Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

learn more… | top users | synonyms (1)

6
votes
0answers
247 views

Parallel Pollard's Rho: Number of distinguished points

When using the parallel version of Pollard's Rho algorithm for discrete logs, each processor performs its own random walk to find distinguished points, and reports the starting point and the ...
5
votes
0answers
151 views

help with cryptanalysis of a sponge permutation

I have been studying and researching hash functions. So far my research has led me to the sponge construction. It appears that the permutation used in the sponge to stir the state is more or less ...
5
votes
0answers
332 views

How to break a columnar transposition cipher?

I'm currently studying for a cryptography exam. I've been given ciphertext that has been encrypted by a columnar transposition cipher. I've been given no shift key length or key word, the only thing I ...
5
votes
0answers
113 views

Would the encryption of bigrams and trigrams weaken the code?

Supposing a rotor machine of the 1940s or 50s, with 36 characters instead of 26. Would the encryption of the ten additional characters as the most frequent bigrams or trigrams weaken the code? What ...
5
votes
0answers
121 views

Homogenous and heterogeneous Unbalanced Feistel Networks

Unbalanced Feistel networks can be homogenous (F-function identical in each round), or they can be heterogeneous (F-function not always identical in each round). The advantage of heterogeneous UFNs ...
4
votes
0answers
53 views

On a proposition in NTRU original paper: $\gamma_1 |f|_2 |g|_2 \leq |f \circledast g|_\infty \leq \gamma_2 |f|_2 |g|_2$

In the original paper of NTRU cryptosystem, we have the following proposition (that is said to be suggested by Don Coppersmith): For any $\epsilon > 0$, there are constants $\gamma_1,\gamma_2 &...
4
votes
0answers
75 views

Would LWE problem be still secure if error were like this $e=2e_1$?

In the Learning with error problem, if the error term $e$ from equation $b=<a,s>/q+e$ were of this kind $e=2e_1$, where $e_1$ is chosen according to the probability distribution for the LWE ...
4
votes
0answers
65 views

Which precautions to protect against side-channel attacks on ARX ciphers?

In recent crypto there has been a trend to design ciphers using only the ARX set of instructions - i.e. additions (modulo $2^{32}$ or $2^{64}$), rotations (by a fixed constant) and XORs, examples ...
4
votes
0answers
76 views

Missing public exponent

Using LUC RSA, I have a list of 8 public keys $(R_1,n_1)$ through $(R_8,n_8)$, and a list of $8$ messages $M_1\dots M_8$. The messages have all been double encrypted. However, one of the public key ...
4
votes
0answers
149 views

Statistical saturation attack on block ciphers

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack against the Block Cipher ...
4
votes
0answers
217 views

Using the same private key for two ECC key pairs

Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private ...
4
votes
0answers
105 views

What informal indicators exist for estimating the computational infeasibility of cryptographic problems?

When assuming a block cipher primitive is secure, or a number theoretic problem is hard, this assumption is usually based on how far we are from breaking the primitive or solving the problem using ...
3
votes
0answers
40 views

In NTRU, if $N$ is not prime, prove that one can recover the private key by solving a lattice problem in dimension lower than $2N$

In the NTRU cryptosystem, it is suggested to take $N$ prime. I want to understand why. In Jeffrey Hoffstein, Jill Pipher and H. Silverman An Introduction to Mathematical Cryptography, they suggest (...
3
votes
0answers
21 views

Would using a symmetric list of subkeys in a Feistel cipher make our messages vulnerable to oracle attacks?

Suppose I have a Feistel cipher structure that has $16$ rounds. I come up with $8$ subkeys $k_1,k_2,...,k_8$ to be used for the first $8$ rounds and then assign the rest of the keys so that $k_9=k_8,...
3
votes
0answers
86 views

Lattice attacks against Multilinear Maps [CLT13]

I am currently studying an article on a construction of Multilinear maps. There are some attacks on the scheme presented by the authors and I got stuck at the one in section 5.1. I will try to ...
3
votes
0answers
76 views

How to overcome issues with big ciphers? E.g. with small vs. big Vigenére Ciphers

I understand that bigger ciphers show more recurring patterns and therefore should be easier (or at least faster) to decrypt as you'll have a better statistical analysis, being However if we use a ...
3
votes
0answers
96 views

Using machine-learning techniques for data-dependent operations in ciphers

From 'Methods of Symmetric Cryptanalysis' by Dmitry Khovratovich, The data-dependent operations are one of the most controversial design concepts. We say that an operation is data-dependent, if it ...
2
votes
0answers
60 views

Are analog quantum computers a threat to RSA and DLP?

