Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

learn more… | top users | synonyms (1)

4
votes
2answers
284 views

Why calculate pi to estimate randomness?

Why do testing suites calculate $\pi$ (pi) using the Monte Carlo method to determine if a series of numbers are random? As far as I can tell, the Monte Carlo method can be used to estimate $\pi$ ...
3
votes
1answer
92 views

Is there any benefit of changing the AES-CCM encryption key periodically even if the Nonce space is not exhausted yet?

I would like an answer that could be sustained by a mathematical proof. Let's say I'm using AES-CCM to encrypt a lot of messages, and I always use a different nonce. I know that when the nonce space ...
1
vote
1answer
139 views

How to prove that the Permutation cipher is not CPA secure?

Encryption scheme is called a permutation cipher if every plaintext string with letters $a_1,\ldots, a_n$ is encrypted as $a_{\pi(1)}, \ldots, a_{\pi(n)}$ for some (not necessarily uniform) ...
2
votes
1answer
40 views

Data Switching and Information Leakage

Hypothesis: Let $z,a$ be uniformly random elements of a field $\mathbb{F}_p$ where $p$ is a large prime number. Also, let $(-z)$ be additive inverse of $z$. I have a fixed secret value $x$. I mask ...
34
votes
10answers
8k views

Now that quantum computers have been out for a while, has RSA been cracked?

D-wave systems has released a commercially viable quantum computer. This means in theory, that all asymmetric encryption algorithms — such as RSA — are now useless due to the speed at which quantum ...
4
votes
2answers
108 views

Weakness of SRP after server compromise

From SRP section 3: The host stores user passwords as triplets of the form { <username>, <password verifier>, <salt> } Password entries ...
2
votes
1answer
61 views

Weaknesses of RFC6628

In RFC6628 section 2.2, they say: w = The password remembered by the user. W = The password verifier registered in the ...
3
votes
1answer
134 views

Avalanche effect sample size

With a fixed key size – key has 128 bits, while block size is 8 byte – how do I calculate how many different keys and texts I have to test for an cryptanalytic statistics study? Differently worded: ...
15
votes
3answers
2k views

Why does SHA-1 have 80 rounds?

Why does SHA-1 algorithm have exactly 80 rounds? Is it to reduce collisions? If yes, then why do SHA-2 and SHA-3 have a lower number of rounds?
1
vote
1answer
102 views

Hypothetical encryption technique, is it secure?

This to me, sounds like a great idea, but with all rosy-tinted ideas it needs some grounding in reality. Here are the steps of the hypothetical system (with the hypothetical part highlighted): User ...
2
votes
0answers
92 views

RSA: special parameters construction

I have to show that the following construction of $q$ allows to factorize $N$ : $p \in \mathbb{P}$, the set of primes $q \gets p \cdot \left((p - 1)^{-1} \bmod e\right) \bmod e$ $k=1$ while $q \not ...
5
votes
0answers
280 views

How to break a columnar transposition cipher?

I'm currently studying for a cryptography exam. I've been given ciphertext that has been encrypted by a columnar transposition cipher. I've been given no shift key length or key word, the only thing I ...
2
votes
0answers
21 views

Does the length of the keyword used for keytable for Playfair matter?

So for Playfair, we choose a keyword and put that in the keytable with no duplicates. Then, we fill the rest of the table with alphabets in order that are not in the keyword without 'J'. Does the ...
2
votes
1answer
102 views

What is the difference between CPA and IND-CPA?

I am writing a paper and I got comments from the reviewer that I don’t really understand. Is there any difference between a CPA (Chosen Plaintext Attack) and IND-CPA (Indistinguishability under ...
8
votes
1answer
279 views

Quantum on hash

Perhaps this has been answered before. Grover's algorithm should result in a 256 bit hash being complexity 128 bits to crack. I was wondering, what if you had a 512 bit hash , and xor'd the lower 256 ...
1
vote
0answers
70 views

Powerline password conversion [closed]

I read this post from Ben Tasker describing how to take control of a powerline network. Since I am interested in security, I tried to do the same thing, to see if it was possible. I used Devolo ...
1
vote
1answer
208 views

Shared modulus attack on RSA

Consider a scenario in which a group of people use a common modulus $n$ in the textbook RSA crypto system, where $n=pq$, $p$ and $q$ are large distinct prime numbers. Is there any chance for an ...
5
votes
2answers
71 views

Does $(u_1=r_1\cdot x,\ \ w_1=r_1\cdot z, \ \ u_2=r_2\cdot x,\ \ w_2=r_2\cdot z)$ Leak Information?

