Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

learn more… | top users | synonyms (1)

6
votes
4answers
233 views

Changing algorithms during encryption

Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption. For example,...
6
votes
2answers
222 views

How are constructs with data-dependent swaps and rotations cryptanalyzed?

Linear and differential cryptanalysis seem well suited for constructs with a (relatively) simple fixed structure of boolean expressions. But some ciphers incorporate swaps of array elements where the ...
6
votes
3answers
9k views

Can Pre-Paid Cards be cracked?

Is it possible to deduce the original function that used to generate those prepaid cards number that are used for charging your mobile phone credits? For example: If I've collected about 1000 of ...
6
votes
3answers
777 views

Rainbow table for DES with all-zero plaintext?

Consider the function $F$ from $\{0,1\}^{56}$ to $\{0,1\}^{64}$, mapping the operative bits of a DES key to the ciphertext for all-zero plaintext. How could we organize a rainbow table to invert that ...
6
votes
2answers
120 views

RSA: Proving that $p+q-1 < 3 \sqrt{N}$, where N = pq and p,q are prime?

I'm doing some research into attacks on the RSA cryptosystem and have stumbled across Wiener's attack. Within the proof there exists the statement "$p+q-1 < 3\sqrt{N}$". No proof is given for this,...
6
votes
1answer
288 views

RSA exhibits symmetrical properties — is it possible to form a cryptanalytic attack?

This question is broken into two sections really: Symmetry in RSA I have been analyzing raw RSA and I have noticed some interesting symmetrical properties of the algorithm. Assume that $M$ is a ...
6
votes
4answers
475 views

Why to try get key out of white box crypto? How can one protect WBC itself?

Help me understand the following. With WBC the question is mainly being stated as can one try to break WBC to identify the key. My question is: Why would one ever want to do that anyways? If one can ...
6
votes
3answers
2k views

Understanding CRC [closed]

There are zillions of articles describing CRC. What can I read to (more deeply) understand what's really going on? Both from an algebraic perspective and a bit-manipulation perspective, I'd like to ...
6
votes
2answers
2k views

Brute forcing CRC-32

I'm working on a cryptosystem which uses IDEA. The designer made the mistake of including a CRC-32B hash of the password unencrypted in the header, so that the system can quickly reject bad passwords....
6
votes
2answers
243 views

Can Grover's Algorithm be combined with a meet-in-the-middle attack?

We all know and love the meet-in-the-middle attack which basically makes double encryption pointless using a time-memory-tradeoff. Now there was recently the recommendation by the NSA to use double ...
6
votes
2answers
428 views

Cryptanalysis and weaknesses of SEED cipher

I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've ...
6
votes
1answer
424 views

Can a nested block cipher avoid the meet in the middle attack by using a secret initialization vector for the inner encryption?

It seems to be believed that encrypting twice with a block cipher using an independent key each time is not as secure as you might expect because of the "meet in the middle" attack. This is an attack ...
6
votes
1answer
521 views

Would RSA-encrypting a private key for itself constitute a vulnerability?

I'm planning to encrypt some individual files for storage, using the GnuPG implementation of RSA. If I happened to encrypt the private key corresponding to the public key used for encrypting -- either ...
6
votes
1answer
182 views

Can it ever be impossible to invert a PRNG?

I've read about the possibility of inverting the Mersenne Twister after 624 numbers of output. 624 matches the state size of my implementation of the Twister. Coincidence? If the generator only ...
6
votes
2answers
497 views

For public-key encryption, why does COA resistance imply CPA resistance?

My professor told me: If a public-key crypto-system is secure against ciphertext-only attacks, then it is also secure against a chosen-plaintext attack. Why is this true? Is there a proof that ...
6
votes
2answers
360 views

Analysis of Repeatedly Enciphered Plaintext using Same Algorithm / Key

Please forgive the impracticality of this question, but I'm curious about the behaviors of encryption algorithms applied to their own output. Suppose I have an encryption algorithm E and (using the ...
6
votes
1answer
158 views

What if the p and q used in keys generation of Pailler cryptosystem are composite?

I've seen a few implementations of Paillier cryptosystem that uses probable primes to choose $p$ and $q$. Assuming that a keypair is generated with $p$ and $q$ that are coprime and that $pq$ is ...
6
votes
2answers
170 views

Advantages of making streamcipher stream depend on plaintext?

