Tag Info

8

First of all, we need to review what they mean by "parity of a permutation"; they don't mean whether the input block had a even number of 1's. Instead, they view the $n$ bit cipher (with a specific key) as a permutation on $2^n$ objects; that is, it can be review as a way of rearranging that set of $2^n$ objects onto itself. Now, permutations on a finite ...

6

There is no uniform permutation; there is a permutation uniformly chosen from the set of all possible permutations over $Z_2^{128}$. It is evident that AES is not a uniformly chosen permutation, since its permutation is fixed for any key. One can consider a family $\{AES_K\}$ of AES permutations under all possible keys $K$. Even if the key is chosen ...

5

If I understand correctly, you want a function that for each input string $p$ assigns a permutation over an alphabet $L$. If the number of elements in $L$ is small enough, the permutation set $P(L)$ will be enumerable. More precisely, $|P(L)| = |L|!$. There exists a surjective function $f:\{0,1\}^k \to P(L)$ that for each bit string $s$ of length $k$ ...

4

The permutations in your question are given in Cauchy's two-line notation, where the upper line gives the input index to the permutation function, and the lower line gives the resulting permuted index. For example, the definition $$\sigma = {1\ 2\ 3 \choose 3\ 1\ 2}$$ means the same as $$\sigma(1) = 3,\quad \sigma(2) = 1,\quad \sigma(3) = 2.$$ Thus, if we ...

4

I thought you were using a block cipher, i.e. a pseudorandom permutation. Instead as per your comment you are only permuting the order of the plaintext bits. This is not secure. For example, you can imagine the bit permutation is an n-by-n square matrix, where each row and column has a single 1 and the rest 0s. The input and output are then vectors of size ...

4

"$BW_N$ is a permutation over the squares $\mod N$". Does someone know what that means? You define your map $BW_N:\mathbb{QR}_N\rightarrow \mathbb{QR}_N$. Note that $$\mathbb{QR}_N:=\{r\in Z_N: r\equiv y^2 \pmod{N}, y\in Z_N\}$$ and a permutation is a one-to-one mapping (bijection) from a set into the same set. Basically, this map is a permutation if ...

4

This is purely a counting problem. We want the number $N(n,m)$ of possible permutations of $n$ things, with the constraint that only $m$ among these things can map to themselves ($0\le m\le n$). The values in the question are $n=11$, $m=5$. It holds that $N(n,n)=n!$ (that's the number of permutations of $n$ elements). It holds that ...

3

How secure is this cipher? At first glance, not very. It would appear to be vulnerable to a ciphertext-only attack, for example, the attacker can recover the plaintext given a ciphertext of about 10k (actually, he probably can deal with less), even assuming that all the attacker initially knows is that the plaintext is "ASCII English", and he has no ...

3

At some level, there is no essential difference. Certainly, there is no difference in the distribution on the random variable $O$ vs $f$. However, there is a potential difference in how the terms are typically used. If we say that $O$ is a random (bijective) oracle, then we are usually implicitly hinting that it is available to everyone: the legitimate ...

2

It means that it maps quadratic residues $\mathbb{QR}_{N} \mapsto \mathbb{QR}_{N}$ to quadratic residues. A quadratic residue is a number $x$ such that $x = y^2 \pmod N$ where $N=pq$. A trapdoor means that once you know the factorization of $N$ it is easy to break quadratic residuocity problem. $p=q=3 \pmod 4$ because you choose 'safe' primes $p,q$ such that ...

2

Each one of your first two sentences has a mistaken premise: you're starting from some assumptions that aren't actually true. DES does not use small PRPs for saving memory. It doesn't use small PRPs at all. The DES S-boxes are not PRPs. The DES F-function is not a PRP. A SPN does not use several small PRPs for saving memory. A SPN doesn't use PRPs at ...

2

You could 1. generate a key from the password, 2. seed a deterministic random number generator from the key, 3. use the random number to generate a permutation, using, e.g., Knuth's algorithm.

2

My own answer would be: 2048, 2048, and still 2048 bits. Why ? Because: 2048-bit is the current "standard recommendation"; it has been so for quite some time, and is likely to remain so for quite some time (decades). See this site for pointers. There are plans for removing support for keys shorter than 2048 bits in some widespread software, e.g. Firefox. ...

2

Yes, it is possible to implement the primitive asked, with a 32-bit block cipher that is secure (indistinguishable from a random permutation) no matter how many input-output pairs are known, keyed with a fixed secret randomly-chosen key. That's a standard building block in Format Preserving Encryption. One such block cipher is: Louis Granboulan and Thomas ...

1

AES transformation can be viewed as a sequence of invertible transformations each processing only a small part of the state. All these transformations would be even, and so is the entire AES for any key (see also this question).

1

In general, the key length and number of rounds are the dominant factors in deciding cipher strength. But you need to consider how the rounds are constructed and how the key is used. Substitution and permutation are the bread and butter of DES. That's literally all it is - substitution, permutation, and XOR. Here is a diagram of the DES fiestel function ...

1

Can you use threshold encryption and a mixnet? It might not be the fastest thing in the world but it uses well-understood components. Setup Every player generates an ElGamal keypair and proves knowledge of their secret key. The joint public key is the product of all public keys. (If you're worried about reset attacks, look up "Pedersen threshold key ...

1

There are two possible explanations. The literature you are reading swapped the positions of the plaintext and ciphertext in the second example. If you were to permute TEN, the result is ENT. There is a mistake in either the permutation value or in the resultant ciphertext. If the first example permutation was used, the ciphertext would be correct. ...

1

The first question is already answered here. For the second question, a single key $k \in \left\{0,1\right\}^{168}$ can be trivially converted back and forth from three keys $k_1, k_2, k_3 \in \left\{0,1\right\}^{56}$ – there is no semantic difference between the two. DES itself operates only on 56-bit keys, and triple-DES requires three independent DES ...

1

The closest to my choice is: C. (a) 2048; (b): 4096; (c): I would not use RSA My answer takes in account not only details mentioned in question, but currently widely deployed security practices. I try to point out useful resources to study. Things are not as simple as pick one of A-D. I recommend to study resources I've included and draw your own ...

1

Consider Shor's algorithm, which solves RSA in polynomial time on a quantum computer and the fact that there is publicly available software that could factor a 512 bit modulus on a modern PC in a few days' time.

1

This was covered on scicomp (http://scicomp.stackexchange.com/questions/4923/random-access-random-permutations), but I'll copy the answer here (not sure if that's appropriate but it definitely belongs in both places). You are looking for Black and Rogaway, Ciphers with Arbitrary Finite Domains, 2001. ...

1

You are looking for almost-prime-order cyclic groups $G$ of order $n$ that have an easily computed bijection $G \rightarrow \{0,1,2,\dots,n-1\}$, along with an estimate of how quickly discrete logarithms can be computed in $G$. There seems to be two choices, a subgroup of $\mathbb{F}_p^*$ with $(p-1)/2$ prime, and the elliptic curve $E: Y^2 = X^3+1$ over ...

1

There are $k!=k(k-1)\dots3\cdot 2\cdot 1$ possible permutations of $k$ elements. This is very basic combinatorics.

Only top voted, non community-wiki answers of a minimum length are eligible