Tag Info

New answers tagged

0

It really depends on the key schedule. IE, how is the key operated on to find the permutation to be used? Absent that knowledge, really the only way to know is to launch searches in parallel at different key lengths, and the one that finds the answer first had the right key length. Unfortunately anything more clever than that will utterly depend on how ...


2

Faliure of indistinguishablity of encryptions under a eavesdropper does imply faliure of indistinguishablity of encryptions under a chosen-plaintext attack. But the converse is not necessarily true (ex. OTP) The aim of CPA-secure is not to decrypt previously unobserved ciphertext but to pass the distinguishability test after a set of (plaintext, ciphertext) ...


3

Yes, if (and this is important) the keys for $E$ and $S$ are selected independently. Consider that we had two encryption methods $E$, $S$ for which their composition $E(S(x))$ is not CPA secure; that is, we have some distinguisher $D$ that had some advantage in distinguishing that from a random function. Then, we can build a distinguisher for $E$ (by ...


3

Note: In this answer, I stick to a definition of the One Time Pad where the random pad is used only One Time; at least, I've the name of it as support! Otherwise, it is well known that the OTP encryption scheme consisting of XOR with a repeated key is insecure by even the weakest standard (unknown plaintext with redundancy). INDistinguishability under ...


0

Ciphertext indistinguishability under CPA is equivalent to semantic security. Semantic security is the computational complexity analogue to Shannon's concept of perfect secrecy. OTP is perfectly secure, therefor is CPA secure. Under CPA, the adversary will be presented with a ciphertext corresponding to a plaintext queried (the adversary chose the ...


0

Yes, a function $f$ is said to be negligible if for every polynomial function $p(n)$ there exits some constant $N$ such that $f(n) < \frac{1}{p(n)}$ for all $n > N$. If $\frac{1}{n!} < \frac{1}{p(n)}$ then $n! > p(n)$, for all polynomials $p(n)$ and suitable $N$ such that $n>N$. Thus, you'd only have to prove the second segment of the ...


2

Hint: you can notice that $n! > 2^n$ (except for very small $n$).


2

I'm not aware of any classical polyalphabetic ciphers where the key could not be longer than the message. For the Vigenère cipher, the key is, effectively, repeated to make it as long as the message. There is no reason why it could not be repeated less than once, effectively discarding the unnecessary characters at the end of the key. Similarly, in the ...


3

If you can efficiently find a $P$ that is not coprime to $N$, then you can easily factor $N$ (use GCD). If you know the factorization of $N$ (say $N=pq$), you can easily find a $P$ that is not coprime to $N$ ($kp$ for some constant $k$). This established the fact that finding $P$ not coprime to $N$ and factoring are equivalent problems. Now, how many ...


1

The threshold for a perfectly secure system is that a computationally unbounded adversary cannot conclude anything about the plaintext from the ciphertext. With a public-key system, the attacker can try to encrypt messages with the real public key; this is not possible with one-time pads. What the attacker can do, quite simply, is to try all one-bit ...


2

If you know a multiple of $p$ and $k$ is smaller than $\sqrt(p)$ than you can use a different approach than the one by poncho. Note: knowing a multiple of $p$ is the typical case of RSA where you know the modulus $N$ made by $p\times q$, so if your question refers to RSA you are left only with the constrain on the size of $k$. The method you can use is an ...


4

If $p$ is prime, then $\phi(p) = p-1$; so the question is "given $k(p-1)$, can someone get a good guess of what $p$ might be?" It is unlikely that the attacker would be able to limit it to one particular value of $p$ (as there are likely to be multiple values of $p$ that are plausible), however the attacker might be able to construct a short list of ...


1

$A$ has outsourced it's private data to the server, right? In that case $A$'s private data has already been leaked to the adversary when the server was corrupted. So there is no added leakage in $B$ also learning this data. In fact since only one of $B$ and the server can be corrupted (assuming static corruptions) we can conclude that $B$ is honest, and ...


1

There's a lot of ways to attack this. The first thing to notice is that if you know the value of plaintext at index $i$, you can then deduce the value of all the plaintext bytes at index $i+8k$; for all integers $i$ (!). That's because the relation between plaintext and ciphertext bytes is $P_{i} = C_{i} \oplus P_{i-8}$; if you know $P_{i-8}$ (and, of ...


3

The answer is "irrelevant", because of a wrong assumption about security. Today, ciphertext only attacks are not considered any more for real security, because it is much too weak. Known plaintext attacks are the very least to be considered, and that breaks any construction of codes or obscure languages. The reason for this is simple: Laymen might only see ...


2

Assuming that the probability distributions of $\pi_{k_1}$ and $\pi_{k_2}$ are both uniform (that is, each permutation can take on any particular setting with probability $1/n!$), then no, adversary does not have enough information to learn anything about the original positions. This remains true even if we assume the adversary can perform unbounded ...



Top 50 recent answers are included