analysing cryptographic algorithms, potentially uncovering weaknesses in them (e.g. "breaking" them or casting doubts on their actual security)

learn more… | top users | synonyms

11
votes
2answers
672 views

Are AES-256's related-key weaknesses exploitable if it is used to build a hash?

Assume it is made a hash based on AES-256 encryption (perhaps because this is hardware-accelerated, but no standard hash is); and it is used the Merkle–Damgård structure, that is padding of the ...
5
votes
4answers
1k views

Simply put, what does perfect secrecy means?

I would like to ask for a clear (but maybe not so deep) explanation of what the term "perfect secrecy" means. As far as I have researched and understood, it has to do with probabilities of assuming ...
-1
votes
1answer
90 views

cryptography and use of python programming language [closed]

why is it recommended to write cryptography programs ,for example crypt-analysis projects with python programming language? what is the advantages of python? why not use c or any other language?
0
votes
0answers
37 views

Open SSL signatures - merkle ecdsa rsa [closed]

I want to sign/verify a file over open ssl using these three algorithms. Is there a way to measure the time?
2
votes
0answers
78 views

An example of Knapsack Cryptosystem cracks/attacks?

I have been studying papers on various ways to crack the knapsack cryptosystem, unfortunately the mathematics in these papers involves lattices and LLL which is over my head. The paper "New Attacks ...
6
votes
3answers
1k views

How to attack a classical cipher using known partial plaintext?

I have a ciphertext generated by a classical cipher. I do not know what was cipher used to generate it. I do however have the beginning of the plaintext. What are the cryptanalysis approaches for ...
9
votes
3answers
376 views

Can we ensure the security of a crypto-algorithm and -implementaton against acoustic cryptanalysis?

Like people always say: “Attacks only get worse…” — which is why I'm asking early. I have been reading the paper “RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis” published December 18, ...
3
votes
1answer
88 views

XOR with constant key in CBC mode

I have a hypothetical encryption scheme where somebody uses the one-time pad in CBC mode. That is, the block cipher is $E(k, m) :=k⊕m$, and that block cipher is used in CBC mode. Now, I am assuming ...
0
votes
0answers
43 views

Is Chaocipher a secure cipher under ciphertext-only attack?

Chaocipher was invented by John F. Byrne in 1919. The algorithm was recently revealed -- see Moshe Rubin's Chaocipher Revealed, the Algorithm While a known plaintext attack successfully finds the ...
7
votes
2answers
943 views

Cycle attack on RSA

I originally posted this question in the mathematics section, you can see it here. Let $p$ and $q$ be large primes, $n=pq$ and $e : 0<e<\phi(n), \space gcd(e, \phi(n))=1$ the public encyption ...
2
votes
0answers
98 views

Using the same private key for two ECC key pairs

Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private ...
-1
votes
0answers
26 views

Is it possible to find an attack that can reduce the key space of the Hill cipher with $d*d$ key matrix to $26^d$ [duplicate]

Is it possible to find an attack that can reduce the key space of the Hill cipher with $d*d$ key matrix to $26^d$ instead of $26^{d^2}$?
1
vote
1answer
44 views

Perl DES PCBC as protection against decryption/crypt analysis

Is error propagation in DES PCBC a good method to prevent decryption/crypt analysis by third parties? If I had a very large file encrypted with Perl's DES with the PCBC option, and then removed the ...
2
votes
1answer
107 views

Explanations for the complexity values for second preimage attack on GOST?

I've been reading the article "A (second) preimage attack on the GOST hash function" by F. Mendel et al (link) and I'm having some difficulty to grasp some of the values of complexities/probabilities ...
4
votes
1answer
122 views

Cryptanalysis of AES on SSD with TRIM enabled

Attack scenario: SSD physically retrieved from a computer that is turned off. The entire disk is encrypted with AES 256-bit (GNU/Linux, LUKS). The SSD has had TRIM enabled for several years and the ...
4
votes
1answer
333 views

Is there a security analysis of CryptDB?