Consider we have a fixed value $x$. We pick values $ r_1,r_2,z\leftarrow \mathbb{F}_p$, where $p$ is a large prime number, and it is public. So $r_1,r_2,z$ are uniformly random values. We compute ...
4
votes
1answer
672 views

True Random Number Generator by milliseconds per keystroke (TRNG-Kms)

The simplest way to generate truly random numbers for OTP keys is to measure the time in milliseconds between each keystroke on a keyboard. The randomness depends on the user typing in various speeds. ...
-1
votes
1answer
85 views

How To prove Any Change to $v=a\cdot y+b$ maks $y=(a)^{−1}\cdot (v−b)$ Uni. random value [closed]

This question is related to data integrity. Let a finite field be $\mathbb{F}_p$, where $p$ is a prime number. I have a fixed value $y$ and two uniformly random values $a$ and $b$. Hypothesis: ...
4
votes
2answers
849 views

Is there a security analysis of CryptDB?

It's interesting to see critical thinking being applied to CryptDB in contrast to all the hoopla around it here. CryptDB is not a major theoretical breakthrough but potpourri of technologies to make ...
2
votes
2answers
46 views

(Uniformly) Random Value when an element is picked with $\frac{1}{p-1}- \frac{1}{(p-1)^2}\ $ probability

Let's $\mathbb{F}_p$ be a finite field where $p$ is a large prime number(e.g. 256-bit) I know if the probability that an element picked from the field is $\frac{1}{p-1}$ we say the element is picked ...
18
votes
1answer
7k views

Security strength of RSA in relation with the modulus size

NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits: ...
2
votes
3answers
156 views

How much processing power should you assume an attacker has?

The answer to this question says that you should assume an attacker can do one billion operations per second: Key Size for Symmetric Homomorphic Encryption Over the Integers Is that a single attacker ...
3
votes
1answer
56 views

Do $v_1=\alpha\cdot r_1$ and $v_2=\alpha\cdot r_2$ leak information about $\alpha$

Please consider we have finite field $\mathbb{F}_p$ for large prime number $p$. We have a fixed field element $\alpha$. By $r_i\leftarrow \mathbb{F}_p$ we mean we pick $r_i$ uniformly random from the ...
2
votes
0answers
38 views

Hash-values's length in identification schemes

I am trying to understand the impact of applying a hash function in an identification scheme. It makes reference to the publication "On the length of cryptographic hash-values used in identification ...
2
votes
1answer
161 views

Straightforward method for hampering frequency analysis on deterministic encryption

I'm brainstorming some different ways of making deterministic encryption more secure. I want to use deterministic encryption to preserve searchability over the keywords in a document set. However, I ...
4
votes
1answer
42 views

Given occasional LFSR samples can the next sample be computed?

Suppose I have access to an LFSR generator output used in a radio communications system, with the LFSR being used to authenticate devices. The system cycles an internal unknown length LFSR (greater ...
11
votes
1answer
523 views

Does Curve25519 only provide 112 bit security?

In a recent mail on the IETF CFRG mailing list it was claimed that: The (currently missing) security considerations (or somewhere) should describe why Curve25519 is ok when used in contexts where ...
-2
votes
1answer
222 views

Having plaintext and ciphertext, how can I learn more about key/encryption?

I have an OLD work database that seems to have a simple encryption on the PW. I have one users whose pw is 7777 the cipher text is ...
4
votes
4answers
137 views

Shamir Secret Sharing: Why cannot we recover polynomial's root if we have $t-1$ shares?

Imagine we have $t-1$ shares in $(t,n)$ shamir secret sharing. So at least $t$ shares are needed. Question: Why cannot we use $t-1$ shares to find a root of the polynomial and then recover the ...
8
votes
1answer
2k views

Knowing pre-encryption data, can we find the private key CryptoLocker used?

