Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

learn more… | top users | synonyms (1)

4
votes
1answer
653 views

True Random Number Generator by milliseconds per keystroke (TRNG-Kms)

The simplest way to generate truly random numbers for OTP keys is to measure the time in milliseconds between each keystroke on a keyboard. The randomness depends on the user typing in various speeds. ...
-1
votes
1answer
85 views

How To prove Any Change to $v=a\cdot y+b$ maks $y=(a)^{−1}\cdot (v−b)$ Uni. random value [closed]

This question is related to data integrity. Let a finite field be $\mathbb{F}_p$, where $p$ is a prime number. I have a fixed value $y$ and two uniformly random values $a$ and $b$. Hypothesis: ...
4
votes
2answers
848 views

Is there a security analysis of CryptDB?

It's interesting to see critical thinking being applied to CryptDB in contrast to all the hoopla around it here. CryptDB is not a major theoretical breakthrough but potpourri of technologies to make ...
2
votes
2answers
46 views

(Uniformly) Random Value when an element is picked with $\frac{1}{p-1}- \frac{1}{(p-1)^2}\ $ probability

Let's $\mathbb{F}_p$ be a finite field where $p$ is a large prime number(e.g. 256-bit) I know if the probability that an element picked from the field is $\frac{1}{p-1}$ we say the element is picked ...
18
votes
1answer
6k views

Security strength of RSA in relation with the modulus size

NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits: ...
2
votes
3answers
152 views

How much processing power should you assume an attacker has?

The answer to this question says that you should assume an attacker can do one billion operations per second: Key Size for Symmetric Homomorphic Encryption Over the Integers Is that a single attacker ...
3
votes
1answer
53 views

Do $v_1=\alpha\cdot r_1$ and $v_2=\alpha\cdot r_2$ leak information about $\alpha$

Please consider we have finite field $\mathbb{F}_p$ for large prime number $p$. We have a fixed field element $\alpha$. By $r_i\leftarrow \mathbb{F}_p$ we mean we pick $r_i$ uniformly random from the ...
2
votes
0answers
36 views

Hash-values's length in identification schemes

I am trying to understand the impact of applying a hash function in an identification scheme. It makes reference to the publication "On the length of cryptographic hash-values used in identification ...
2
votes
1answer
161 views

Straightforward method for hampering frequency analysis on deterministic encryption

I'm brainstorming some different ways of making deterministic encryption more secure. I want to use deterministic encryption to preserve searchability over the keywords in a document set. However, I ...
4
votes
1answer
40 views

Given occasional LFSR samples can the next sample be computed?

Suppose I have access to an LFSR generator output used in a radio communications system, with the LFSR being used to authenticate devices. The system cycles an internal unknown length LFSR (greater ...
11
votes
1answer
506 views

Does Curve25519 only provide 112 bit security?

In a recent mail on the IETF CFRG mailing list it was claimed that: The (currently missing) security considerations (or somewhere) should describe why Curve25519 is ok when used in contexts where ...
-2
votes
1answer
217 views

Having plaintext and ciphertext, how can I learn more about key/encryption?

I have an OLD work database that seems to have a simple encryption on the PW. I have one users whose pw is 7777 the cipher text is ...
4
votes
4answers
136 views

Shamir Secret Sharing: Why cannot we recover polynomial's root if we have $t-1$ shares?

Imagine we have $t-1$ shares in $(t,n)$ shamir secret sharing. So at least $t$ shares are needed. Question: Why cannot we use $t-1$ shares to find a root of the polynomial and then recover the ...
1
vote
1answer
127 views

Cryptanalysis of Marvin32 compared to SipHash

So I am curious about the security analysis of Marvin32, the randomized hash algorithm used in .NET (to prevent hash-table DoS). I found the source code here: ...
8
votes
1answer
2k views

Knowing pre-encryption data, can we find the private key CryptoLocker used?