Most descriptions that explain how streamciphers work (like the one on Wikipedia), tend to describe a model that boils down to a simple “$ciphertext = plaintext \oplus stream$”, where the stream is ...
6
votes
1answer
490 views

Message space in security definitions

What is the message space in the following example and how does a message space relate to a security definition? I mean, what difference does it make to such a definition if your message space is $\{...
6
votes
1answer
163 views

What's the state of the attack to get the first pre-image on MD4?

What's the state of the attack to get the first pre-image on MD4? Is it still $2^{102}$ as described by Gaëtan Leurent in "MD4 is Not One-Way" ?
6
votes
1answer
167 views

Are there any tools for expressing the cipher operations as a system of equations?

The first step In Algebraic-attack is expressing the cipher operations as a system of equations. Is there an automated tool to do this?
6
votes
1answer
280 views

Is it possible to find a Mersenne Twister seed given only the first output?

Suppose I have a Mersenne Twister seeded with some unknown value, and I’ve been given the first output. Given only this first output, and no other information, is it possible to derive the unknown ...
6
votes
1answer
393 views

Is it a requirement to understand mathematics when implementing (or breaking) cryptography?

Related: What is the lowest level of mathematics required in order to understand how encryption algorithms work? and Recommended skills for a job in cryptology In the context of putting crypto into ...
6
votes
1answer
2k views

Get RSA PlainText without Knowing Private Key

If I have an algorithm,RSA-Crack(), that, for a given RSA public key (n,e), is able to decrypt 1% of the messages encrypted with that key (without knowledge of the corresponding private key).Can there ...
6
votes
1answer
310 views

Attacking a hardware AES implementation if it leaks the intermediate round states

Let's say that we have a hardware AES implementation that, on request, will encrypt or decrypt a 16-byte block of data in ECB mode using a fixed key, but refuses to reveal its fixed key. In other ...
6
votes
1answer
543 views

Crack linear congruential generator knowing every other word in sequence

I need to crack one of the example of linear congruential generator. I have $X_{n+1} = (a \cdot X_n + b) \bmod m$ and I know every other word in the output sequence: ..., 3158, ..., 1888, ..., 1285,...
6
votes
1answer
318 views

Difference between actual attacks and theoretical attacks on SHA cryptographic series

Could anyone tell me what the difference is between a theoretical attack (Like the one done on SHA-1) and an actual, practical attack (Like the one done on SHA-0)? Is a theoretical attack a proposed ...
6
votes
0answers
240 views

Parallel Pollard's Rho: Number of distinguished points

When using the parallel version of Pollard's Rho algorithm for discrete logs, each processor performs its own random walk to find distinguished points, and reports the starting point and the ...
5
votes
3answers
1k views

A simple block cipher based on the SHA-256 hash function [duplicate]

I've come up with this little routine for doing encryption using the SHA-2 (in this case SHA-256) hash function. As such it is a block cipher with a 256 bit (32 byte) block size and an arbitrary key ...
5
votes
2answers
3k views

How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?

Given a CBC ciphertext and IV, how can I find the encryption key? We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = 2^{...
5
votes
1answer
428 views

Purpose of expanding then shrinking in SHA-1

What is the purpose of expanding then shrinking in SHA-1? Does it serves any security purposes?
5
votes
2answers
1k views

DES — Can I recover the key when I have both ciphertext and the plaintext?

Given a message and DES encrypted form of said message, is it possible to efficiently compute the key used to encrypt the data?
5
votes
2answers
95 views

Would adding daily changing nulls in front of their messages have made the Engima harder to crack?

The British decrypted the German enigma because they knew that they would repeat the message key twice at the start of every message. Of course, technology to encrypt enigma without the repetition ...
5
votes
2answers
547 views

Is Chaocipher a secure cipher under ciphertext-only attack?

Chaocipher was invented by John F. Byrne in 1919. The algorithm was recently revealed – see Moshe Rubin's Chaocipher Revealed, the Algorithm (PDF). While a known plaintext attack successfully finds ...
5
votes
5answers
528 views

Is there a technique to confirm that a given large integer value is a product of two primes?

Given a list of 2048 bit integer values in which one or few 2048 bit integer values may be product of two prime numbers and other values may be just 2048 bit odd integers numbers. My question is - ...
5
votes
2answers
328 views

Why is it said that if we have a duplicate ciphertext block it can leak our information?

