New answers tagged

1

a) The question seems to be about a comparison of the size of the key spaces. The hint already shows the key spaces for Vigenère with a 10-letter key ($26^{10}$) and for simple substitution ($26!$). Simple substitution has the much bigger key space. b) Using frequency analysis simple substitution is much easier to solve. Basic frequency analysis does not ...


0

It is easily seen that the value of $q$ is invariant modulo $e$. As a consequence, we always have $q \equiv p\cdot (p-1)^{-1} \pmod e$ and thus $q(p-1) \equiv p \pmod{e}$. So, the resulting modulus $N = pq$ is such that $N \equiv (p+q) \pmod e$. Example: With $p=10598342506117936057$ and $e=5004898192290387253$, the proposed construction yields the prime ...


1

As SEJPM already hinted at in his comment, a 7 bit key is short enough to allow a plain and simple brute-force attack because there are merely 128 different keys to be tested. Hint: 7 bit = 1111111 = 127, + 1 for the 0000000 key = 128 possible keys. Even when using a low-resource device, testing 128 different keys to find the correct one should be a pretty ...


0

This is called homophonic encryption, and has been around for a long time. In terms of cryptanalysis of such ciphers, there is a nice thesis from SJSU on this topic which is available here. The attacks tested in that cipher were based on hill climbing and local optimization techniques. The conclusion states: We designed and implemented an efficient ...


1

the receiver process decrypts the symetric key without telling if there is a padding error (OAEP padding) The idea of OAEP padding is that you can check the correctness of the padding without being vulnerable to a padding Oracle attack. This is called "all-or-nothing" security. You could however replace the wrapped symmetric key with a previously ...


5

You have to differentiate between it being theoretically OK and practically. Without fully checking, I can say that such an approach may be possible to fully prove. However, practically, it is almost impossible to implement it. Specifically, you have to be able to make it impossible to differentiate between an error due to the symmetric decryption or the ...


5

A boolean function $f:\{0,1\}^n\rightarrow \{0,1\}$ has correlation immunity $k$ if its walsh-hadamard transform coefficients $$F(a)=\sum_{ x \in \{0,1\}^n} (-1)^{f(x)+a\cdot x}$$ are zero whenever $1\leq w(a)\leq k,$ where $w(a)$ is the hamming weight of $a$. An sbox $S:\{0,1\}^n\rightarrow \{0,1\}^n$ has correlation immunity $k$ if the functions $b ...


3

Any group where you can derive $x$ from $g, g^x, g^{1/x}$ would also have the Discrete Log problem be equivalent to the (computational) Diffie-Hellman problem. Since this is not known to be true in general, we don't know of any general method for deriving $x$ from those values. This equivalence is quite simple to demonstrate; if it based on the fact that ...


-1

$e$ and $d$ cannot both be small, because $ed$ must equal at least $(p-1)(q-1)+1$, which is very large if the scheme is to provide any security against factoring algorithms.


2

If you want to attack the block cipher, then there are no generic attacks which use the block size. However, if you want to use a block cipher for messages which are longer than 32 bits, then you will have to use it in a mode of operation, like GCM, or OMAC (more popular modes are CBC and CTR, but they should not be used for communication on their own since ...


3

The block size does not directly determine the security of a block cipher. Even with a 32 bit block cipher the number of possible permutations is 2^32!, a stupendously big number. Small block sizes are however cumbersome to use in secure modes of operation as the input is limited. For instance, it would be easy to have repeating counters in counter mode ...


3

Remark: The round function of your toy cipher is the following. | K ---> + | ------- | S | ------- | >> 2 | Hence in the last round, the shift and S-box are useless (because invertible hence do not add security) which is why in a SPN scheme the key addition at the end is preferred. I did ...


0

Looks like Marvin32 is a part of a patent :-) And Microsoft really do believe it is resistant to Hash Flood attack. http://www.google.com/patents/US20130262421


2

The first thing you should do is estimate the key length. While you may be able to do this using Kasiski examination, in this modern era of computers I very much recommend instead using the index of coindicence, which you can compute very easily, e.g. with this Python program: import sys msg = sys.stdin.read() # read ciphertext from standard input for ...


