New answers tagged

3

Wrapping up my comment as an answer: Imagine you’re a Japanese cryptanalyst in the year 1944. There is no such thing yet called “television”, and you’re still decades away from a wordwide network feeding you with all the knowledge you could wish for. In that case there’s only a minimal chance you’ve ever heard or seen a Navajo. So, you’ll be wondering ...


0

Just to show you how easy it is today to create collisions on MD5: One could create collisions using Marc Steven's HashClash on AWS and estimated the the cost of around $0.65 per collision. These 2 images have the same md5 hash: 253dd04e87492e4fc3471de5e776bc3d (If you want to test it yourself, take images from the link below, after uploading ...


1

I think that in a completely unknown language you have to do frequency analysis on whole words and match that against English. I believe they just didn't have the word-level stats for English, in the military context, and I guess they did not have enough material to derive any significant stats from.


1

A quick internet search delivered this description of Enigma: "This meant that the notches were engaged when Q, E, V, J and Z were uppermost on rotors I, II, III, IV, and V respectively and that therefore the turnover positions were R, F, W, K, A, remembered by the cryptanalysts at Bletchley Park by the mnemonic Royal Flags Wave Kings Above." So this ...


1

Remember that the initial value is split into two halves, and each half is shifted independently. If all the bits in each half are either 0 or 1, then the key used for any cycle of the algorithm is the same for all the cycles of the algorithm. This can occur if the key is entirely 1s, entirely 0s, or if one half of the key is entirely 1s or the other half is ...


3

I'll answer question 2, leaving the first as an exercise to the reader. I'll do this on intuitive grounds, rather than using explicit conditional probabilities. The adversary is free to compute $v_1\cdot v_2$ regardless of what we ask, therefore removing everything about that and $v_3$ does not change the problem, which reduces to: We somewhat have ...


0

In full codebook, data complexity equals to all input of cryptosystem and in non full codebook is less than it. For example in SIMON 32/64, if data complexity=2^32, the attack is full codebook, and if DC < 2^32, the attack is non full codebook.


1

I just came across this question and was surprised that no one referenced the paper: A Natural Language Approach to Automated Cryptanalysis of Two-time Pads by Mason et al. at ACM CCS 2006. This shows how to solve this problem in an automated and intelligent way.


2

what is the range for exponent e? Actually, there is no required upper bound for $e$ (except that some implementations may reject ridiculously large values). The math behind RSA states that any $e$ that is relatively prime to both $p-1$ and $q-1$ will work, no matter how large it is. There might not appear to be a need for an $e > lcm(p-1, q-1)$ (as ...


0

As explained on this page you have: $1 < e < \phi(n)$ so with the specific values you mentioned we have: $\phi(n) = \phi(p \times q) = \phi(p) \times \phi(q) = (p-1) \times (q-1) = 12 \times 16 = 192$ (see Euler's totient function definition) The threshold on the maximum integer you can encrypt is $n-1$ which is $76$ if $p=7$ and $q=11$. Note that if ...


6

Let us first consider the problem without involving Shamir secret-sharing at all. Suppose that $n = 140$ and that the secret $\sigma$ is a 140-byte Twitter message. The space is thus restricted considerably, from all possible $256$ byte values to the printable characters permitted to be used in Twitter messages, and the distribution in this restricted space ...


3

I'm not sure I understand your question entirely. If there is only one possible message, then the ciphertext can be trivially decrypted simply by choosing this message. I'll assume instead that the ciphertext contains the shuffled bit pattern of a name chosen from a set of more than one name. The problem with bit shuffling is that the number of set bits ...


0

In cryptography, algebra and number theory are mainly tools, which are used to implement the various primitives (one-way functions, trapdoor permutations, whatever). Hence, one of the most pressing concerns in this area has to do with devising efficient algorithms to perform various number-theoretic computations, both for implementing cryptosystems (e.g., to ...


0

There is a paper by Daniel Bleichenbacher and Alexander May called "New attacks on RSA with small secret CRT-Exponents" (you can find it under http://www.cits.rub.de/imperia/md/content/may/paper/crt.pdf). They are not quite able to break the RSA under your assumptions. I'm not aware of better results, but I didn't look at the list of articles citing this ...


0

In his paper, Wiener suggests using large values of $e$ when the exponent $d$ is small. When $e>N^{1.5}$, Wiener's attack will fail even when $d$ is small. Boneh and Durfee attack is an improvement for Wiener's attack. With this attack you can decrypt $c$. This attack use $LLL$ algorithm. For more detail you can see "Cryptanalysis of RSA with Private ...


