New answers tagged

3

Yes, these are public parameters of the system. Note that NTRU is not implemented exactly this way any more. The most up-to-date current spec is EESS#1, which can be obtained from https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/doc/EESS1-v3.1.pdf.


0

In a chosen plaintext attack, the expected ciphertext length required to conclude that a decryption is correct was derived by Claude Shannon and is called the unicity distance. It depends on the distributions of the plaintext and the key and is infinite for the one time pad. See, e.g., wikipedia or van der Lubbe's Information Theory text.


2

The lattice basis $L$ generates every point that is a solution to the congruence $a^{i-1} x_1 - x_i \equiv 0 \pmod{m}$. By definition, the reduced basis $B = \mathsf{LLL}(L)$ also generates the same solutions; it just has shorter vectors. Now suppose we have a set of outputs $\mathbf{y} = y_i$ of the generator, which correspond to the most significant bits ...


2

Is it necessary to have 50 000 different reducing functions to avoid the collisions? Yes. If you do not have different functions it is not a rainbow table. It is just a table of hash chains which is less efficient, especially for high coverage tables. However, the functions do not have to be unrelated, just different. How do I create those ...


6

Before we start with vectorial Boolean functions, let's recall the definition of the nonlinearity of a Boolean function: $$\mathcal{NL}(f) = \min_{a \in \mathbb{F}_2^n} d_H(f, \ell_a \oplus b),$$ where $\ell_a \oplus b$ represents the affine Boolean function defined by the bitvector $a$: $\ell_a(x) = a \cdot x$ ($\cdot$ is the dot product). The above ...


3

Does adding more characters to the (Enigma) rotors improve crypto strength? Not really… since the weaknesses of Enigma go well beyond the count of chars per wheel! Of course you could – theoretically – think of using very big (read: huge) wheels with an insane char range. But, when looking at the “time” and “resources” you would need to invest each time ...


4

Look at the S-boxes of DES. It turns out that if you choose them at random, you'll probably get an algorithm that's vulnerable to differential cryptanalysis, whereas if you use the NSA-approved ones, you'll get an algorithm that's highly resistant to it.


11

One of the best examples that I know of is "chained CBC" as used in SSL. This looks exactly like regular CBC. The only difference is that instead of sending a new IV with every message, the IV is taken to be the last ciphertext block of the previous message. This is much more efficient since for small packets you don't need to send a large IV each time. In ...


5

There is imprecision in what is stated in your notes. The Kasisky test only works if the corresponding letters in the two segments are separated by a distance that is a multiple of the key length (in other words they are encrypted by the same letter in the key). For example (source Wikipedia): [abcdea]bcdeabcdeabcde[abcdea]bcdeabc [crypto] is short for [...


4

The function $f$ is biased towards the complement of the input $c_{i,j}$, assuming the other two inputs are approximately randomly distributed. As all the values $c_{i,j}$ are public, this means that the output of the function $R_i$, and hence the function $F$ is strongly distinguishable from random (being biased towards a known bit pattern). This isn't an ...


1

No. ​ ​ ​ ​ Also, note that by hybrid encryption, ciphertext overhead will always be at most ​ ​ + poly(security_parameter) , ​ ​ no matter how long the message is. For IND-CPA of any public-key encryption scheme, or even symmetric encryption scheme with stateless encryption , ciphertexts for non-empty messages must be overwhelmingly likely to be ...


0

One possibility is that the cipher might be a combination of a transposition cipher and a (probably monoalphabetic) substitution cipher. Since the transposition step will not affect letter frequencies, you cannot tell this combination from a simple substitution cipher based on simple frequency analysis alone. One way to check whether this might be the case ...


0

Also, differential attacks can be useful in the design of a cipher to strike the right balance between performance (e.g., number of rounds) and security. Let's assume DES initially had 10 rounds and the designers performed a differential attack on that setup. They would have found that 10 rounds were not buying enough resistance against that type of attack ...


3

Anyone who begins to develop an attack on primitive XYZ is probably not aware beforehand of what the computational complexity of their attack will turn out to be. Then, the attack is developed and computational complexity becomes known. Just because DES isn't broken by the attack in question does not mean no other ciphers will be. And just because the ...


3

Differential cryptanalysis is a very powerful technique that permitted highly practical attacks on many ciphers that were not designed to resist it (e.g. FEAL-4). DES, as it turns out, was designed to be pretty resistant to it, which is why it requires an essentially impractical amount of chosen plaintexts to implement a differential attack on DES. ...


11

Note that, for the least significant bit, addition mod $2^n$ and xor are the same. So if the cipher doesn't include rotation then you can set up a linear equation in the least significant bits of the plaintext, ciphertext, and round keys that holds with probability 1 (if the cipher breaks the state up into two or more distinct parts, like a Feistel cipher, ...


4

For fixed values $z$ the functions $\varphi_z(x) = ((x\oplus z)-x)\oplus z$ and $\varphi'_z(x) = ((x\oplus z)+x)\oplus z$ (where $-$ rsp. $+$ denotes subtraction rsp. addition modulo $2^n$) are linear over the field with two elements. In other words, considered as functions $\varphi_z : GF(2)^n \to GF(2)^n$, they are $GF(2)$-linear: e.g., for each $z$ there ...


1

As @yyyyyy already commented: if you are able to successfully apply a length extension attack, you would be able to compute $$\operatorname{SHA256}(\mathit{secret}\Vert\mathit{padding}\Vert\mathit{data})$$ But computing $\operatorname{SHA256}(\mathit{secret}\Vert\mathit{data})$ for freely chosen $\mathit{data}$ without the $\mathit{padding}$ in between is ...


0

The British decrypted the German enigma because they knew that they would repeat the message key twice at the start of every message. The Poles decrypted the Enigma because the message key was repeated at the start of each message. The encryption key for the Enigma messages changed daily but what if the Germans also specified an amount of nulls ...


0

The idea in [1] (disregarding reception errors) is to first remove the impact of the message. This is done by computing the syndrome $\qquad\qquad\mathbf{H} \mathbf{v} = \mathbf{H} (\mathbf{m} \oplus \mathbf{k}) = \mathbf{H}\mathbf{k}$. In the case of a ${1}/{5}$ repetition code, this could correspond to adding even number of (bold) codeword symbols ...



Top 50 recent answers are included