Tag Info

11

Note that, for the least significant bit, addition mod $2^n$ and xor are the same. So if the cipher doesn't include rotation then you can set up a linear equation in the least significant bits of the plaintext, ciphertext, and round keys that holds with probability 1 (if the cipher breaks the state up into two or more distinct parts, like a Feistel cipher, ...

11

One of the best examples that I know of is "chained CBC" as used in SSL. This looks exactly like regular CBC. The only difference is that instead of sending a new IV with every message, the IV is taken to be the last ciphertext block of the previous message. This is much more efficient since for small packets you don't need to send a large IV each time. In ...

7

Before we start with vectorial Boolean functions, let's recall the definition of the nonlinearity of a Boolean function: $$\mathcal{NL}(f) = \min_{a \in \mathbb{F}_2^n} d_H(f, \ell_a \oplus b),$$ where $\ell_a \oplus b$ represents the affine Boolean function defined by the bitvector $a$: $\ell_a(x) = a \cdot x$ ($\cdot$ is the dot product). The above ...

5

There is imprecision in what is stated in your notes. The Kasisky test only works if the corresponding letters in the two segments are separated by a distance that is a multiple of the key length (in other words they are encrypted by the same letter in the key). For example (source Wikipedia): [abcdea]bcdeabcdeabcde[abcdea]bcdeabc [crypto] is short for [...

4

Look at the S-boxes of DES. It turns out that if you choose them at random, you'll probably get an algorithm that's vulnerable to differential cryptanalysis, whereas if you use the NSA-approved ones, you'll get an algorithm that's highly resistant to it.

4

The function $f$ is biased towards the complement of the input $c_{i,j}$, assuming the other two inputs are approximately randomly distributed. As all the values $c_{i,j}$ are public, this means that the output of the function $R_i$, and hence the function $F$ is strongly distinguishable from random (being biased towards a known bit pattern). This isn't an ...

4

For fixed values $z$ the functions $\varphi_z(x) = ((x\oplus z)-x)\oplus z$ and $\varphi'_z(x) = ((x\oplus z)+x)\oplus z$ (where $-$ rsp. $+$ denotes subtraction rsp. addition modulo $2^n$) are linear over the field with two elements. In other words, considered as functions $\varphi_z : GF(2)^n \to GF(2)^n$, they are $GF(2)$-linear: e.g., for each $z$ there ...

3

Anyone who begins to develop an attack on primitive XYZ is probably not aware beforehand of what the computational complexity of their attack will turn out to be. Then, the attack is developed and computational complexity becomes known. Just because DES isn't broken by the attack in question does not mean no other ciphers will be. And just because the ...

3

Differential cryptanalysis is a very powerful technique that permitted highly practical attacks on many ciphers that were not designed to resist it (e.g. FEAL-4). DES, as it turns out, was designed to be pretty resistant to it, which is why it requires an essentially impractical amount of chosen plaintexts to implement a differential attack on DES. ...

3

Yes, these are public parameters of the system. Note that NTRU is not implemented exactly this way any more. The most up-to-date current spec is EESS#1, which can be obtained from https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/doc/EESS1-v3.1.pdf.

3

Does adding more characters to the (Enigma) rotors improve crypto strength? Not really… since the weaknesses of Enigma go well beyond the count of chars per wheel! Of course you could – theoretically – think of using very big (read: huge) wheels with an insane char range. But, when looking at the “time” and “resources” you would need to invest each time ...

2

The lattice basis $L$ generates every point that is a solution to the congruence $a^{i-1} x_1 - x_i \equiv 0 \pmod{m}$. By definition, the reduced basis $B = \mathsf{LLL}(L)$ also generates the same solutions; it just has shorter vectors. Now suppose we have a set of outputs $\mathbf{y} = y_i$ of the generator, which correspond to the most significant bits ...

2

Is it necessary to have 50 000 different reducing functions to avoid the collisions? Yes. If you do not have different functions it is not a rainbow table. It is just a table of hash chains which is less efficient, especially for high coverage tables. However, the functions do not have to be unrelated, just different. How do I create those ...

1

I guess you are taking this information from this document. In Section 2.1 you can see a table with different sizes. In particular, a plaintext block (that is, an encoded message) has size $(n-k) \log_2 p$ bits, while a ciphertext has size $n \log_2 q$ bits. The explanation is simple: ciphertexts are actually polynomials of $n$ terms (since degree is $n-1$)...

1

The Siegenthaler result is for boolean functions, i.e., $f:F_2^n\rightarrow F_2$, while you are considering vectorial boolean functions $$f:F_2^n\rightarrow F_2^n$$ so you can't apply it. The results in this area are quite technical. Some overview: You could certainly compute resilience (hence correlation immmunity for AES Sbox) by using the definition ...

1

No. ​ ​ ​ ​ Also, note that by hybrid encryption, ciphertext overhead will always be at most ​ ​ + poly(security_parameter) , ​ ​ no matter how long the message is. For IND-CPA of any public-key encryption scheme, or even symmetric encryption scheme with stateless encryption , ciphertexts for non-empty messages must be overwhelmingly likely to be ...

1

As @yyyyyy already commented: if you are able to successfully apply a length extension attack, you would be able to compute $$\operatorname{SHA256}(\mathit{secret}\Vert\mathit{padding}\Vert\mathit{data})$$ But computing $\operatorname{SHA256}(\mathit{secret}\Vert\mathit{data})$ for freely chosen $\mathit{data}$ without the $\mathit{padding}$ in between is ...

Only top voted, non community-wiki answers of a minimum length are eligible