# Tag Info

8

Not all ciphers can be broken, even by infinitely powerful adversaries. When used correctly, the One Time Pad (OTP) is information-theoretic secure, which means it can't be broken with cryptanalysis. However, part of being provably secure is that you need as much key material as you have plaintext to encrypt. Such a key needs to be shared between the two ...

7

Pure Threefish has received less attention than Skein. Shortly speaking, it has a large security margin, and can be safely used for encryption. In more details, Threefish has been tweaked twice. The first two versions were vulnerable to rotational cryptanalysis in weak models (related-key attacks or distinguishers) up to 57 rounds. All these attacks are ...

5

The modulo operator keeps the result of the addition of $M$ and $K$ within the set $Z$. For example, if $m$ is 10, $M$ is 6 and $K$ is 5, $M + K$ would be 11 which is no longer in the set $Z$. Taking 11 mod 10 results in 1 which is in the set $Z$. As a help towards answering the question whether scheme $M + K$ mod $m$ is perfectly secure, when $m$ is 26 ...

5

No, it not possible to attack RSA (and practical modulus size) with a WalkSat derivative, as far as we know, or using the algorithm in the question. Problem with that algorithm is: in order to have a sizable/constant rate of success as $n$ increases, we have to repeat steps 2 and 3 not the stated $t\cdot m^2$ times, but rather $t\cdot 2^m$ times. That's ...

5

Yes, RSA is secure as we know it — although recommended key sizes are ever-increasing, as expected. Any seemingly-simple result that suggests a long-studied, well battle-hardened cryptosystem is insecure should throw up red flags. As an exercise, I wrote up your algorithm in simple C code: #include <stdio.h> #include <stdlib.h> int ...

5

I do not remember if we checked this explicitly, but my guess is that in the chosen-plaintext setting the biclique attack would still be faster than the exhaustive search, maybe by the factor of 2 compared with 4 in the chosen-ciphertext setting. However, both results are pretty far from declaring AES broken in any sense. Such small gain over exhaustive ...

5

I commonly hear statements along the lines of "all cryptograms are crackable - it's only a matter of time" Using a perfectly random key which is as long as the message itself, not a pseudo-random key, cannot be broken no matter how fast the attacker's computer is. This scheme is called one-time-pad and its security is guaranteed by information theory ...

4

Let's first get something out of the way. You say ".. key-recovery attack for SPECK32/64 ..". This is not true. The cryptanalysis you linked attacks SPECK32/64 with 10 rounds. This is less than half the amount of rounds used for SPECK32/64. Then onto your actual question, is $2^{29}$ chosen plaintexts a good or a bad attack? I can't decide that for you, but ...

4

Full disclosure — I'm a Skein/Threefish co-author. Also, when I mention Skein/Threefish without any other qualification, I mean Skein/Threefish-512. The security proofs we did for Skein prove that if there's a weakness in Skein, it implies an underlying weakness in its components (Threefish or UBI). As Dmitry says above, Threefish is very strong, and there ...

3

This is called an Even-Mansour cipher. Actually, for the differential cryptanalysis it does not matter what sort of difference you use, you only need that it propagates deterministically through linear transformations (whatever linearity means). In this case you use a difference modulo $2^{32}$: $$A \boxminus B \equiv (A-B)\pmod{2^{32}}.$$ You compute ...

3

Can insecure algorithms be combined to form a secure algorithm? Yes: Think of any secure round-based block cipher. The independent rounds are not secure, but put together the overall cipher is. I think my favourite example is (currently) the Even Mansour cipher, which combines two xor operations and one unkeyed permutation to form a secure cipher. nb: I ...

2

One potential issue with this strategy revolves around compliance. You might be subject to various regulations (such as Government/DoD regulations) that prohibit unsafe hash functions. You might have a very unpleasant experience trying to explain to the audit team how using MD5 as part of user authentication does not mean "the terrorists win!"... In the best ...