I have been recently going through a question: http://security.stackexchange.com/questions/15767/what-do-key-size-and-block-size-mean-in-cryptography and it created in me a series of doubts. Referring ...
5
votes
1answer
506 views

What is 'security margin'?

I have been academic papers about Rijndael, Serpent, and Twofish, and there is this term that is vague to me. I cannot find a tangible definition in google. Can someone briefly define, describe, and/...
5
votes
2answers
124 views

Data Leakage and Data Switching

I have two secret values $a$ and $b$ (i.e. they are arbitrary values). I mask them as follow: $v_1=r_1a+r_2$ $v_2=r_1(b-a)$ where $r_1$ and $r_2$ are uniformly random values. I send $v_1$ and $v_2$ ...
5
votes
2answers
181 views

ML/NN Cryptanalysis

Is it computationally plausible to use NN/ML to do any of the following tasks? "Real" cryptanalysis. Cyclic neural networks for extended computation, but break the hash all the way through. ...
5
votes
1answer
217 views

How can I break this encryption scheme?

Let $p$ be a large public prime. Alice holds a private key $(e_1,d_1) \in Z_{p-1}^*$ such that $e_1 d_1 = 1 \mod {p-1}$. Bob also holds a different private key $(e_2,d_2)$ with the same property. Let'...
5
votes
1answer
2k views

Known Plaintext attack against XTEA?

I'm looking for information on known-plaintext attacks against XTEA. I'm most interested in the worst case scenario: if an attacker has all 8 bytes of input and all 8 bytes of output, how much ...
5
votes
2answers
73 views

Does $(u_1=r_1\cdot x,\ \ w_1=r_1\cdot z, \ \ u_2=r_2\cdot x,\ \ w_2=r_2\cdot z)$ Leak Information?

Consider we have a fixed value $x$. We pick values $ r_1,r_2,z\leftarrow \mathbb{F}_p$, where $p$ is a large prime number, and it is public. So $r_1,r_2,z$ are uniformly random values. We compute ...
5
votes
1answer
317 views

Why doesn't this replay attack work on ECDSA?

I've just started working with elliptic curves and ECSDA in particular, so my understanding of the underlying math isn't great. The thing I'm currently stuck on is trying to understand why replay ...
5
votes
1answer
232 views

What are the consequences of a MAC tag collision?

I've seen some proofs of MAC security that are based on the extremely-unlikely event that two MAC tags collide (ie, they are equal for distinct messages). Suppose that this extremely unlikely event ...
5
votes
1answer
839 views

If the PSK is known, is it possible to decrypt traffic from other clients in a WPA2 wlan network?

If in a public WLAN WPA2-PSK is used, but the PSK is more or less publicly available, does this mean that an attacker with that PSK can easily decrypt wlan traffic from/to other clients of that WLAN? ...
5
votes
1answer
107 views

Backdoor in NIST elliptic curves

Let $E$ be an elliptic curve defined over a finite field $F_q$ with prime order $n$ and $P,Q \in E$ and $k$ be private key such that $kP=Q$. Since $n$ is prime, $E$ is isomorphic to $Z_n$. Suppose $\...
5
votes
2answers
604 views

Can you break a multi language code using Frequency analysis?

Let say that I wrote a 26 letter alphabet, each letter of my alphabet represent a letter from the latin alphabet. I'm writing in 3 languages, only I know which languages. Grammar is the one from my ...
5
votes
2answers
439 views

Security of tokenization of plain text conversations - cryptanalysis

I came across a marketing video here. They claim to perform AES encryption and tokenization of sensitive data, at the corporate gateway, before it leaves the company firewall destined for the public ...
5
votes
1answer
1k views

Example of CHI Square test on Caesar Cipher?

I am trying to get my head round the chi square test, when used with the Caesar cipher. I started off using this formula, $$ X = \sum_{i = 1}^k \frac{f_i · f'_i}{n · n'} $$ Where $...
5
votes
1answer
79 views

Correlation Immunity Of 4 bit S Box

I have a 4 bit S Box byte[] S = new byte[16] { 0x9, 0xE, 0x5, 0x6, 0xA, 0x2, 0x3, 0xC, 0xF, 0x0, 0x4, 0xD, 0x7, 0xB, 0x1, 0x8 }; How can i calculate Correlation ...