# Tag Info

## Hot answers tagged cryptanalysis

6

Let us first consider the problem without involving Shamir secret-sharing at all. Suppose that $n = 140$ and that the secret $\sigma$ is a 140-byte Twitter message. The space is thus restricted considerably, from all possible $256$ byte values to the printable characters permitted to be used in Twitter messages, and the distribution in this restricted space ...

6

If I understood your question correctly, you want a message authentication code (MAC). The "hidden input" is usually called key and the "visible input" is just the message. The output of the MAC is called tag (or also MAC). The main security goal for MACs is resistance against forgery: It should be computationally infeasible for an attacker who does not ...

5

The other answer already explains that what you are looking for is a message authentication code, but did not show a clear attack against your construction. At the very least it seems to be vulnerable to length-extension type attacks, like the keyed hash mentioned: Take the output for some known message, where the length of the key x and message v is ...

5

Well, to start off with, we have: $$k_1 m_1 + k_2 - n_1 p = c_1$$ $$k_1 m_2 + k_2 - n_2 p = c_2$$ $$k_1 m_3 + k_2 - n_3 p = c_3$$ Where we know $m_1, c_1, m_2, c_2, m_3, c_3$, and we don't know $k_1, k_2, p, n_1, n_2, n_3$. I chose to use explicit unknown integers $n_1, n_2, n_3$, rather than modulo an unknown $p$, as it makes it easier to justify the ...

4

By two-time pad I assume you mean using a one time pad key to encrypt two messages. Lets say $K$ is the key and $m_1, m_2$ are your messages. Then from the ciphertexts $c_1 = m_1 \oplus K$ and $c_2 = m_2 \oplus K$ an adversary could trivially learn information such as $x = c_1 \oplus c_2 = m_1 \oplus m_2$. Whether or not this information is "exploitable" may ...

3

Wrapping up my comment as an answer: Imagine you’re a Japanese cryptanalyst in the year 1944. There is no such thing yet called “television”, and you’re still decades away from a wordwide network feeding you with all the knowledge you could wish for. In that case there’s only a minimal chance you’ve ever heard or seen a Navajo. So, you’ll be wondering ...

3

I'll answer question 2, leaving the first as an exercise to the reader. I'll do this on intuitive grounds, rather than using explicit conditional probabilities. The adversary is free to compute $v_1\cdot v_2$ regardless of what we ask, therefore removing everything about that and $v_3$ does not change the problem, which reduces to: We somewhat have ...

3

I'm not sure I understand your question entirely. If there is only one possible message, then the ciphertext can be trivially decrypted simply by choosing this message. I'll assume instead that the ciphertext contains the shuffled bit pattern of a name chosen from a set of more than one name. The problem with bit shuffling is that the number of set bits ...

2

The reference definition of Spritz seems to be: Ronald L. Rivest and Jacob C. N. Schuldt, Spritz - a spongy RC4-like stream cipher and hash function, presented at Charles River Crypto Day (2014). The code snippet of the question shows how the state of Spritz repeatedly used in DBRG output mode is updated and its next output byte $z$ produced; the state ...

2

Is javascript RSA signing safe? …is safe or can people forge… In contrast to the accepted answer, I would not call it “safe” from a cryptographic point of view and I would definitely not say that “ if you take good care of securing your environment where you run the JS code you will be OK. ” because the sad fact is: that’s not enough to ensure ...

2

I guess you do not want to break anything at all. Universal re-encryption pursues the idea that anyone given a ciphertext can WITHOUT knowledge of the public key re-randomize a given ciphertext to an unlinkable ciphertext to the same message. Thus you include an additional encryption of the identity (1 in the group $\mathbb{Z}_p^*$) with independent ...

2

Without knowing $g$ and $h$ we can do as the original paper says: Pick $m,n$ random, both from $\mathbb{Z}_q$ where $n \neq 1, c^m \neq 1, d^m \neq 1$. Then $\sigma' = (c^n, d^n,ac^m, bd^m) \pmod p$ will do. The decryption routine is also in that paper.

2

what is the range for exponent e? Actually, there is no required upper bound for $e$ (except that some implementations may reject ridiculously large values). The math behind RSA states that any $e$ that is relatively prime to both $p-1$ and $q-1$ will work, no matter how large it is. There might not appear to be a need for an $e > lcm(p-1, q-1)$ (as ...

1

What do you mean that you keep the root of the merkle tree locally? Is the merkle tree signed? If i understand what you are saying correctly, then the server can choose not to display to the public the changes you have made and keep presenting the merkle tree for the values before you updated them. Even if you sign the merkle tree the server can still do ...

1

A quick internet search delivered this description of Enigma: "This meant that the notches were engaged when Q, E, V, J and Z were uppermost on rotors I, II, III, IV, and V respectively and that therefore the turnover positions were R, F, W, K, A, remembered by the cryptanalysts at Bletchley Park by the mnemonic Royal Flags Wave Kings Above." So this ...

1

Remember that the initial value is split into two halves, and each half is shifted independently. If all the bits in each half are either 0 or 1, then the key used for any cycle of the algorithm is the same for all the cycles of the algorithm. This can occur if the key is entirely 1s, entirely 0s, or if one half of the key is entirely 1s or the other half is ...

1

$h=g^x$ so $h^s={g^s}^x$ so for decryption of $m$ we have: $$m=d\cdot c^{-x}$$ I think $a$ and $b$ are not necessary. Also, there exist lot of valid ciphertexts. As cygnusv mentioned you can choose $r',s'$ randomly and this is a valid ciphertext: $$\sigma' = (g^{r+r'},h^{r+r'},g^{s+s'},m\cdot h^{s+s'})$$

1

You can compute $\sigma'$ as follows: $$\sigma' = (a\cdot g^{r'},b'\cdot h^{r'},c'\cdot g^{s'},d'\cdot h^{s'})$$ where $r',s'$ are chosen randomly from $\mathbb Z^*_p$. This produces the following ciphertext, which decrypts to $m$: $$\sigma' = (g^{r+r'},h^{r+r'},g^{s+s'},m\cdot h^{s+s'})$$

1

I just came across this question and was surprised that no one referenced the paper: A Natural Language Approach to Automated Cryptanalysis of Two-time Pads by Mason et al. at ACM CCS 2006. This shows how to solve this problem in an automated and intelligent way.

1

Q: Is there any way I can infer what is being used to encrypt the file? A: Yes there is some way. Examples: Reverse engineer the software to figure out what algorithm they use as Gilles said. This is not related to cryptography. Learn crypt-analysis to infer the enc alg used. You might win several prestigious awards along this path. The reason it's so ...

1

What you're describing is a ciphertext-only attack on AES. No, there's no (known) ciphertext-only attack on AES. Condition one: We know none of the weaknesses and similar plain-texts in these two blocks, I just mentioned, how easily could we discover it? By the lack of an transmitted IV, an attacker can learn whether the two messages are equal and ...

1

Machine learning and decision tree models are being used and improved everyday to break ciphers. Quantum computing coupled with machine learning is nowadays one of the most sophisticated tools for decryption.

Only top voted, non community-wiki answers of a minimum length are eligible