# Tag Info

2

I have looked at some attacks on RC4 and be curious if some of them can be applied to Spritz as well. Does anybody else has analysed Spritz so far? Or is it far too early for results against Spritz? No third party analysis. Probably way too early. (Even the paper you linked is unpublished.) The answer may of course change any time. From the ...

-2

Use something more collision resistant like SHA... I can't find any hashes that are completely collision proof, but sha at least decreases the collisions...

2

You are correct in that after the birthday bound you will leak some plaintext in random 8-byte blocks. Nova's answer has the specifics and links to useful sources. To give you a rough idea of the risk, you can look at what percentage of the data could leak. 10 TB is about $2^{40}$ blocks. The expected number of collisions is $2^k (1-(1-2^{-n})^{2^k-1})$, ...

2

As far as I understand, the scheme is: $$MD5(x) = a_1||a_2||a_3||a_4 \, \, \Longrightarrow \, \, H(x) = a_1 \oplus a_2 \oplus a_3 \oplus a_4,$$ with $a_i$ 4-byte/32-bit words. Obviously you can't guarantee a unique 32-bit hash from an unbounded domain, due to the pidgeonhole principle. Neither can you make finding collisions infeasible, since $2^{16}$ MD5 ...

3

I didn't find anything about the exact way Crashplan encrypts files, only that it uses Blowfish in CBC mode. The block size of Blowfish is 64 bit, so there are $2^{64}$ different input blocks and the same number of output blocks. All in all $147573953$ terabytes of different output data. The problem with this is the birthday attack. Summarized it says that ...

0

You cannot escape the birthday bound - it will eat your lunch lunch every time. MD5 has a good uniform distribution, so should your algorithm. Since it outputs 32-bit values, you should expect collisions after around $\sqrt{\frac{\pi}{2}2^{32}} = 82137$ hashes.

2

AES was designed to behave like an ideal cipher. An ideal cipher has no weaknesses when used with a non-uniformly distributed key (beyond that inherent in the non-uniform distribution of the key). Therefore, if AES does indeed meet its design goals, there are no shortcut attacks on AES that exploit special properties of AES, when using non-uniformly ...

1

My experience is that hill climbing is very efficient for solving substitution ciphers. As I understand there are two topics now. How to generate the child keysSwapping characters of the key randomly (stochastic hill climbing) as well as trying all possible swap combinations is reasonable. But for solving a substitution cipher I believe trying all ...

3

As far as I know, NO, there has not been any cryptanalysis of AES under a non-uniformly distributed key. That holds even if we let the adversary decide what the non-uniform distribution is. Of course we should adjust the expected difficulty of attack according to the entropy remaining per the distribution; but typically, hashing a low-entropy password looses ...

2

The same way other ciphers, basically, only it does it better than some. From the Blowfish paper these were the relevant building blocks "demonstrated to produce strong ciphers" in previous designs: "Large S-boxes. Larger S-boxes are more resistant to differential cryptanalysis." "Key-dependent S-boxes. While fixed S-boxes must be designed to be resistant ...

2

For security in Shamir secret sharing we need that the coefficients of the polynomial are independent and uniformly random in the field. Multiplying the polynomial by a constant from the field does not change this, so yes, you can do it and still be secure. In fact, in multiparty computation, something akin to this is done when we want to privately multiply ...

1

python code: import hashlib, sys hashDict = {} total = 10000000 for i in xrange(1,total): hashd = hashlib.sha1(str(i)).hexdigest() relev = hashd[:10] if relev in hashDict: print " *** Collision found ", hashDict[relev], " and ", i sys.exit(0) hashDict[relev] = i Could be made slicker, but I was just typing the first ...

1

If you have $t-1$ shares of an $(t,n)$ system, you have a chance at learning of the roots of the system... as long as some of your shares have a 0 for the $y$ coordinate. You can't learn any other roots. Demonstration that the possession of a share with a $y$ coordinate of 0 gives you knowledge of a root (and forgive me if this is too obvious): A share ...

3

The BSW07 CP-ABE scheme is a pairing based construction. Denoting the pairing as $e:G\times G\rightarrow G_T$ (symmetric notation for simplicity), the message space of this scheme is the prime order $q$ group $G_T$, which in practice is a prime order $q$ subgroup of the multiplicative group of some finite field. Consequently, if you have a message $m$ and ...

4

In real world applications Attribute-based Encryption (ABE) is used in conjunction with a symmetric cipher, because you can only encrypt group elements with ABE. In this case it is the multiplicative group $G_T$. The number of bits is limited when you try to represent text messages (bit strings) with a group element, because the size of the group is derived ...

Top 50 recent answers are included