# Tag Info

11

Note that, for the least significant bit, addition mod $2^n$ and xor are the same. So if the cipher doesn't include rotation then you can set up a linear equation in the least significant bits of the plaintext, ciphertext, and round keys that holds with probability 1 (if the cipher breaks the state up into two or more distinct parts, like a Feistel cipher, ...

4

For fixed values $z$ the functions $\varphi_z(x) = ((x\oplus z)-x)\oplus z$ and $\varphi'_z(x) = ((x\oplus z)+x)\oplus z$ (where $-$ rsp. $+$ denotes subtraction rsp. addition modulo $2^n$) are linear over the field with two elements. In other words, considered as functions $\varphi_z : GF(2)^n \to GF(2)^n$, they are $GF(2)$-linear: e.g., for each $z$ there ...

4

Schneier is talking about distinguishing a block cipher from an ideal cipher - or in other words, about formal definitions for security. Think of a game, where the attacker is given a ciphertext encrypted either with a block cipher or with an ideal cipher (with equal probability), and has to guess which cipher encrypted the message. Let's say this attacker ...

3

Usually differential cryptanalysis relies on something called the "wrong key randomization hypothesis", which is the assumption that decryption of the last round with the wrong key results in a random difference at the beginning of the last round, while decryption with the correct key will result in the expected difference with the probability of the ...

3

If I understand you correctly, you are using the Simon key expansion process, so that the input to your block is the 256 bit Simon key, and the output is the 256 bit last round key (and you're ignoring the Simon encryption process entirely). If so, three nits: I believe that you can find preimages for your hash function in $O(2^{64})$ compression function ...

2

The permutation used for Even-Mansour needs to approximate a random permutation. This is the model in which all of the $r$-round Even-Mansour proofs are done. If you have a permutation that is distinguishable from random in a small number of queries, those proofs become null and void—though in some cases the cipher may still be secure. Now, it is perfectly ...

2

Blowfish inputs two blocks of the same length and outputs two blocks of the same length. That is where you are running into an issue. Blowfish inputs a single 64-bit block and outputs a single 64-bit block, just like the picture shows. All the standard 64-bit compatible block cipher modes are compatible with Blowfish.

1

An exhaustive search of half the key space requires $2^{n-1}$ work and provides the right answer 75% of the time. I haven't read that book, and so they may give a cavaet about the larger picture. However, as specified, I don't believe that's correct, but not for the reason you think. If you present a distinguisher with a copy of the cipher, it will give ...

1

For some modes of operation you can easily show that an involution would be insecure: OFB would be most clearly insecure, since the keystream just repeats the nonce/IV and its corresponding encrypted block. CFB would likewise be insecure, since zero blocks encrypt just like with OFB. This is of more limited advantage to an attacker, but far from secure. ...

Only top voted, non community-wiki answers of a minimum length are eligible