analysing cryptographic algorithms, potentially uncovering weaknesses in them (e.g. "breaking" them or casting doubts on their actual security)

learn more… | top users | synonyms

2
votes
1answer
261 views

How to prove a cipher resistant to differential cryptanalysis?

How do you prove that a cipher is resistant to differential cryptanalysis? It's said that Rijndael has been proven resistance to differential cryptanalysis. How do cryptographers do that?
2
votes
1answer
65 views

Comprehension question on a signature protocol based on the RSA assumption

We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R ...
2
votes
1answer
265 views

Understanding one-way hash functions construction

I understand the needs that lead to the development of cryptography and I am quite familiar with the uses we make of the cryptographic tools. But, as a programmer, I am conditioned to see them as ...
2
votes
1answer
538 views

Using Chi-Square for Vigenère Cipher

I am writing a program which will use Chi-Square to determine which is the correct keyword for a ciphertext via Vigenère cipher. I came across a website that describes the Chi-Square statistics in a ...
2
votes
1answer
245 views

Regarding matsui's Paper on Linear Cryptanalysis of DES

I's going throught the the Paper by Matsui on Linear Cryptanalysis of DES . In that he says $NS_{5}(16,15)=12$ And then in the next paragraph he says considering the expansion and permutation phases ...
2
votes
2answers
675 views

ECC algorithm pollard's $\rho$ complexity

One of the methods to break a ECDLP is Pollard's rho algorithm. When ECDLP is defined over a finite field $F_p$, and given a relation $S=w.T$, where S and T are a member of $F_p$. Then ECDLP is to ...
2
votes
1answer
735 views

RC4 : Keystream reconstruction?

First up: it's a step in some challenge found on the Internet, where we get an application and a file. The application must be feed with that file and a password (the password is the flag for the ...
2
votes
2answers
506 views

DES Crack simulation

I wish to simulate an implementation of a DES Cracker using verilog. But every paper I read give only abstract hints but no concrete steps or how really to go about it. How is it usually done? For ...
2
votes
1answer
1k views

Cryptanalysis Affine Cipher: Brute-Force Search Vs. Meet-in-the-middle

Affine Cipher: $Enc(x) = (ax + b) \mod m$ $Dec(x) = a^{-1}(x-b) \mod m$ For a brute-force key search, we need to do $a \cdot b$ encryptions in the worst case. For a meet-in-the-middle attack, how ...
2
votes
1answer
106 views

Hill Cipher question

Recently, I was given three ciphers to crack for my cryptography class. At this point, I have guessed that one of them is likely a Hill cipher (probably 3x3, as that is the most complex we have done ...
2
votes
1answer
161 views

LFSR Output Sampling for Berlekamp-Massey

Looking at the use of Linear Feedback Shift Registers in cryptographic algorithms, I have learned that the Berlekamp-Massey algorithm can be used to find the (shortest) LFSR that generates a given ...
2
votes
2answers
179 views

Is there a way to compare the 923 bit pairing based key with RSA or AES, etc

I've see many articles, most of them basically the same, praising Fujitsu for cracking what is referred to as a 923 bit pairing based encryption. I understand that in comparing RSA to AES you've got ...
2
votes
1answer
382 views

Security analysis of a “one-time pad” type hill cipher

Suppose the Hill cipher were modified to something like a one-time pad cipher, where Alice wants to send a message to Bob, and she chooses a key matrix randomly everytime a new message is sent (and ...
2
votes
1answer
35 views

Differences between Work Factor and Time Complexity

I am interested to know if work factor means the same thing as time complexity. Quoting Work Factor : Uncovering keys in cryptosystems The Work Factor of a cryptosystem is related to its ...
2
votes
1answer
79 views

How do we find the subkey out of a differential cryptanalysis?

