# Tag Info

1

If the attacker can make related-key chosen-plaintext queries, then there is a generic attack that can break any block cipher with $n$-bit keys in $2^{n/2}$ time, using $2^{n/2}$ related-key queries and $2^{n/2}$ memory. So against a related-key attacker, the effective strength of a block cipher can be no more than half the key length. However, the ...

0

Your question here has two answers, depending on what you mean. The first is the distinction between birthday attacks and exhaustion attacks. In a birthday attack, the attacker wins if he gets two messages that have the same key. And in that case the security is proportional to half the key length. In an exhaustion attack, the attacker has a specific ...

0

It really depends on the key schedule. IE, how is the key operated on to find the permutation to be used? Absent that knowledge, really the only way to know is to launch searches in parallel at different key lengths, and the one that finds the answer first had the right key length. Unfortunately anything more clever than that will utterly depend on how ...

2

Not quite, if all possible permutations are allowed. There are $8! = 40320$ permutations over 3 bits; 15 bits of key allows you to specify $2^{15} = 32768$ of them; hence any mapping of 15 bits will necessarily $40320-32768 = 7552$ of permutations unexpressable. It is doable if you don't allow every single permutation (e.g. allow only even permutations), ...

0

Bruce Schneier's Description of a new variable-length key, 64-bit block cipher (Blowfish) (in proceedings of the first FSE conference, held Dec. 1993) defines that Blofish's key is of 4 to 56 bytes (32 to 448-bit), with this rationale for the maximum: The 448 limit on the key size ensures that the every bit of every subkey depends on every bit of the ...

2

Your calculation is broken. First as pointed out correctly the expected run-time of GNFS (general number field sieve) is: $O(exp((\sqrt[3]{\frac{64}9}+o(1))*\sqrt[3]{ln(n)}*\sqrt[3]{ln(ln(n))}^2))$. So next you can't just set these $O$s equal, as $O(f(x))$ means $O(f(x))< k*f(x)$ which means this is an asymptotic upper bound meaning you need some ...

Top 50 recent answers are included