1

If you encrypt (partially) random values then the likelyhood that you encrypt the same value is larger for block ciphers that operate of fewer bits. If you encrypt the same value with the block cipher (which is a PRP) it will result in the same ciphertext. Identical ciphertext can be used by an attacker to retrieve information about the plaintext, breaking ...


4

Can a variable that is not explicitly computed correlate with the power consumption? Yes, and this can happen in several ways. When you say "not computed explicitly", I assume you mean that the computation is performed on a masked value or share instead. That is, the secret inputs (referred to as the key by the paper you link to) themselves do not ...


1

You're essentially asking if SHA-3 can use a keyed hash instead of an HMAC. The short answer is yes. But there's more to it than that. In the SHA-3 competition, two of the finalists (Keccak and Skein) were specifically designed to have a one-pass MAC as part of their design, and that's what the answer above is giving about Keccak. KMAC is Keccak's ...


1

Most of side channel attacks are depends on algorithm and implementation. In several cases, power consumption is evidently visible in algorithm. For example in the algorithm for elliptic curve points multiplication, for computing $Q=k\cdot P$ we have following algorithm: Let $k$ be $l$ bit. Q=P for i from l-1 to 0 do Q = 2Q if k_i == 1 then Q = Q+P ...


1

The main complexity of attacks using a quantum computer with Grover's attack is explained here. I'll use the remainder of the answer to indicate some possible misconceptions in your question. It's hard to say exact QC specs, but let's assume we have decent a quantum computer using Grover's algorithm that is able to half AES-128 keyspace to that of ...


1

I believe the only way you can do this is to assume you have fixed length inputs to the hash function $f$. Otherwise, it is problematic what probability distribution you'd want to impose on the input set $\{0,1\}^{\ast}$ which is the collection of all finite input strings. In practice, hash functions do have an upper limit on the input string, but that's ...


5

HMAC does not provide an obvious security improvement over the KMAC construction, which is optimal for Keccak based functions. HMAC is designed to create a secret initialization vector or IV for Merkle-Damgård type hash functions, KMAC does the same for sponge based hash functions but much more efficiently. HMAC also needs to deal with the length extension ...


10

There is no such thing as a 16 bit AES key. AES is a block cipher with a block size of 128 bits and a key size of 128, 192 or 256 bits. As a block cipher, AES can only encrypt 16 bytes (128) bits at a time. AES in itsef is not (CPA) secure as repetition of the plaintext would lead to repetitions of the ciphertext. To encrypt larger amounts of data, AES ...


0

ChaCha20 and Salsa20 are both considered secure ciphers and so looking at the keystream will get you nowhere. What you can do is analyze your implementation: It should run in exactly constant time regardless of inputs. There should be no data-dependent branches or array lookups


3

Our goal is to find a root $(x_0,y_0)$ in $\mathbb{Z}_e$ of the polynomial $f(x,y) = x(A+y)-1$. Finding roots of a polynomial in any $\mathbb{Z}_n$ isn't an easy job, in order to solve the problem Coppersmith had the idea to reduce to problem to finding a root $(x_0,y_0)$ over $\mathbb{Q}$ of some other polynomial $f'$ related to $f$. About Coppersmith ...


2

Scheme is not IND-CPA for any message longer than one block. I'll include a image of CBC mode below for reference (Source: Wikipedia). Suppose instead of block cipher encryption we have plaintext xor-ed with the key as you propose. You'll note that for message block 1, $M_1$, the ciphertext block $C_1 = M_1 \oplus IV \oplus Key$. Similarly $C_2 = M_2 ...


4

See Vitor's answer for the answer your professor was looking for. However, for any PRNG of the form $s_{i+1} = F(s_{i})$, where the attacker sees the $s_i$ values, and knows $F$, then he can distinguish it. Given a sequence of values $r_1, r_2, ...$, he can determine whether it was generated by that PRNG by checking if $r_2 = F(r_1)$; this is always true ...


9

$s_i = s_{i-1}\cdot(N + 1) + 1 = s_{i-1} \cdot N + s_{i-1} + 1$ but $s_{i-1} \cdot N = 0 \pmod N$, so $s_i = s_{i-1} + 1 \pmod N$ which means you can discover the next number to be generated just looking to the current one...



Top 50 recent answers are included