I understand the differential cryptanalysis up to the "finding the last subkey" part. If XORing with the key doesn't change the differentials, how can testing different key affect the equations we ...
2
votes
1answer
101 views

To prove $r \cdot f_1 +f_2 \cdot (s+1)$ is secure

We define the polynomials $r, f_1,f_2,s \in R[x]$. Where $r$ is a random degree 1 polynomial and $s$ is a random polynomial such that: $degree(s)=degree(f_1)=degree(f_2)$, let $R$ be $\mathbb{Z}_p$ ...
2
votes
1answer
75 views

Cryptanalysis of Nonlinear Table Lookup

I am trying to derive a symmetric key based on a master key, combined with a simple string. Based on my limited knowledge, it seems that something like PBKDF2 would do that for me in a well-defined ...
2
votes
1answer
122 views

Straightforward method for hampering frequency analysis on deterministic encryption

I'm brainstorming some different ways of making deterministic encryption more secure. I want to use deterministic encryption to preserve searchability over the keywords in a document set. However, I ...
2
votes
1answer
168 views

Security of the iterated Hill Cipher

I can understand that the basic Hill Cipher is susceptible to known plaintext attacks, but suppose the Hill Cipher is modified into the Iterated Hill Cipher. For a plaintext $x_0=m_0$ and an ...
2
votes
2answers
89 views

Should tweak be unique per message?

Since tweaks are like IV,Salt for block cipher inputs . Should they be unique for each message ? If they are to be unique per message then what is the advantage of giving tweak directly into the ...
2
votes
1answer
135 views

Decryption or attacking DES encrypted file

I have a file that has been encrypted using DES and am looking to decrypt and find a secret message encoded. All I have is the file which is full of binary data. There is no key or anything else which ...
2
votes
1answer
198 views

In RSA, what is faster attacking “d” when plaintext is known, or factoring when M is unknown?

I'm aware of two methods to attack RSA: Brute force factoring, where no plain text is available Brute force (1/e) mod φ where the plain text is available as described here Question Given an ...
2
votes
1answer
745 views

Verilog simulation of Data Encryption Standard

I interested in developing DES(in verilog) for my college project.Can i get help in understanding the simulation results of DES encryption and decryption ? thanks in advance .
2
votes
0answers
63 views

How does cryptanalysis of the Playfair cipher work?

I have a set of Playfair-enciphered data that I'm trying to crack without the key. I know I need to analyse bigrams; I've currently worked out what decrypts to th, ...
2
votes
0answers
60 views

Using machine-learning techniques for data-dependent operations in ciphers

From 'Methods of Symmetric Cryptanalysis' by Dmitry Khovratovich, The data-dependent operations are one of the most controversial design concepts. We say that an operation is data-dependent, if it ...
2
votes
0answers
67 views

Homomorphic proxy re-signature

Alice has a value $a$ and she signs it using her secret key $d_1$ as: $s_1 = (r_1 * g^a)^{d_1} \bmod p$, and Bob has a value $b$ and he signs it using his secret key $d_2$ as: $s_2 = (r_2 * g^b)^{d_2} ...
2
votes
3answers
195 views

Does this guarantee a unique 32 bit Hash?

I came across some source code that loosely does the below in order to achieve a 32 bit hash. The input string is passed through MD5 to get 16 bytes Hash (as usual). Then the 16 bytes are split into ...
2
votes
0answers
61 views

Cracking an appliance's network protocol

I'm trying to crack my thermostat's network protocol. I've captured several rounds of network traffic and here is what I've got to work with. Communicating via HTTP POST The POST data is JSON ...
2
votes
0answers
201 views

An example of Knapsack Cryptosystem cracks/attacks?

I have been studying papers on various ways to crack the knapsack cryptosystem, unfortunately the mathematics in these papers involves lattices and LLL which is over my head. The paper "New Attacks ...
2
votes
0answers
51 views

Why the same characteristics cannot be used to recover all FEAL4 keys

I am trying to understand how differential Cryptanalysis works. Here I read how to use differential cryptoanalysis for cracking FEAL4 cipher. The big gotcha with this process is that you cannot ...
2
votes
1answer
191 views

Bellovin 96' attack on IPsec ESP protocol on encryption only option

Can you explain the actual attack? Why does the attacker need to firstly send some arbitrary UDP packet? How can the attacker break the privacy between A and B? Link: The article of Bellovin I'm ...
2
votes
0answers
108 views

Jumblar: Using map locations as passwords

I had the idea of converting map locations into passwords. Basically Jumblar takes a hash of the user's location and stores this as a comment on the PGP network. The 'stored-hash'(Vague-Hash) ...
2
votes
0answers
153 views

Security of stream cipher based on Matrix multiplication GF(256) with randomized padding

The actual question is stated at the end of the text. Suppose you have a (grossly inefficient) confidentiality stream cipher with the following components: The keyed function ...
2
votes
1answer
62 views

How to construct the blind factors in practice?