One of our users seems to have been hit by CryptoLocker. As a result, he has a hard drive full of encrypted files. The ransom-ware claims to have used public key encryption on the files. If we know ...
0
votes
0answers
37 views

Is double encryption using AES using different key lengths (128 bit and then 256 bit) vulnerable? [duplicate]

I know that AES 256 bit is far more than enough to secure a file. I just want to know if there are any vulnerabilities or known attacks which can make such this combination less secure "double ...
2
votes
1answer
236 views

Recovering key length from transposition block cipher ciphertext

First of all I would like to say hello to all StackExchange users. So far I've been stalking the forum for some time, now it's time to leave the shadows. In my master thesis I'm writing about ...
3
votes
2answers
137 views

Combine two sha512 hashes to a single hash

Assume I have two data fragments: $Frag_1$ and $Frag_2$. I can build sha512 hashes the usual way with $SHA512(Frag_1)$ and $SHA512(Frag_2)$ and then hash the two fragments appended to each other: ...
2
votes
0answers
41 views

Is it possible to generate backdoored DH parameters?

I know it has been already asked and answered whether it's possible to generate weak DH parameters. But "recentely" we experienced the Logjam attack, which makes use of the pre-computation ...
4
votes
1answer
147 views

Hashing a Diffie-Hellman result

In many implementations, the result of the Diffie-Hellman algorithm is hashed. I read that: Hashing the shared secret point prevents an attacker from gaining more information about the EC private ...
4
votes
1answer
512 views

Understanding a Blowfish cryptanalysis

I'm reading a cryptanalysis on Blowfish, and I've come across something that I don't quite get. Let's denote $$\delta = a \oplus a'$$ where a and a' are bytes that cause a collision in some S-box ...
0
votes
0answers
32 views

how many pairs of plaintext-ciphertext are needed before we break AES? [duplicate]

Imagine a set of words ($plaintext$) each are encrypted using AES-ECB mode and due to some leakage in the system an attacker could gain access to some pairs of $plaintext$ and $ciphertext$. But once ...
5
votes
0answers
110 views

Would the encryption of bigrams and trigrams weaken the code?

Supposing a rotor machine of the 1940s or 50s, with 36 characters instead of 26. Would the encryption of the ten additional characters as the most frequent bigrams or trigrams weaken the code? What ...
1
vote
2answers
80 views

Collision probability of MD5 over different attacks

I am researching the collision probability of MD5 and various attacks against it. Can someone help me how to learn the least probability that there will be a collision in a specific attack on MD5? ...
2
votes
1answer
92 views

Mathematically / statistically “safe” way to differentiate between crypto and random blob?

I assume the United Kingdom will impose (as opposed to just talk about it) restrictions on crypto software that may be used within it's borders. Me, quite the border clown (yes, I always bring a up ...
1
vote
1answer
87 views

Is it a good practice to use plain text for derivation of Keys?

I have a question regarding the derivation of keys in crypto. Is it a good practice to use the plain text (in form of hashes) for derivation of keys ? these keys will be used for encryption of the ...
2
votes
0answers
67 views

What are the current known weaknesses/attacks on quantum key distribution?

I am writing a paper on the implementation of QKD in the future. I want to know if there are any viable attacks on the BB84 protocol or QKD in general? I know of the Photon Number Splitting attack or ...
0
votes
0answers
70 views

How can I calculate the probability of collisions of a hashing algorithm?

I'm pulling a “Dave” and I'm designing my own hashing algorithm. Not that I intend to use it, I'm not certifiable or anything, I just want the challenge of creating something. I'm not going to get ...
0
votes
0answers
116 views

How can I compare two hash algorithms?

In studying the algorithms of cryptographic hash functions, I have tried out a few (educated) modifications to the code for academic purposes only. For example, I modified the algorithm by applying an ...
1
vote
0answers
65 views

Understanding a faulty Needam-Schroeder protocol

Give this mutual-authentication protocol (along with the attack) in which Alice wants to communicate with Bob, I can't understand how the attack works. A chooses $N$ (nonce) and sends to C (trusted ...
0
votes
1answer
84 views

How hard is it to recover $p$ if I can get $h(p) \oplus h(p^*) \oplus r$ and $h(r)$?

Assume that $h:\{0,1\}^* \rightarrow \{0,1\}^\lambda$ is a cryptologic hash function, $r$ is taken randomly from $\{0,1\}^\lambda$, $p$ is a low-entropy password and $p^*$ is a guess. Now we get $h(p) ...
2
votes
1answer
185 views

Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator

Imagine we have a 3-party protocol, including client $A$,client $B$ and a server. In this protocol client $B$ encrypts its input under its public key and sends it to the server. The server performs ...
21
votes
2answers
11k views

Definition of Textbook RSA

What is the definition of Textbook RSA? What are some of the properties of textbook RSA? How does it differ from other RSAs?