One of our users seems to have been hit by CryptoLocker. As a result, he has a hard drive full of encrypted files. The ransom-ware claims to have used public key encryption on the files. If we know ...
0
votes
0answers
37 views

Is double encryption using AES using different key lengths (128 bit and then 256 bit) vulnerable? [duplicate]

I know that AES 256 bit is far more than enough to secure a file. I just want to know if there are any vulnerabilities or known attacks which can make such this combination less secure "double ...
2
votes
1answer
219 views

Recovering key length from transposition block cipher ciphertext

First of all I would like to say hello to all StackExchange users. So far I've been stalking the forum for some time, now it's time to leave the shadows. In my master thesis I'm writing about ...
3
votes
2answers
130 views

Combine two sha512 hashes to a single hash

Assume I have two data fragments: $Frag_1$ and $Frag_2$. I can build sha512 hashes the usual way with $SHA512(Frag_1)$ and $SHA512(Frag_2)$ and then hash the two fragments appended to each other: ...
2
votes
0answers
41 views

Is it possible to generate backdoored DH parameters?

I know it has been already asked and answered whether it's possible to generate weak DH parameters. But "recentely" we experienced the Logjam attack, which makes use of the pre-computation ...
4
votes
1answer
138 views

Hashing a Diffie-Hellman result

In many implementations, the result of the Diffie-Hellman algorithm is hashed. I read that: Hashing the shared secret point prevents an attacker from gaining more information about the EC private ...
4
votes
1answer
507 views

Understanding a Blowfish cryptanalysis

I'm reading a cryptanalysis on Blowfish, and I've come across something that I don't quite get. Let's denote $$\delta = a \oplus a'$$ where a and a' are bytes that cause a collision in some S-box ...
0
votes
0answers
32 views

how many pairs of plaintext-ciphertext are needed before we break AES? [duplicate]

Imagine a set of words ($plaintext$) each are encrypted using AES-ECB mode and due to some leakage in the system an attacker could gain access to some pairs of $plaintext$ and $ciphertext$. But once ...
5
votes
0answers
110 views

Would the encryption of bigrams and trigrams weaken the code?

Supposing a rotor machine of the 1940s or 50s, with 36 characters instead of 26. Would the encryption of the ten additional characters as the most frequent bigrams or trigrams weaken the code? What ...
1
vote
2answers
78 views

Collision probability of MD5 over different attacks

I am researching the collision probability of MD5 and various attacks against it. Can someone help me how to learn the least probability that there will be a collision in a specific attack on MD5? ...
2
votes
1answer
92 views

Mathematically / statistically “safe” way to differentiate between crypto and random blob?

I assume the United Kingdom will impose (as opposed to just talk about it) restrictions on crypto software that may be used within it's borders. Me, quite the border clown (yes, I always bring a up ...
1
vote
1answer
84 views

Is it a good practice to use plain text for derivation of Keys?

I have a question regarding the derivation of keys in crypto. Is it a good practice to use the plain text (in form of hashes) for derivation of keys ? these keys will be used for encryption of the ...
2
votes
0answers
60 views

What are the current known weaknesses/attacks on quantum key distribution?

I am writing a paper on the implementation of QKD in the future. I want to know if there are any viable attacks on the BB84 protocol or QKD in general? I know of the Photon Number Splitting attack or ...
0
votes
0answers
65 views

How can I calculate the probability of collisions of a hashing algorithm?

I'm pulling a “Dave” and I'm designing my own hashing algorithm. Not that I intend to use it, I'm not certifiable or anything, I just want the challenge of creating something. I'm not going to get ...
0
votes
0answers
114 views

How can I compare two hash algorithms?

In studying the algorithms of cryptographic hash functions, I have tried out a few (educated) modifications to the code for academic purposes only. For example, I modified the algorithm by applying an ...
1
vote
0answers
65 views

Understanding a faulty Needam-Schroeder protocol

Give this mutual-authentication protocol (along with the attack) in which Alice wants to communicate with Bob, I can't understand how the attack works. A chooses $N$ (nonce) and sends to C (trusted ...
0
votes
1answer
83 views

How hard is it to recover $p$ if I can get $h(p) \oplus h(p^*) \oplus r$ and $h(r)$?

