# Tag Info

## New answers tagged cryptanalysis

0

It works with autokey system because the key itself have a bias : in the key is much more E than other letters (this is a natural consequence of using a clear text as key).

0

I found my answer from a different question very similar to mine from this(crypto.stackexchange). Hope it helps.

1

If you are able to compute $m^1 \pmod{N}$, then you have (obviously) recovered the message $m$. So, you should be able to use the extended Euclidean algorithm to express $m^1 \pmod{N}$ in terms of $c_A$ and $c_B$. Hint: It will involve exponentiations and multiplications.

2

Yes and yes, as mentioned in the comments. It is worth noting that Bitcoin wallets use a scheme similar to this in BIP32, a method of creating n various EC keypairs from a single seed deterministically: https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki

2

Yes, this is exactly what KDFs and PRFs are designed for. That is, no reasonably efficient attacker will be able to tell if you used an actual random key or something generated from the KDF/PRF. This is of course assuming that your initial seed/master secret was of sufficient entropy, and the way you derive the various values are not done in a silly way. ...

0

What you did seems fine for verifying the key is correct. However, unless AES256_encrypt uses an authenticated mode of encryption (in which case the whole exercise would be unnecessary), there is nothing that prevents an attacker from modifying the message. And depending on the mode of encryption used, that can even compromise the privacy of the message. ...

0

Since you are approaching this from the point of view of mathematics, I think the most fruitful avenue would be to look at asymptotic performance and security of the problems that the cryptosystems are based on. For example, with RSA you need a modular exponentiation for every message you encrypt or sign. The time that takes depends on the length of the ...

1

So the idea is to use the IV of MD5 as a key to create a MAC. Like CodesInChaos mentions in a comment, it would be pretty much equivalent to using $H(k||m)$, if your IV is randomly chosen. By only using it on fixed length messages you avoid the length extension attack, but that is not the only attack on hash constructions that try to create a MAC. In this ...

0

An IV is not a key. In modes of operation, an IV does not have to be kept secret, and in order to decrypt everything you need the IV, which is transmitted in the clear. The only required property of an IV is that it is unique, or at least with overwhelming probability unique. For that you can use "bad" randomness to create it (e.g. from a non-secure PRNG). ...

3

The requirement was introduced in IUT Recommendation X.509 (November 1993), informative appendix D.5.2: It must be ensured that e > log2(n). If not, then the simple operation of taking the integer eth root of a ciphertext block will disclose the plaintext. This advice was removed in the 2000 edition of the standard. It is arguably misguided, and at the ...

0

The form of equation you expect is not usually applied to Shamir's Sharing Scheme. Instead the equation is usually represented as polynomial: $$f\left(x\right)=a_0+a_1x+a_2x^2+a_3x^3+\cdots+a_{k-1}x^{k-1}\,\! \mod p,$$ where $k$ is number of pieces needed to restore the secret; $a_i$ are random coefficients (modulo p) and $p$ is 13 (in your case). ...

0

Given any $n-$bit sequence $(a_1,\ldots,a_n)$ with $a_k \in \{0,1\}$ you can use the Berlekamp Massey algorithm (which is conveniently recursive) to obtain minimal degree characteristic polynomials $C_m(X)$ where $C_m(X)$ is the output polynomial of Berlekamp Massey, when its input is $(a_0,\ldots,a_m)$ with $1\leq m\leq n.$ The linear complexity profile of ...

3

This specific hash function is weak; it appears that what this hash function does is pad out the string to be hashed into a 32 byte string, and then take the 8 4-byte substrings, and maps each substring individually into an individual byte. This immediately makes it trivial to find a preimage; start with a random 31 byte preimage (there appears to be a bug ...

-1

For the symmetric key crypto, generally speaking, you must provide the secret key to the other end for decryption. The same random keys can be generated at the receiver end, if you use same function with same parameters. I am also a bit confused, since you have also used "signature" word in your program. Are you talking about the encryption or the ...

4

As otus suggests in the comments, it's better to first calculate the frequency of each letter in the decrypted message, and then compare the frequency distribution to what would be expected for English text. For the comparison, you can use chi-squared ($\chi^2$) testing. (Actually, for just comparing the likelihoods of different decryptions, you don't even ...

2

As CodesInChaos notes in the comments, having more ciphertext–plaintext pairs doesn't help with brute force guessing attacks. Well, that is, except for the minor issue of unicity. Basically, to narrow the results of your brute force attack down to a single key, you do need to have enough ciphertext–plaintext pairs that the length of the known plaintext ...

0

you could also use some grammar to eliminate false positives, for example, in portuguese, before the letter "p" or "b" there should be a "m" and after the letter "q" there is always a "u", after the letter "l" it will be a vogal or the letter "h". There are patterns like these in english, i just can't seem to remember now xD

Top 50 recent answers are included