Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

learn more… | top users | synonyms (1)

2
votes
2answers
84 views

Is it hard to recover $p$ from $k \phi(p)$?

Given $k\phi(p)$, is it hard to recover $p$? Here, $p$ is a large prime, $\phi(\cdot)$ is Euler's totient function and $k$ is an unknown integer. Or what's the complexity to recover $p$ from $k ...
2
votes
2answers
700 views

How should we interpret the cryptanalysis results of SIMON and SPECK?

The NSA recently released SIMON and SPECK light weight block ciphers. Although initial spec release did not have much of cryptanalysis details, two works later appeared providing the cryptanalysis for ...
2
votes
2answers
405 views

What does the linear assumption over bilinear groups mean?

In the abstract of "Cryptography with Tamperable and Leaky Memory", at the end of the 3rd paragraph, the authors say: In both schemes we rely on the linear assumption over bilinear groups. What ...
2
votes
2answers
3k views

How to get the keyword from a keyword cipher?

I was given a ciphertext and now I am trying to break it via looking for the keyword. This is a keyword cipher. So: PlainEnglish: ABCDEFGHIJKLMNOPQRSTUVWXYZ If ...
2
votes
2answers
412 views

Is One Time Pad considered Chosen-Plaintext Attack Secure?

If we're considering Chosen-Plaintext Attack setting, then the adversary has access to the Encryption Oracle right, and we know that OTP is only considered secure if we use the key only once. How ...
2
votes
1answer
103 views

RFID Protocol Cryptanalysis

Assume we have the following scheme for RFID: TAG & READER both have initially k keys. Every session the TAG computes $k_i$=F($k_{i-1})$ where F is a function which computes XOR of previous key ...
2
votes
2answers
195 views

Has there been any cryptanalysis of AES under a non-uniformly distributed key?

The standard security property demanded of a blockcipher is that it be a pseudo-random permutation; i.e., given a uniformly random key, the blockcipher should be computationally indistinguishable from ...
2
votes
2answers
1k views

DES Encryption Algorithm all 64 bits for key instead of 56 bits

Would a DES algorithm that uses all 64 bits for the key instead of just the 56 bits be more secure? I have been thinking about it but those 8 bits used for parity are very useful and but including ...
2
votes
1answer
362 views

Revealing random bit permutation

I am new in cryptography. I want to determine the complexity of revealing a random bit permutation which is used as block cipher for plaintexts (bitstrings of length n). An adversary catches different ...
2
votes
2answers
474 views

Breaking Double Encryption

I am trying to understand how an attacker knows when he has successfully decrypted a ciphertext for an assignment. As such, some pointers/hints for the following questions would be greatly ...
2
votes
2answers
159 views

Publicly exposed hash of private key

Would exposing a cryptographic hash function's digest (e.g. SHA-3) of RSA private key data compromise the key? If so, what are the possible (cryptanalysis-) vectors for attacking the key if an ...
2
votes
2answers
734 views

Computing p and q from private key

We are given n (public modulus) where n=pq and e (encryption exponent). Then I was able to crack the private key d, using Wieners attack. So now, I have (n,e,d). My question is, is there a way to ...
2
votes
1answer
142 views

Can you explain what the AES paper means by “sharing active S-boxes”?

I am reading the "Biclique cryptanalysis of the full AES" paper. What do they mean by "sharing active S-boxes"? How can this concept can be advantageous to make a bicycle? If there is someone who ...
2
votes
1answer
384 views

How insecure in practice?

I am in attempt to understand relative insecurity of certain encryption schemes. Particularly of interest is DES and RC2. I know AES is better and should be used to encrypt. But practically, if ...
2
votes
1answer
195 views

What are the dangers of predictable (repeated) plaintext structures?

When using a "good", modern cipher (specifically one that provides ciphertext indistinguishability), is it a problem at all if there is some well-known structure in all plaintexts? For example, ...
2
votes
2answers
206 views

How hard is to find the operators of an addition knowing the sum of them?

I want to learn whether or no there is a cryptographic primitive,scheme assumption that is based on the following hard problem if it is hard . By hard we mean that we have a polynomial adversary: The ...
2
votes
2answers
377 views

How do I demonstrate that a PRNG not designed for cryptography is not suitable for generating passwords?