Its interesting to see critical thinking being applied to cryptDB in contrast to all the hoopla around it here . cryptDB is not a major theoretical breakthrough but potpourri of technologies to make ...
9
votes
4answers
6k views

What is the difference between known-plaintext attack and chosen-plaintext attack?

I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not. Can anyone explain to me how ...
7
votes
2answers
3k views

How does a padding oracle attack work?

I am unsure of how a padding oracle attack works. What I am not getting is how changing one bit at one time allows one to exploit(get keys) ASP.NET machines. Can anyone explain this?
0
votes
2answers
84 views

How does compression before encryption leak info about the input?

Apparently current best practices recommend that you do not compress before you encrypt. For example in this blog entry (*): http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ It ...
1
vote
1answer
95 views

How to solve custom made ciphers? [closed]

How would you go about solving basic custom made ciphers - e.g. one generated from this website http://www.wikihow.com/Write-a-Custom-Cipher-Carefully? This is solving it without knowing the method ...
0
votes
0answers
47 views

Probability of an ed25519 selective forgery?

What is the expected number of trials required to selectively forge ed25519? Please include how it is calculated.
-1
votes
1answer
89 views

Hash Based Encryption (fast & simple), how well would this compare to AES? [duplicate]

First of all, I know it's a very bad idea to invent your own encryption algorithm. It's better to use existing known, trusted, extensively tested and studied algorithms with a proven track record. The ...
3
votes
3answers
242 views

Is it possible to work out the hash algorithm from a list of known message-hash pairs?

For example, in my situation I know hash(20) = 486e9638177faf1f34e49910491b77af. I also know the hashes for all values from 0 to 20. Is it possible to work out the ...
11
votes
3answers
1k views

Why does SHA-1 have 80 rounds?

Why does SHA-1 algorithm have exactly 80 rounds? Is it to reduce collisions? If yes, then why do SHA-2 and SHA-3 have a lower number of rounds?
0
votes
1answer
65 views

How does the key size per data bit influence the security?

The likelihood of breaking, for instance, an AES-128 cipher is 100% after $2^{128}$ tries in brute force, meaning that I've got to try $2^{128}$ keys to certainly break it. What if I (hypothetically) ...
1
vote
2answers
140 views

Breaking Double Encryption

I am trying to understand how an attacker knows when he has successfully decrypted a ciphertext for an assignment. As such, some pointers/hints for the following questions would be greatly ...
2
votes
0answers
44 views

Why the same characteristics cannot be used to recover all FEAL4 keys

I am trying to understand how differential Cryptanalysis works. Here I read how to use differential cryptoanalysis for cracking FEAL4 cipher. The big gotcha with this process is that you cannot ...
9
votes
2answers
462 views

Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?

Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
0
votes
1answer
76 views

Prime factors of non-random keys

I have been working on a challenge i found on the internet. It is as follows: You've stumbled onto a significant vulnerability in a commonly used cryptographic library. It turns out that the ...
2
votes
3answers
102 views

Frequency of letters change by the length of the texts?

In terms of the frequency of letters, how is it possible to have different frequent letters when the length of the text I'm analyzing is shorter? At the moment, I'm comparing the frequencies of a ...
3
votes
1answer
288 views

ElGamal message signatures retrieving the secret value x

If the GCD(r, p-1) is small and the value k is used to sign a message using ElGamal is also small. Then the secret value of x can be determined. Why is this true? How would one retrieve x?
1
vote
0answers
141 views

Example of second preimage attack [closed]

Please, I'm trying to understand second-preimage attacks on cryptographic hash functions. I understand the definition well: given a message and it's hash, an attacker finds another message which ...
0
votes
0answers
242 views

Question on mono-alphabetic substitution cipher and poly-alphabetic substitution cipher

You know that a meaningful plaintext in a language with a 26-letter alphabet, like English, is encrypted using either the mono-alphabetic substitution cipher or the poly-alphabetic substitution cipher ...
4
votes
0answers
65 views

How has the “power” of cryptography evolved from its beginnings till today? [closed]

I'm looking for a historical overview for the change in cryptographic power, which I hereby define as How far state-of-the-art cryptography is ahead of state-of-the-art cryptanalysis. In other ...
13
votes
8answers
2k views

RSA with small exponents?

Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
2
votes
2answers
97 views

ML/NN Cryptanalysis

I am 14 years and am a NN/ML CS enthusiast (perhaps some of you have seen my NN troubles on SO). I have this question: is it computationally plausible to use NN/ML to do any of the following tasks? (I ...
0
votes
1answer
104 views

Partially-known-plaintext attack of a stream cipher based on modular arithmetic

I have a function called $F$, using modular arithmetic as does RSA, defined as $$x\mapsto F(x) = g^x\bmod p$$ where $p$ is a 1024-bit prime and $g$ is a generator of $\mathbb Z_p^*$. A secret key $r$ ...
1
vote
1answer
84 views

Can a properly implemented ed25519 private key with public underlying data be cracked?

If the underlying data is public albeit hashed with SHA-512, does that make a difference on the strength of ed25519? Please quantify the extent. Can ed25519 be cracked after a certain amount of ...
2
votes
2answers
78 views

Should tweak be unique per message?

Since tweaks are like IV,Salt for block cipher inputs . Should they be unique for each message ? If they are to be unique per message then what is the advantage of giving tweak directly into the ...
5
votes
5answers
429 views

Is there a technique to confirm that a given large integer value is a product of two primes?

Given a list of 2048 bit integer values in which one or few 2048 bit integer values may be product of two prime numbers and other values may be just 2048 bit odd integers numbers. My question is - ...
0
votes
1answer
71 views

How to determine which type of crypto is used in a text file? [closed]

is there a tool or a way to determine which type of crypto is used in this type of text: ...
5
votes
3answers
3k views

Can Pre-Paid Cards be cracked?

Is it possible to deduce the original function that used to generate those prepaid cards number that are used for charging your mobile phone credits? For example: If I've collected about 1000 of ...
9
votes
3answers
867 views

Is 80 bits of key size considered safe against brute force attacks?

I came across KATAN Family of Ciphers for small domain input blocks . They cipher arbitrary block lengths 32,48,64 but their key size 80 bits only. Is 80 bits of key size considered safe with ...
5
votes
2answers
146 views

Cryptanalysis and weaknesses of SEED cipher

I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've ...
1
vote
0answers
141 views

How good is the RandomPool generator in Crypto++ library?

How good is the RandomPool generator in Crypto++ library? I never heard of it before… I wonder if there is a Fortuna C implementation that I could use in an Objective-C project. Also: How secure is ...
3
votes
1answer
95 views

How would using only one s-box affect security of Blowfish?

Schneier says: Fewer and smaller S-boxes. It may be possible to reduce the number of S-boxes from four to one. Additionally, it may be possible to overlap entries in a single S-box: entry 0 ...
0
votes
1answer
51 views

Bicliques for permutations

So I'm trying to understand the complexity of the biclique attack on Grostl and I have some questions: 1) The paper introduces sliced bicliques where on Grostl one constructs a biclique of dimension ...
5
votes
1answer
169 views

How can I break this encryption scheme?

Let $p$ be a large public prime. Alice holds a private key $(e_1,d_1) \in Z_{p-1}^*$ such that $e_1 d_1 = 1 \mod {p-1}$. Bob also holds a different private key $(e_2,d_2)$ with the same property. ...
4
votes
2answers
476 views

Hill cipher, unknown letter value

I've been struggling on this problem for a while now : the Hill cipher is well-known to be vulnerable to known-plaintext attack due to its linearity. Given a key matrix $K$ of size $n\times n$, one ...