# Tag Info

2

The definitions are not all universal and there is quite some overlap. The clearest definition is for PRG, which is the (synchronous) stream cipher model. A PRG maps a secret value to a long, random-looking keystream, so that an attacker cannot predict any part of the keystream from knowing other parts of it. For a precise definition, you can see the ...

1

The question as stated has some serious issues: The alternating step generator works with 3 LFSRs. If the output of R1 is 1, then R3 is clocked, otherwise R2 is clocked, so at each clock period exactly one of those two is clocked. The output of R2 and R3 is added modulo 2 to form the keystream. The initial loadings of the 3 LFSRs is essentially the key. ...

5

I have argued so 15 years ago, and not been proven wrong since. Basically, A5/1, with a $n$-bit state, offers a resistance of roughly $2n/3$ bits of security. With $n = 64$, the resistance is very low, thus amenable to not only direct breaking, but also all kinds of trade-offs. All the attacks published so far are dances around that resistance level of ...

2

It would be good to define what you require for the cipher to be secure before trying to determine it's security properties. Take the example of CPA security - Katz and Lindell (Introduction to Modern Cryptography 2nd ed.) state that a symmetric scheme has indistinguishable multiple encryptions under chosen plaintext attack (i.e. the scheme is CPA secure for ...

1

This is secure assuming that the hash function is a PRF. It is also secure for common Merkle-Dämguard hash functions like SHA-256. Furthermore, it is secure if one uses a $n × n \rightarrow n$ compression function $F$ as $C = P \mathop{xor} F(\mathop{Key}, \mathop{Nonce}||\mathop{Counter})$, provided that $F$ is a PRF and $n$ is large enough to prevent ...

3

This is not a concern; the model of costs that the paper uses is unrealistic. In the paper, they state: In other words, the attacker is given unlimited amount of time in preparation (Section 2, second paragraph) That is, they assume that the attacker can easily spend $O(2^{128})$ time (or more, if necessary) to generate a Hellman table (or Rainbow ...

1

Yes the multiplexing generator due to Jennings, and more advanced versions have been broken. I am assuming regular synchronous clocking of all 3 LFSRs in this answer. The attacks mentioned are either correlation attacks or linear consistency attacks or a combination of the two. A reference which also cites earlier work is Optimal correlation attack on the ...

4

Unfortunately, there is no specification for XChaCha20. But several implementations provide a HChaCha20 function, built the same way as HSalsa20. XChaCha20 can be built with HChaCha20 + ChaCha20, and the security proof is similar to the one for XSalsa20. The Libsodium documentation has a section on HChaCha20, which includes a code snippet to build ...

1

The "XOR cipher" described does not encrypt more than the first block, even if you do not reuse keys. The subsequent blocks can be "decrypted" by the attacker simply by undoing the XOR – there is no secret involved. Decrypting the first block and finding the key does require more than one message. It is a case of the many-time pad and can be solved either ...

2

Sure. one-way permutation ​ + ​ strong hard-core functions $\to$ pseudorandom generator $\to$ stream cipher The keystream is concatenation of the strong hard-core function's values at the iterates of the one-way permutation on the key. ​ ( k,f(k),f(f(k)),f(f(f(k))),... )

Top 50 recent answers are included