Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

learn more… | top users | synonyms (1)

5
votes
1answer
688 views

What is the best method to determine the language used in a monoalphabetic substitution cipher?

Working on a cipher (which I assume to be a mono-alphabetic substitution cipher due to the letter frequency) I struggle with the fact that I don't know which language the plain text is written in. ...
5
votes
1answer
281 views

If a cryptanalytic breakthrough is made, what process should be followed?

If a researcher manages to make a cryptanalytic breakthrough on a cryptographic algorithm or protocol that is in use, what should they do? Has this ever happened before? What are the implications for ...
5
votes
1answer
161 views

Proof that Alternating Step Generator and modifed ASG' have equivalent security?

The Alternating Step Generator (ASG) is a PRNG combining 3 LFSRs. Output of the ASG is the XOR of the output of two clock-gated LFSRs. At each step, a single one of these LFSRs is clocked, according ...
5
votes
2answers
70 views

How does the split mask countermeasure work on AES?

I am trying to understand the split mask countermeasure which is a masking method to avoid side channel attacks. Let's first describe the principle and then try to apply it to AES. I found this paper ...
5
votes
1answer
114 views

Can somebody help me understand RC4 Spritz? (Three Questions)

So ever since I first took a stab at understanding stream Ciphers, not one stood out more than RC4, because it's so fantastically simple. As most people reading this will know, with its fantastic ...
5
votes
1answer
762 views

Security analysis of Spritz?

Recently, a new cipher called Spritz has been released by Ronald L. Rivest and Jacob Schuldt. It should be a "drop-in replacement" for RC4. There are many differences to RC4, Spritz is "spongy" and ...
5
votes
1answer
164 views

How to construct a next bit predictor from a distinguisher

I read the claim, without proof, that it is possible to construct a next bit predictor for any PRNG given an oracle distinguisher for that PRNG and vice versa. How do I prove that? A distinguisher ...
5
votes
1answer
116 views

Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?

I'm basically looking at this construction to turn a tweakable blockcipher $E_c(x)$ taking a key $k$, nonce $n$, counter $c$ (forming tweak $t = c||n$) and an input $x$ into a PRF on an ...
5
votes
2answers
887 views

Hill cipher, unknown letter value

I've been struggling on this problem for a while now : the Hill cipher is well-known to be vulnerable to known-plaintext attack due to its linearity. Given a key matrix $K$ of size $n\times n$, one ...
5
votes
1answer
855 views

Can cryptocurrency mining devices be used for cryptanalysis?

In the past year or so we have seen production of ASIC devices designed for mining of cryptocurrencies. These devices can perform SHA256 hashing at rates much higher than was seen in the past and are ...
5
votes
1answer
231 views

Questions on rank-attacks in Multivariate Cryptography

While reading this article on rank attacks on STS (a public-key scheme based on Multivariate Quadratic (MQ) equations), I stumbled upon some claims that I've also seen in other presentations on ...
5
votes
1answer
216 views

Why $e>n^{3/2}$ prevents Wiener's attack

Here's the Wiener's attack as I understand it. Suppose $n=pq$ with $q < p < 2q$, and $d < n^{1/4}/3$ where $ed=k\phi(n)+1$ and $e < \phi(n)$. $$\begin{align*} n-\phi(n) ...
5
votes
1answer
813 views

How to solve cipher encrypted with Vigenère + Columnar Transposition?

Vigenère's weakness is Kasiski's test and index of coincidence. However, if you put columnar transposition on top of Vigenère, that weakness is gone. The text is now shuffled and you can't search for ...
5
votes
0answers
139 views

help with cryptanalysis of a sponge permutation

I have been studying and researching hash functions. So far my research has led me to the sponge construction. It appears that the permutation used in the sponge to stir the state is more or less ...
5
votes
0answers
225 views

How to break a columnar transposition cipher?

I'm currently studying for a cryptography exam. I've been given ciphertext that has been encrypted by a columnar transposition cipher. I've been given no shift key length or key word, the only thing I ...
5
votes
1answer
308 views

Small subgroup confinement attack on Diffie-Hellman

I am trying to understand the small subgroup confinement attack on the Diffie-Hellman algorithm. I will present the attack and try to explain why it works. Small subgroup confinement attack on the ...
5
votes
0answers
110 views

Would the encryption of bigrams and trigrams weaken the code?