This is a replication of this question on Stack Overflow. There's class Random in .NET runtime which is designed for use as a cheap fast source of pseudo-random ...
2
votes
1answer
1k views

Finding CRC collisions for specific divisor

My current textbook (Information Security: Principles and Practice by Mark Stamp) discusses how to determine the CRC of data via long-division, using XOR instead of subtraction to determine the ...
2
votes
1answer
72 views

Permuting Small Sized Set in Practice

Imagine we have a set $S$ of $m$ elements and we wants to permutes the set elements. Thus the original position of each element should be unknown after permuting. If we define a permutation function ...
2
votes
1answer
130 views

How do we guarantee plaintext is coprime in RSA?

The specifications for RSA state: $P^{\phi(N)} \equiv 1 ~mod~N$ if and only if $P$ and $N$ are coprime. Here $P$ is the plaintext and $N$ is the product of two suitable primes $x_1, x_2$. My question ...
2
votes
1answer
478 views

How to accurately calculate Unicity Distance for English?

The Unicity Distance for the DES cipher is around $8.6$ characters, and can be calculated using the $U=H(k)/D$ formula, where $D = R - r$, and where $R = 8$ is the number of bits in a byte (ASCII is 7 ...
2
votes
1answer
277 views

Perfectly secure shift cipher

Prove that if only one character is encrypted using a shift cipher, then the shift cipher is perfectly secure. I want to show that $P(P=p | C=c)=P(P=p)$. But I don't know how to relate. Can anyone ...
2
votes
1answer
753 views

Entropy of the key

Suppose a $1000$-bit key used in the one-time pad is not randomly and uniformly generated. Suppose that the values of the first $5$ bits are $0$, and the other $995$ bits are randomly generated and ...
2
votes
1answer
151 views

Can I make a PRNG that is secure even when state can be modified by user?

I am interested in making a PRNG which, after being initially seeded, can accept and incorporate client data as the only ongoing source of "entropy". It is not directly for a cryptographic purpose, ...
2
votes
2answers
721 views

DES with actual 7 byte key

Do we have any library or any mechanism where we can use true 7 byte key for DES instead of 8 byte key. I need it for keys analysis in DES and 8 byte key requirement for associated library is creating ...
2
votes
1answer
156 views

Explanations for the complexity values for second preimage attack on GOST?

I've been reading the article "A (second) preimage attack on the GOST hash function" by F. Mendel et al (link) and I'm having some difficulty to grasp some of the values of complexities/probabilities ...
2
votes
2answers
354 views

What is the limit of plaintext required to break the Vigenère encryption?

A theoretical question about the Vigenère cipher: Without any knowledge about the key (not even it's length) can we tell how much known or chosen plaintext is needed for the adversary to completely ...
2
votes
2answers
224 views

Hypothetical unknown cipher - security in obscurity?

I'm curious what would happen in the following scenario: Suppose an attacker gets a hold of a cipher-text of sufficiently large length. And suppose he has the means to verify a successful decryption. ...
2
votes
1answer
363 views

How much does a successful Distinguishing Attack “break” the attacked stream cipher?

I started reading about the most recent cryptanalysis of RC4 and it's variants. One of the papers I just finished reading ("Two Linear Distinguishing Attacks on VMPC and RC4A and Weakness of RC4 ...
2
votes
1answer
343 views

How to prove a cipher resistant to differential cryptanalysis?

How do you prove that a cipher is resistant to differential cryptanalysis? It's said that Rijndael has been proven resistance to differential cryptanalysis. How do cryptographers do that?
2
votes
1answer
115 views

Why constrain the message lengths in indistinguishability in the presence of an eavesdropper?