4

By two-time pad I assume you mean using a one time pad key to encrypt two messages. Lets say $K$ is the key and $m_1, m_2$ are your messages. Then from the ciphertexts $c_1 = m_1 \oplus K$ and $c_2 = m_2 \oplus K$ an adversary could trivially learn information such as $x = c_1 \oplus c_2 = m_1 \oplus m_2$. Whether or not this information is "exploitable" may ...


5

Well, to start off with, we have: $$k_1 m_1 + k_2 - n_1 p = c_1$$ $$k_1 m_2 + k_2 - n_2 p = c_2$$ $$k_1 m_3 + k_2 - n_3 p = c_3$$ Where we know $m_1, c_1, m_2, c_2, m_3, c_3$, and we don't know $k_1, k_2, p, n_1, n_2, n_3$. I chose to use explicit unknown integers $n_1, n_2, n_3$, rather than modulo an unknown $p$, as it makes it easier to justify the ...


2

Is javascript RSA signing safe? …is safe or can people forge… In contrast to the accepted answer, I would not call it “safe” from a cryptographic point of view and I would definitely not say that “ if you take good care of securing your environment where you run the JS code you will be OK. ” because the sad fact is: that’s not enough to ensure ...


0

The number of your ID card is not really a secret, and probably shouldn't even considered one. You could use it as a key for symmetric encryption (but for this purpose you'd have to share it with your communication partners, and everybody knowing the ID could read the communication), but not for public/private key cryptography. This is the reason why the ...


1

Q: Is there any way I can infer what is being used to encrypt the file? A: Yes there is some way. Examples: Reverse engineer the software to figure out what algorithm they use as Gilles said. This is not related to cryptography. Learn crypt-analysis to infer the enc alg used. You might win several prestigious awards along this path. The reason it's so ...


5

The other answer already explains that what you are looking for is a message authentication code, but did not show a clear attack against your construction. At the very least it seems to be vulnerable to length-extension type attacks, like the keyed hash mentioned: Take the output for some known message, where the length of the key x and message v is ...


6

If I understood your question correctly, you want a message authentication code (MAC). The "hidden input" is usually called key and the "visible input" is just the message. The output of the MAC is called tag (or also MAC). The main security goal for MACs is resistance against forgery: It should be computationally infeasible for an attacker who does not ...


2

The reference definition of Spritz seems to be: Ronald L. Rivest and Jacob C. N. Schuldt, Spritz - a spongy RC4-like stream cipher and hash function, presented at Charles River Crypto Day (2014). The code snippet of the question shows how the state of Spritz repeatedly used in DBRG output mode is updated and its next output byte $z$ produced; the state ...


1

What you're describing is a ciphertext-only attack on AES. No, there's no (known) ciphertext-only attack on AES. Condition one: We know none of the weaknesses and similar plain-texts in these two blocks, I just mentioned, how easily could we discover it? By the lack of an transmitted IV, an attacker can learn whether the two messages are equal and ...


1

Machine learning and decision tree models are being used and improved everyday to break ciphers. Quantum computing coupled with machine learning is nowadays one of the most sophisticated tools for decryption.


0

The NIST test suite for random numbers implements "short-term memory" machine learning algorithms. It needs to save and categorize all relevant data to be "long-term memory" machine learning. Paper: http://csrc.nist.gov/publications/nistpubs/800-22-rev1a/SP800-22rev1a.pdf Suite: https://gerhardt.ch/random.php


4

I'm happy to have a crack at this one, providing I've understood your question correctly. Firstly I wouldn't say the cipher possibly exhibits low level bias at any point. It experiences plenty of bias and I'll attempt to explain how we can use it to launch practical attacks. As I'd imagine you know, the strongest bias is found right at the start of the KSA, ...


2

I'm thinking that is not true. Because if we have $p=67$ and $q=3$ then $N=201$ and $p+q-1=69$ and so we have inconsistence.


4

To build on mikeazo's answer (since it's not really practical to post code in comments), here's a quick Python program that takes any two permutations of $\{0, \dots, 255\}$ and generates a key that transforms one into the other when run through the RC4 key setup: # source and target permutations s = range(256) t = [181, 172, 179, 178, 177, 168, 175, 174, ...


5

Wanted to expand on my comment as an answer. The KSA in RC4 permutes the bytes [0,1,...,255] using a key, say $k_u$. For any permutation of these bytes, there exists a key that will get you that permutation. The idea you outline is basically to start by permuting the bytes [0,1,...,255] according to some fixed initial permutation, then permuting the bytes ...


8

There is likely an assumption on the sizes of $p$ and $q$ that you haven't listed in your question that exists in the description. For example, Boneh's description of Wiener's attack has that $q<p<2q$. With that assumption, we can prove the inequality. We know that $$p+q < 2q+q$$ $$p+q < 3q$$ Furthermore, since $N=pq$ and $p>q$, we have ...



Top 50 recent answers are included