Supposing a rotor machine of the 1940s or 50s, with 36 characters instead of 26. Would the encryption of the ten additional characters as the most frequent bigrams or trigrams weaken the code? What ...
5
votes
0answers
114 views

Homogenous and heterogeneous Unbalanced Feistel Networks

Unbalanced Feistel networks can be homogenous (F-function identical in each round), or they can be heterogeneous (F-function not always identical in each round). The advantage of heterogeneous UFNs ...
5
votes
2answers
454 views

Tunnels used in md5

I'm reading the paper "Message Freedom in MD4 and MD5 Collisions: Application to APOP" about finding collisions for the MD5 hash algorithm involving the concept of tunnels as described in "Tunnels in ...
4
votes
4answers
559 views

Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?

For RSA cryptography, we know that the modulo $n$ is a product of two big prime numbers(say $p$ and $q$). However, in some documents I see an extension of $p=2p'+1$ and $q=2q'+1$ with $q'$ and $p'$ ...
4
votes
4answers
135 views

Shamir Secret Sharing: Why cannot we recover polynomial's root if we have $t-1$ shares?

Imagine we have $t-1$ shares in $(t,n)$ shamir secret sharing. So at least $t$ shares are needed. Question: Why cannot we use $t-1$ shares to find a root of the polynomial and then recover the ...
4
votes
2answers
506 views

Is this a structural weakness of Feistel networks?

I'm doing a lot of reading about Feistel networks. Something occurred to me a bit ago that I hadn't realized previously, namely that in any Feistel construction there are bits of the plaintext that ...
4
votes
2answers
3k views

How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?

Given a CBC ciphertext and IV, how can I find the encryption key? We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = ...
4
votes
2answers
882 views

What is the smallest plaintext/ciphertext size for an algorithm like?

When I read about a choosen plaintext attack, for example on AES the block size is always 128 bits, does it mean the attacker will only supply 128 bits data words as "plain text" ?
4
votes
2answers
120 views

Name and security of these non-invertible functions?

I would like to learn more about a specific set of non invertible functions: The function should accept 2 inputs: one hidden and the other visible. The output and the function should also be ...
4
votes
2answers
470 views

Is it generally possible to employ brute force methods when the encryption scheme is not known? Why or why not?

Lets say you are presented with an encrypted string of bits or text, and no other information. What would be necessary before you could apply brute force methods to decrypting the string? How would a ...
4
votes
2answers
90 views

Do we have anyway of knowing if avoiding self-permutation in RC4 makes it any stronger?

OK, so lots of questions get asked about RC4 but I want to make mine specific and hopefully answerable. RC4 Design as I'm sure anyone reading this knows, uses self permutation in stage 1 of the KSA. ...
4
votes
3answers
807 views

How to attack a fixed LCG with partial output?

To show some colleague programmers exactly how broken C's rand() is (at least on Windows) I decided to break it. So everyone knows the exact parameters, MSVC's ...
4
votes
2answers
3k views

AES-CTR vulnerability to cryptographic oracle

I am new to cryptographic issues and from what I googled so far I could not retrieve the information I need. Consider the use of AES-128 in CTR mode. Let M be the set of possible plaintexts, for ...
4
votes
2answers
230 views

Are there valid attacks on full SHA-1?

Google today announced they are sunsetting SHA-1. Its fine by me. But that made me realize I am not keeping up with the research on SHA-1. The Wikipedia page only says Stevens' attack is the most ...
4
votes
2answers
2k views

Cryptanalysis of Linear Feedback Shift Registers

It is well known that simple m-sequence linear feedback shift registers have a linear algebraic structure and therefore the generator seed can easily be deduced using the Berlekamp-Massey algorithm. ...
4
votes
3answers
321 views

How to encrypt data and know it will be secure for at least a few decades?

I want to encrypt a small amount (few kilobytes) of data and be fairly confident it will be secure against brute force decryption and advances in cryptanalysis for at least a a few decades (or more). ...
4
votes
2answers
2k views

Decrypting DES with decrypted and encrypted data [duplicate]

I got two 8-byte strings. One which is decrypted is: FF FF FF FF FF FF FF FF and one which is encrypted is: ...
4
votes
1answer
467 views

Why is it a bad idea to use a UTF-8 derived symmetric key?

Given a cryptographically secure series of octets, it is often useful to display this information or store it in a database in a textual format such as hexadecimal. Why would it be incorrect to take ...
4
votes
2answers
280 views

Why calculate pi to estimate randomness?