2

Why are there exactly $m$ values for $k$? Well, assuming $k$ is the value of the shared secret that either Alice and Bob derive, well, that's not true; there are at most $m$ possible values, however it may be fewer. There will be exactly $m$ values if $g$ is a primitive root modulo $p$; however when we use Diffie-Hellman in practice, we generally avoid ...

2

I can several possible questions in the original post, hopefully I'll manage to answer at least one of them here. I have calculated a large $N$, with $\log_{10}(N)>600,000$. Is this suitable for RSA? We have that $\log_{10}(N)>6*10^5>2^{19}$, meaning $\log_2(N)>2^{19}$. Currently, implementations with $\log_2(N)\approx 2^{11}$ are coming into ...

2

Practicality: Using a bitcoin miner for cryptanalysis would at the very least require you to write very low-level custom code. Indeed, depending on the precise hardware/software split used by the miner, it might well require modifying the actual hardware to facilitate your cryptanalytic attack. Anyway, let's suppose someone could 'convert' one. What would ...

2

Is there any chance of finding symmetric key from encrypted public key? The answer is no, assuming the symmetric key has sufficient entropy and a secure encryption algorithm and mode is used correctly. Modern ciphers like AES with proper secret keys are not vulnerable to known plaintext attacks. Why? This has been answered in an earlier question: Why ...

2

I'll expand my comments into a full answer. Start by examining that you know the value of $r^3$ - this is just $F(r)$. You know you can express $F(r+1)$ and $F(r+2)$ symbolically. You can do this for any term in the key sequence, but it will be useful to write down $F(r+3)$. Forget any constant terms in the computations because they can be added in at ...

1

No, exposing such a hash does not compromise the RSA private key, unless the hash function is sufficiently and severely broken. Of course, you don't need to hash the private exponent to identify the key. You can simply use the modulus or a hash over the (public) modulus to identify the key. This has the additional advantage that that ID will also match the ...

1

For AES-128, the block cipher works on 128 bits at a time. Whichever block cipher mode you use (ECB, CBC, CTR, etc.), the encrypting will always be done on 128-bit blocks. The assumption is also made that padding is being used. Let's assume that $m = (a||b||c)$ and that $m' = (c||a||b)$. That gives us two separate messages, each 900 bits. Using ...

1

I'm going to assume that the comma $,$ operator used in your question means 'concatenate' (normally written $a||b||c$). Moreover, I'm assuming that $a,b,c$ are distinct. In that case, With incredibly high probability, No: $V_1$ and $V_2$ will not be equal. Think of it this way: if they were equal, then what would $D_k(V_1)$ be? Supposing $V_1=V_2$, we ...

1

It is too early to interpret the cryptanalytic results on those ciphers, as the results have not been verified by third parties. These papers are preprints, and they have not been peer-reviewed. I recommend to wait for the upcoming conference Fast Software Encryption 2014, where I expect to see many more new results on those ciphers, and they would undergo ...

1

Here is the actual proof (hopefully in close to plain English) that to encrypt n bits with perfect security you need n bits of key, and if you have less your system is Information-theoreticly unsecure and can be broken by an adversary with unlimited computing power. The basic principle of what we mean by secure here is, for all messages m in the message ...

1

If it only multiplies mersenne primes then likely not. For now I can think of RSA, DSA and the Diffie–Hellman key exchange for its uses (They use prime numbers). There are not enough mersenne primes for it to be used by itself. May be in can be used as part of a process. (Specialization).

1

As mentioned, most proofs of PRNG security are really proofs of a protocol that uses some underlying construct. The proofs say, "If the construct can't be broken, then the protocol that uses it can't be broken any easier than that." That makes all these proofs subject to the assumption that the underlying construct (like factoring, quadratic residuosity, ...

1

The two seeds add up to 56 bits but the fact that the random number is generated by xor'ing constrains the problem to 28 bits. With my machine running all 28 bit numbers xor the generating number gives every possible x and y in about 90 seconds. In python: P, out1, out2 = 295075153, 210205973, 22795300 def search(): for i in range(P): ...

Only top voted, non community-wiki answers of a minimum length are eligible