# Tag Info

11

Even though all the operations you described can be performed homomorphically, the result remains encrypted, i.e., the attacker cannot "see" it. So homomorphic computation is not useful (on its own) as an attack, because the results remain unknown to the attacker. For example, given two ciphertexts $c, c'$, an attacker can homomorphically compute whether ...

10

In complete honesty: if you have to ask this question, it's overwhelmingly unlikely that you have actually succeeded in breaking the security of AES. At best, you may have discovered a well-known attack against misuse of particular block cipher modes; for instance, plaintext recovery with a chosen-ciphertext attack against ECB, or blind manipulation of the ...

6

The cost of finding collision for SHA-1 is currently estimated as $2^{61}$ SHA-1 calls. To understand how much (or how little) it is, we could look at Bitcoin mining. Right now (September 2014) the entire mining network computes 200,000,000 giga-double-hashes of SHA-256 per second, or $2^{61}$ hashes in three seconds.

5

I won't say someone would be able to break it 'easily'; however it won't be anywhere as difficult as with a true 128 bit cipher (or even 120 bit cipher; your construction ignores 8 of the key bits). Here's an outline of how the attack would work: we assume we know the plaintext and the ciphertext, and are trying to recover the key. When we do is encrypt ...

5

Assuming you really had broken AES or another frequently used algorithm that is thought to be secure, the first step would be to prove it. Write the code for the attack. Verify that it works on randomly generated data of the kind it requires. If it can break some challenge (e.g. these), do it. Post the results to the challenger or show the results ...

5

Nobody can tell you not to "have fun with it" but I would strongly recommend you to first study attacks on other ciphers. Spritz (Rivest & Schuldt) fortunately mentions a lot of research on its predecessor, RC4. This makes it a rather good starting point in my opinion. It is necessary to understand the linguistics and mathematical constructs that are ...

4

Since bits are independently generated, the entropy of the key is the sum over the entropy of the individual bits. The following calculations use the chance $P(x)$ of a zero or one bit. The first 5 bits are constant and thus have 0 entropy. The others are unbiased and have 1 bit of entropy each. $P(0)=P(1)=0.5$. $-2\cdot(0.5 \cdot \log_2(0.5))= ... 3 The actual security would probably be about 65 bits. A meet-in-the-middle attack can be used to find the keys of both ciphers in less time than naive brute force. The attack would decrypt the ciphertext with all the 64 bit l keys of the outer cipher, encrypt the plaintext with all the 56 bit keys of the inner cipher, then look for matches. It only requires ... 3 Stevens' attack is on full SHA-1, not a reduced round variant. The differentials are on only part of the rounds, but the attack itself extends to the full algorithm. However, the attack (pdf of full paper) described as "fully working" in the slides you link has still not been used to demonstrate actual collisions, so it's indeed theoretical. Additionally, ... 3 Let's say I choose$m = 8192$,$a = 4801$, and$c = 83$. By looking at the value of$x$, I can learn quite a lot about the value of$y$: for any$x$, there are only about nine or ten possible subsequent$y$s, and they're very unevenly distributed. With a LCG every$L_1$has a single possible$L_2$, and for a maximal period the reverse is also true. ... 3 As one of the authors of the paper, let me give you an answer. The operation$F$is indeed applied to both$x$and$x'$. By stating that$\oplus$is invariant under rotation, we mean that if you first rotate$x$and$x'$and take the difference with$\oplus$, you get the same result as if you first take the difference with$\oplus\$ and then rotate the ...

2

PBKDF2 is defined for an arbitrary PRF, but in practice HMAC is usually used. Either with SHA-1 (original definition), SHA-256 (e.g. in scrypt) or even SHA-512-256 (NaCL). So first you can look at how swapping key and message affects HMAC. HMAC has two cases depending on the length of the key: if it's no longer than the block size of the hash, it is used as ...

2

Assuming for the moment that your claim is correct, I would suggest caution in revealing the details of your findings. After having your results validated by one or two people with the skills to do so (and whom you trust to keep things confidential), then some sort of general announcement (without specifics) would be best, to give people time (say three ...

2

You would need (at least) 3 pairs of vectors in order to determine the 3*3 matrix.

2

Yes, it would be more secure if they were used correctly. But as it would require a substantially different algorithm, you really would not be talking about DES anymore. Brute forcing usually scales exponentially with the size of the key. However, if the algorithm is substantially altered then it is required to analyze the algorithm again. Note that AES is ...

2

What you propose is called Double Encryption. With two independent keys, it is vulnerable to meet-in-the-middle attacks as described in another comment. I just add that this attack can be performed almost memoryless. Details are in the answer to similar question about Double-DES.

1

There are several known attack techniques on homomorphic computation. Google's first paper describes an attack involving a modified secret key. In this paper we present an attack on this fully homomorphic encryption scheme. In fact, our attack only aims at its “somewhat homomorphic encryption algorithm”. We construct a modified secret key, a modified ...

1

Basically, "length" increases the time a brute force or other generic attack takes, while "complexity" makes it more difficult or less likely to find attacks faster than those. However: The length in question varies depending on the algorithm or operation. It can be the length of keys, the block size of a block cipher, the state size of a PRG or the ...

Only top voted, non community-wiki answers of a minimum length are eligible