We already know that D-WAVE's "quantum computers" can't really run the Shor's algorithm, because the way they're built doesn't qualify them as universal quantum computers. Now researchers actually ...
2
votes
0answers
48 views

Is this PRG secure?

$G$ is a safe PRG in range $\{0,1\}^n\rightarrow\{0,1\}^{n+1}$. Let us define $G'(S)=G(S\oplus G(S)_{1,...,n})$, s.t. $G(S)_{1,...,n}$ is the first n bits of $G(S)$. Is $G'(S)$ a secure PRG? ...
2
votes
0answers
46 views

Differential Cryptanalysis

How do I find the differential characteristics using techniques Shrinking ? How do I extract the key on Differential Cryptanalysis using the technique Shrinking in Blockcipher Algorithm? Shrinking ...
2
votes
0answers
22 views

Does the length of the keyword used for keytable for Playfair matter?

So for Playfair, we choose a keyword and put that in the keytable with no duplicates. Then, we fill the rest of the table with alphabets in order that are not in the keyword without 'J'. Does the ...
2
votes
0answers
42 views

Is it possible to generate backdoored DH parameters?

I know it has been already asked and answered whether it's possible to generate weak DH parameters. But "recentely" we experienced the Logjam attack, which makes use of the pre-computation ...
2
votes
0answers
78 views

What are the current known weaknesses/attacks on quantum key distribution?

I am writing a paper on the implementation of QKD in the future. I want to know if there are any viable attacks on the BB84 protocol or QKD in general? I know of the Photon Number Splitting attack or ...
2
votes
0answers
58 views

search of patterns in key schedules

I am developing a new key schedule, and there is this article (Enhanced Key Expansion for AES-256 by Using Even-Odd Method) where the authors also propose a new algorithm and one of the objectives is ...
2
votes
0answers
85 views

Homomorphic proxy re-signature

Alice has a value $a$ and she signs it using her secret key $d_1$ as: $s_1 = (r_1 * g^a)^{d_1} \bmod p$, and Bob has a value $b$ and he signs it using his secret key $d_2$ as: $s_2 = (r_2 * g^b)^{d_2} ...
2
votes
0answers
63 views

Infer encoding mechanism from $n$-grams distance?

I have a series of obfuscated strings which across the set of strings have regions of high variance and regions of low variance – implying some encoding mechanism as opposed to an encryption procedure ...
2
votes
0answers
77 views

Cracking an appliance's network protocol

I'm trying to crack my thermostat's network protocol. I've captured several rounds of network traffic and here is what I've got to work with. Communicating via HTTP POST The POST data is JSON ...
2
votes
0answers
63 views

Why the same characteristics cannot be used to recover all FEAL4 keys

I am trying to understand how differential Cryptanalysis works. Here I read how to use differential cryptoanalysis for cracking FEAL4 cipher. The big gotcha with this process is that you cannot ...
2
votes
0answers
402 views

Is there any analysis of freebsd's “geli” encrypted geometry provider?

I've done a few obvious searches on google and google scholar and not turned up any security analysis of FreeBSD's geli. Is there some out there, or has it gone unanalyzed since its introduction ...
2
votes
0answers
115 views

Jumblar: Using map locations as passwords

I had the idea of converting map locations into passwords. Basically Jumblar takes a hash of the user's location and stores this as a comment on the PGP network. The 'stored-hash'(Vague-Hash) ...
2
votes
0answers
171 views

Security of stream cipher based on Matrix multiplication GF(256) with randomized padding

The actual question is stated at the end of the text. Suppose you have a (grossly inefficient) confidentiality stream cipher with the following components: The keyed function $F_k:\{0,1\}^{8n}\...
1
vote
0answers
43 views

Countering Cryptographic Attacks

By reading Camellia Design and Analysis document following is my understanding about few cryptographic attacks from designer point of view. Differential and Linear Crypt-analysis. Number of Active ...
1
vote
0answers
20 views

How to calculate how many trials I need to guess the plain text if a simple P-Box is used to make the cipher text

If I have 64 bit as input for a straight box that use a transposition process to encipher the plain text and the given 64 bits contains 60 bits as (1s), then how many trial I should do?
1
vote
0answers
39 views

Issue Factorization Quadratic Sieve

Good evening, I'm about to write my own quadratic sieve implementation in C using GMP library for large numbers. I'm facing an issue while attempting to do the last factorization step for the number: ...
1
vote
0answers
43 views

How to break a Quagmire 3 cipher?