Assume that $h:\{0,1\}^* \rightarrow \{0,1\}^\lambda$ is a cryptologic hash function, $r$ is taken randomly from $\{0,1\}^\lambda$, $p$ is a low-entropy password and $p^*$ is a guess. Now we get $h(p) ...
2
votes
1answer
184 views

Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator

Imagine we have a 3-party protocol, including client $A$,client $B$ and a server. In this protocol client $B$ encrypts its input under its public key and sends it to the server. The server performs ...
19
votes
2answers
10k views

Definition of Textbook RSA

What is the definition of Textbook RSA? What are some of the properties of textbook RSA? How does it differ from other RSAs?
2
votes
1answer
267 views

Is the GOST block cipher broken?

Is the GOST cipher broken or known to be weak and insecure? Please try to simplify your answer since I am a programmer and not a cryptographer and please consider this web page and tell me if the ...
6
votes
3answers
328 views

What are the practical implications of ciphertext distinguishability?

Commonly there are four ways to "break" a secrecy-focused cryptosystem: Recover the secret key Recover the message Distinguish an encryption from random noise Distinguish the encryption of two ...
0
votes
0answers
18 views

Cryptanalysis on two time pad ciphers? [duplicate]

One time pad ciphers are unbreakable if the message is encrypted correctly and if only used once. However if used more than once, it becomes decipherable. How come? Also, would it be smart to use one ...
6
votes
4answers
443 views

Is there a proof for showing any cryptogram is crackable?

I commonly hear statements along the lines of "all cryptograms are crackable - it's only a matter of time". Is there a proof to show that any cryptogram is "crackable"? The proof may be of a more ...
6
votes
1answer
157 views

What if the p and q used in keys generation of Pailler cryptosystem are composite?

I've seen a few implementations of Paillier cryptosystem that uses probable primes to choose $p$ and $q$. Assuming that a keypair is generated with $p$ and $q$ that are coprime and that $pq$ is ...
1
vote
1answer
189 views

Playfair Cipher + Vigenere Cipher?

I'm researching cryptography for a school project, came across the above two ciphers, and something occurred to me. Would combining these two schemes give a considerably stronger encryption than ...
2
votes
0answers
57 views

search of patterns in key schedules

I am developing a new key schedule, and there is this article (Enhanced Key Expansion for AES-256 by Using Even-Odd Method) where the authors also propose a new algorithm and one of the objectives is ...
2
votes
1answer
75 views

Permuting Small Sized Set in Practice

Imagine we have a set $S$ of $m$ elements and we wants to permutes the set elements. Thus the original position of each element should be unknown after permuting. If we define a permutation function ...
3
votes
1answer
85 views

Logjam-style attack on Factoring?

We're all aware of the Logjam attack, which is known as "FREAK on discrete logarithms". The attack works by doing a large pre-computation step, which needs only to be done once per field and then ...
2
votes
1answer
81 views

Finding keys of modified DES encryption

This is a question I had in my exam today, and I'll be glad if someone can help me to find the answer. A student built an encryption algorithm (something between DES and 3DES), in which the ...
0
votes
0answers
52 views

one complex password as a “seed” for localy generated per-service passwords

I've stumbled upon a project that suggests a way of having to remember one password, from which a “per-service password” could be generated by salting the service name using scrypt. What could be a ...
1
vote
2answers
91 views
2
votes
1answer
44 views

Why should the input value on a DPA attack be non-constant?

I actually was wondering if anyone could help me out with the following problem: Let's assume we are attacking the first SubBytes() operation on AES with the help ...
7
votes
2answers
13k views

How much computing resource is required to brute-force RSA?

It's been over 30 years since Rivest, Shamir and Adleman first publicly described their algorithm for public-key cryptography; and the intelligence community is thought to have known about it for ...
0
votes
1answer
171 views

Finding Vigenère cipher key(s) [closed]

How can we find the key used with a Vigenère cipher in small number of steps? If we have text like: Peit Wokm! Mhfa fepatgb ets bvvrvxmea ebte bae twkd qiqi ...
2
votes
1answer
123 views

Words in “index of coincidence” in relation to the Vigenère cipher

I am trying to interpret the formula for index of coincidence from here… I am not understanding $f_i$. How can I calculate $f_i$ in this context? Is this the appearance of single word like ...
2
votes
1answer
307 views

Perfectly secure shift cipher

Prove that if only one character is encrypted using a shift cipher, then the shift cipher is perfectly secure. I want to show that $P(P=p | C=c)=P(P=p)$. But I don't know how to relate. Can anyone ...