computed for example with Sage) you will see there are many entries with what looks like a high bias of -16 ("absolute bias" scale).
I ...
- 47
0
votes
0
answers
161
views
What is digram analysis?
so I wanted to ask something since I just learned about cryptography. Here where I have the task to write an essay on cryptography and the title I have to do is introduction digram analysis. However, ...
- 1
2
votes
0
answers
98
views
Scyther related questions for handling/splitting values and verifying hashes
While implementing a protocol in Scyther, I need help with the following questions -
How do we split a particular message/variable into two parts in Scyther?
(For eg. if I have value R in my protocol ...
- 53
1
vote
1
answer
158
views
Differential cryptanalysis - how to extend the attack to rounds before the last?
Suppose that we have a block cipher such that the last round of the cipher depends on half of the key and the penultimate round uses the other half.
Suppose also that I attacked the last round using ...
- 47
0
votes
0
answers
288
views
Attack against stream cipher (LFSR with ASCII)
I'm reading Understanding Cryptography by Christof Paar and Jan Pelzl. In chapter 2 (Stream Ciphers) there's a question that goes like this:
Assume we have a stream cipher whose period is quite short....
- 123
2
votes
1
answer
110
views
For any numbers $a, b$, what are the operators $X, Y$ such that revealing $a\ X\ b$ and $a\ Y\ b$ doesn't reveal info about $a,b$?
Previously I thought about a pair of 8-bit uniformly distributed random numbers $(a,b) \in \{0,1\}^8$, and $X$ to be bitwise XOR, $Y$ to be 8-bit addition. But it turned out that revealing $a \text{ ...
- 573
2
votes
3
answers
241
views
What does $(a+b) \bmod{256}$ and $a$ XOR $b$ reveal about $a, b$?
Say $a$ and $b$ are some uniform random $8$ bits so that the entropy of $a$ and $b$ is 8 bits each.
If I show you $(a+b) \bmod{256}$ and $a$ XOR $b$, then what can you tell about $a$ and $b$? Or how ...
- 573
-1
votes
2
answers
147
views
predict random keys using python [closed]
How can I write a program in python to predict the random key (urandom) that is used for encryption? I tried to search and I couldn’t find anything related to guessing and predicting urandom in python
- 17
0
votes
0
answers
113
views
Hashing and Password Cracking
I was playing a game on cryptography where I encountered this problem:
Hashed Value of password: 24 109 76 35 22 94 83 25 106 104 73 87 56 38 56 50 10
92 58 84 44 88 24 112 125 121 125 43 122 55 106 ...
- 111
5
votes
1
answer
319
views
Which is the smallest, cyclic in 3 directions, consistent structure of random values which can be hidden at the adversaries machine? (some comparison)
Or more general each member can be part of up to three 2D locally euclidean planes of 2 different dimensions each.
(each of those planes is cyclic in two orthogonal directions, like a torus)
Given ...
- 453
1
vote
0
answers
59
views
Can I decrypt AES-CBC ciphertext if I have the key without IV? [duplicate]
Can I decrypt ciphertext from AES-CBC encryption, if I have the key and ciphertext only?
- 17
4
votes
1
answer
222
views
What is the effect of low rank dual sublattices on the dual lattice attack on LWE?
In the dual lattice attack of Espitau, Joux and Kharchenko (On a dual/hybrid approach to small secret LWE), the authors propose distinguishing (and subsequently recovering secret values) of LWE ...
- 23.9k
0
votes
1
answer
94
views
Computational indistinguishability of two LWE type samples
Consider the problem of distinguishing between polynomially many samples of either
\begin{equation}
(x, b, As + e) ~~\text{or}~~\left(x, b, ~Ax + b\cdot(As + e) + e'\right).
\end{equation}
Here, $A$ ...
- 103