What would be a good way to go about attacking a Quagmire 3 cipher? I understand that it is polyalphabetic with a key and an indicator. I have started by taking the cipher text, taking every n-th ...
1
vote
0answers
39 views

Can error correcting codes be used to guess this plaintext?

I pick a finite set of messages, perhaps the set of integers $M = \lbrace n \in \mathbf{Z} \, : \, 0 \leq n\lt10 \rbrace$, which you are then allowed to encode in any way you want (some form of error ...
1
vote
0answers
72 views

Differential bound of the S-Box in GOST R34.11-2012

In Russian GOST R34.11-2012 LPS-transformation is used. LPS gets all of its non-linearity from the 8-bit S-box S, which apparently has been designed to offer resistance against classical methods of ...
1
vote
0answers
50 views

Is it possible to create a detection oracle for all block cipher modes? — ciphertext-only cryptanalysis

I have made an ECB/CBC detection oracle, and am now trying to make a detection oracle that can differentiate between CBC/CFB/OFB/CTR/etc. I can already tell ECB apart from the others due to this ...
1
vote
0answers
108 views

Breaking Vigenere via Kasiski/Babbage method? (non-programmatic)

I'm really hoping someone can explain to me what is going on in the second major component of this form of analysis. If you wish, for convenience, here's a page that already has some ciphered text ...
1
vote
0answers
67 views

When we use one time pad TWICE in two different ways

Assumption and Notations: All the values defined over the field $\mathbb{F}_p$, where $p$ is a large prime number. We denote multiplicative inverse of value $v$ by $v^{-1}$. All values are non-zero ...
1
vote
0answers
62 views

Encryption technology for DARPA

I'm working on a short story taking place in the near future in which a hacker gains access to the DARPA mainframe and files related to a highly classified DARPA project. Being ignorant about state ...
1
vote
0answers
71 views

Calculating Phi(M) and D for RSA decryption given p,q,e

I've been given a message in 4 digit numbers but it doesn't seem to work when I use my calculated values for phi(m) and d. If I'm correct phi(m) = (p-1)(q-1) correct? And d is given by ed = 1mod(phi(m)...
1
vote
0answers
16 views

How to calculate LOW(b) and HIGH(b) in spritz cryptography

I try to implement spritz cryptography like this paper . But I don't know how to calculate LOW(b) and HIGH(b). In paper page 7. ...
1
vote
0answers
67 views

Understanding a faulty Needam-Schroeder protocol

Give this mutual-authentication protocol (along with the attack) in which Alice wants to communicate with Bob, I can't understand how the attack works. A chooses $N$ (nonce) and sends to C (trusted ...
1
vote
0answers
50 views

How to find an impossible differential?

Given an arbitrary SPN-based cipher with X rounds. How to find an impossible differential for this cipher? What are strategies to find one?
1
vote
0answers
118 views

RSA OAEP: prevention of partial decryption of ciphertexts

I'm trying to understand RSA encryption (as a beginner in cryptography). go on this wiki page http://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding scroll down to the 2 numbered points: ...
1
vote
0answers
92 views

To prove $r_2$ is a uniformly at random value in $Z_n$, where $r_2=r_1 . m$

$m$ is arbitrary value in $Z_n$, where n is RSA modulo. Then we do: $r_2=r_1 . m (modn)$, where $r_1$ is a random value such that $r_1\in Z^*_n$. ** Question(1): is $r_2$ a uniformly at random ...
1
vote
0answers
22 views

Cryptography — with a semi-priveleged user in the middle — to prevent request-tampering with another server

I'm working on a chat server for a mobile app I am writing. I would like to use a different application server for non-chat related operations and another application for chat operations. I would ...
1
vote
0answers
210 views

Partial encryption of a file?

I want to partially encrypt a large block of data using AES. Meaning: given plaintext[0:1100], I would like to encrypt ...
1
vote
0answers
224 views

Differential Cryptanalysis of FEAL-4

I'm currently carrying out a differential attack on the FEAL-4 algorithm, however I have hit a bit of a wall. Basically I attacked the final round first ($K3$) using the differential characteristic ...