I'm Implementing a protocol that uses masking techniques (or blinding factors), so we can mask a value $y_0$ as $m_0=y_0 \cdot r_0$ where $y_0 \in \mathbb{Z}_p$ and $r_0 \stackrel {R}\leftarrow ...
1
vote
2answers
304 views

Help me describe/identify this challenge-response protocol/algorithm?

My area of expertise is reverse engineering, specifically embedded systems. I do attack cryptographic systems, but this largely involves key recovery or exploiting the implementation. I was asked to ...
1
vote
2answers
109 views

What is “msg = group.random(GT)” in Charm encryption schemes?

In many encryption schemes in Charm the random group message is used instead of a text-message: msg = group.random(GT) For example, in CP-ABE scheme, random ...
1
vote
1answer
149 views

Do practical key-less cryptosystems exist?

Hopefully the question isn't too broad or off. Basically, are there any practical, and by practical I mean secure enough that a ciphertext only attack is infeasible, key-less cryptosystems? For ...
1
vote
2answers
122 views

What cryptanalysis is possible against two independent keystreams XORed against plaintext?

If a wise person was unsure about which commercial cryptography standards are truly secure from the fascist powers that be, it would seem the obvious option for companies and individuals is to now use ...
1
vote
1answer
1k views

What is the probability of breaking the AES algorithm?

I am doing a project which requires the encryption to be done using AES. Is it really possible (technically) to crack AES? If yes, please tell me: What is the probability of breaking AES? How ...
1
vote
2answers
179 views

CPA distinguisher for matrix multiplication in GF(256) with randomized padding

What is the best CPA distinguisher for the function $F_k:\{0,1\}^{8n}\to\{0,1\}^{16n}$ described below? Let $E_k$ be a $2n\times2n$ matrix with elements in $GF(2^8)$, selected by generating bit ...
1
vote
2answers
235 views

Key management for military GPS receivers

I wonder what encryption scheme is used in high-precision encrypted GPS streams (the so-called “P(Y) code”). If there's a master key needed, then it has to be in every device. Yet the master key ...
1
vote
1answer
313 views

How should I treat a new cipher release like Spritz?

I have been looking at both the paper as well as the sourcecode of Spritz — a spongy RC4-like stream cipher and hash function by Ronald L. Rivest and Jacob Schuldt. The paper states We have also ...
1
vote
1answer
75 views

How does the key size per data bit influence the security?

The likelihood of breaking, for instance, an AES-128 cipher is 100% after $2^{128}$ tries in brute force, meaning that I've got to try $2^{128}$ keys to certainly break it. What if I (hypothetically) ...
1
vote
1answer
2k views

decryption many time pad [duplicate]

I have eleven ciphertexts that were encrypted with the same key (which I don't know). I want to decrypt the last ciphertext. I read similar question like Many time pad attack but I can't solve my ...
1
vote
1answer
452 views

Possibility of factorisation of rsa modulus due to vulnerability in java implementation code

Below is my implementation of the RSA algorithm. Actually I'm choosing the private key (d) instead of public key (e) and computing the public key.It is working fine but I want to know if this is a ...
1
vote
2answers
460 views

Chosen Plaintext Attacks against an Affine Cipher

Assuming the ability to launch Chosen Plaintext Attacks (CPA), how many oracle calls an attacker needs to break the affine cipher? and how
1
vote
2answers
525 views

Cryptanalysis of S-DES - Equations

I am trying to derive equations for s and t in the cryptanalysis of a Simple DES algorithm, but I haven't been able to deduce ...
1
vote
1answer
229 views

Can we quantify strength of encryption scheme ?

Was wondering if we have any (or can we come up with) "units" for strength of encryption like in Physics. Most of our comparative analysis of encryption schemes are based on number of S boxes or ...
1
vote
2answers
74 views

Key cracking: Prefer many small texts over one large text?

If an attackers sets out to crack the symmetric key of e.g. AES-CTR, would they prefer to have access to many small cryptotexts or one large cryptotext? I.e. is it more interesting for the attacker to ...
1
vote
1answer
89 views

Is knowing the distribution of input domain only way to do cipher text only attacks?

Imagine there is a $n$ bit block cipher. The attacker has harvested some how all possible $2^n$ cipher texts for some given key. Without the knowledge of the distribution of input domain as in ...