I need your help with a very basic concept in cryptography which I can't understand/prove on my own. I'm trying to prove and understand why, under "indistinguishability in the presence of an ...
2
votes
1answer
785 views

Using Chi-Square for Vigenère Cipher

I am writing a program which will use Chi-Square to determine which is the correct keyword for a ciphertext via Vigenère cipher. I came across a website that describes the Chi-Square statistics in a ...
2
votes
1answer
393 views

Break double encryption

Let $E_k$ : {0,1}$^l$ be a block cipher encryption function with block-size $l$ and key-length $n$. In class, we saw that a double encryption with two independent keys $E{}'_{k_1k_2}(x)$ = ...
2
votes
2answers
147 views

High Power Computing for Crypto Research

Obviously, much of cryptography requires the assumption that adversaries have bounded computing power. So, I was wondering, are there any fields in cryptographic research for which high power ...
2
votes
1answer
96 views

Cracking a hash which descends to a single value after repeated hashes

Assume I have a hash function (such as the one below) and a cipher, and I know that if I repeatedly hash any string over and over again, it will eventually descend to one unique value. Is there any ...
2
votes
1answer
110 views

Finding key of AES in ECB mode

How many plaintext-ciphertext pairs would be needed to guess with probability, say $p=0.5$, the key $k$ of AES under ECB mode? Most of the articles that I found tried attacks on single ...
2
votes
1answer
40 views

Data Switching and Information Leakage

Hypothesis: Let $z,a$ be uniformly random elements of a field $\mathbb{F}_p$ where $p$ is a large prime number. Also, let $(-z)$ be additive inverse of $z$. I have a fixed secret value $x$. I mask ...
2
votes
1answer
95 views

What is the difference between CPA and IND-CPA?

I am writing a paper and I got comments from the reviewer that I don’t really understand. Is there any difference between a CPA (Chosen Plaintext Attack) and IND-CPA (Indistinguishability under ...
2
votes
1answer
202 views

Is the GOST block cipher broken?

Is the GOST cipher broken or known to be weak and insecure? Please try to simplify your answer since I am a programmer and not a cryptographer and please consider this web page and tell me if the ...
2
votes
1answer
68 views

On composition of encryption schemes

If we composed (as in function composition) multiple CPA-secure encryption schemes would the result also be CPA-secure?
2
votes
1answer
201 views

Are well designed crypographic codes unbreakable? (NOT ciphers)

Codes are not to be confused with ciphers. It is known that all known ciphers are theoretically breakable except the one-time pad and this isn't what the question is about. Some cryptographic codes ...
2
votes
1answer
159 views

What use is the signature without the message under RSA?

Using RSA for signing & verification, is there a way to take a valid signature for an unknown message, and for someone else to generate a valid signature using a different key against the valid ...
2
votes
1answer
112 views

Stacked LFSR - why not used?

New to cryptographic, weak in math. I have designed a PRG which consist of 33 LFSR's, each 32 bits wide. I use one of the LFSR's as "selector", using the 5 LSB from this register to select one of ...
2
votes
1answer
96 views

Why are modes of operation used, what attacks do they prevent?

I know you always need to use a mode of operation when using a block cipher, AES for example, and Wikipedia has a good explanation for what modes of operation are Now I know if i do not use a mode of ...
2
votes
1answer
458 views

Precomputation attacks on RSA

Are precomputation attacks - such as outlined in RFC 3610 chapter 5 - possible on RSA PKCS#1 v1.5 signature generation? If yes, are such attacks taken into account when calculating the cryptographic ...
2
votes
1answer
168 views

SIMONs Cryptoanalysis

I'm reading Cryptanalysis of the SIMON Family of Block Ciphers. In Section 3.1, it says: For SIMON, consider an n-bit input difference $\alpha= x\oplus x'$ to $F$ of Hamming weight one. As the ...
2
votes
1answer
208 views

Can a properly implemented ed25519 private key with public underlying data be cracked?

If the underlying data is public albeit hashed with SHA-512, does that make a difference on the strength of ed25519? Please quantify the extent. Can ed25519 be cracked after a certain amount of ...
2
votes
1answer
225 views

Can you help me with this DES variant analysis?

I'm struggling with some DES variant that I got as an exercise (exercise taken from Katz-Lindell Ex5.14). The variant is as follows: The left half of the master key is used to derive all the ...
2
votes
3answers
173 views

Help me about Advanced Encryption Standard (AES)

Suppose $E_k$$(a, b, c)$ is encryption of values $a, b$ and $c$ with key $k$ through encryption algorithm AES (AES-128) and each $a, b$ and $c$ are 300 bits integer values. Also Suppose this ...
2
votes
1answer
598 views

What is adversary's advantage in cryptography and why we use it?

The definition of adversary's advantage seems a bit odd for me and I am wondering why do we use it to measure the power of an adversary rather than just use the probability of a PPT adversary ...