Why do testing suites calculate $\pi$ (pi) using the Monte Carlo method to determine if a series of numbers are random? As far as I can tell, the Monte Carlo method can be used to estimate $\pi$ ...
4
votes
2answers
524 views

Is Chaocipher a secure cipher under ciphertext-only attack?

Chaocipher was invented by John F. Byrne in 1919. The algorithm was recently revealed – see Moshe Rubin's Chaocipher Revealed, the Algorithm (PDF). While a known plaintext attack successfully finds ...
4
votes
3answers
5k views

Is javascript RSA signing safe?

I'm currently working on a secure open source messaging system (https://github.com/DSMNET/DSMNET). I'm currently using the cryptico.js (https://github.com/wwwtyro/cryptico) library to encrypt all the ...
4
votes
2answers
429 views

Source for examples with broken cryptography

I've heard again and again that many crypto systems have been broken in the past for one reason or another and that it is best to use one that has been peer reviewed, etc etc. However, I've yet to see ...
4
votes
2answers
847 views

Is there a security analysis of CryptDB?

It's interesting to see critical thinking being applied to CryptDB in contrast to all the hoopla around it here. CryptDB is not a major theoretical breakthrough but potpourri of technologies to make ...
4
votes
2answers
2k views

How can I break a Vigenère cipher with partial plain text?

I have an exercise to do regarding Vigenère encryption. I've got the cipher text: WNZTNVIEEGTJYKRRWYUELWNZTNV and a partial plain text: ...
4
votes
1answer
185 views

When all shares of a secret are given to adversary as a permuted matrix

Suppose we have a secret $\sigma$. The secret comes from a universe in which the elements are not necessarily distributed uniformly. We split $\sigma$ into $n$ shares $[\sigma_1,...,\sigma_n]$ ...
4
votes
2answers
232 views

Can Grover's Algorithm be combined with a meet-in-the-middle attack?

We all know and love the meet-in-the-middle attack which basically makes double encryption pointless using a time-memory-tradeoff. Now there was recently the recommendation by the NSA to use double ...
4
votes
1answer
712 views

Recent attacks on RSA

At Blackhat 2013 this week, there was a talk saying RSA is (essentially) doomed in the near future. networkworld.com ~ “Black Hat: Elliptic curve cryptography coming as smarter algorithms threaten ...
4
votes
1answer
234 views

How can we determine if two discrete logarithms are equal?

Let $p$ be a prime number, and let $g_{1},g_{2},...,g_{n}$ be $n$ generator of $Z^{*}_{p}$. We have a list $y_{1},y_{2},\dotsc,y_{n}$ of elements in $Z^{*}_{p}$ such that for every $i\in ...
4
votes
4answers
2k views

Assistance Cracking Classical Cipher

Below is the cipher text I am trying to break and as you can see its rather short which is why I am having so much trouble. ...
4
votes
1answer
640 views

Differential cryptanalysis - breaking the last round of FEAL4?

I've been trying to learn cryptanalysis. I've come across this resource which proved very helpful: http://theamazingking.com/crypto-feal.php So far I've been almost successful in breaking FEAL4 ...
4
votes
1answer
230 views

Is the last step of an iterated cryptographic hash still as resistant to preimage attacks as the original hash?

Considering a cryptographic hash, such as MD5 or SHA2, denoted by the function $H(m)$ where $m$ is an arbitrary binary string, there is a lot of material available that deals with potential weakness ...
4
votes
2answers
128 views

Does knowing multiple hash of the same content make it more likely to generate original plain text?

Say I'm trying to brute force the original plain text of an SHA256 hash, does knowing the RIPEMD160 hash of the same text help? In other words, does providing access to hash values of the same text ...
4
votes
1answer
720 views

Is XOR in a CBC-like mode secure?

Assuming that $K_{n}$, $P_{n}$, and $C_{n}$ are individual bytes of the key, plaintext, and ciphertext respectively. The first byte of ciphertext is computed like this: $C_{1} = K_{1} \oplus P_{1}$ ...
4
votes
1answer
400 views

How was the complexity of the Biclique Attack calculated?

The abstract of the Biclique Attack paper claims: The first key recovery attack on the full AES-128 with computational complexity $2^{126.1}$. What does $2^{126.1}$ mean in this context? And ...