Reputation
2,050
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
Badges
5 13
Newest
 Informed
Impact
~16k people reached

  • 0 posts edited
  • 0 helpful flags
  • 24 votes cast
Jan
30
answered Theoretical security of bit rotation for encyption
Jan
23
awarded  Informed
Jan
23
comment Best attack on double DES followed by XOR with third key
@MeysamGhahramani - well, you don't say why you think that, so I can't correct you (or be convinced by you).
Jan
23
comment Best attack on double DES followed by XOR with third key
@MeysamGhahramani - yes, by which I mean the value for $A$ is arbitrary (i.e. can be any 64-bit string), so long as it is fixed. I did not say "do step one for all possible 64-bit strings". Apologies if that wasn't clear.
Jan
23
comment Best attack on double DES followed by XOR with third key
@MeysamGhahramani - no, the time complexity of step one is about $2^{57}$, because there are $2^{56}$ possible values of $k2$, and for each such value the attacker runs $DES$ once and then $DES^{-1}$ once.
Jan
23
comment Best attack on double DES followed by XOR with third key
@MeysamGhahramani - a brute force attack with two plaintexts would use $2^{113}$ time, whereas my attack uses about $2^{58}$ time. Of course, the brute-force attack doesn't need chosen plaintexts and ciphertexts, and the memory requirements are basically nill, so in that sense the brute-force attack is greatly superior. But it is much slower.
Jan
23
comment Best attack on double DES followed by XOR with third key
@user1820553 - the attack I outlined does not use linear or differential cryptanalysis. The attack does have time and memory requirements that are about the same as the classic MitM attack on double-DES (to within small constant factors). But unfortunately it must use chosen plaintext and ciphertext requests, which again have nothing at all to do with linear or differential attacks on single-DES.
Jan
23
answered Best attack on double DES followed by XOR with third key
Jan
23
comment Best attack on double DES followed by XOR with third key
@MeysamGhahramani - you need the pair $m$ and $DES_{k1}(DES_{k2}(m))$ to carry out the usual MitM attack. You cannot get there with the four values $m$, $m'$, $E_k(m)$ and $E_k(m')$. Yes, it is true that $E_k(m) \oplus E_k(m') = DES_{k1}(DES_{k2}(m)) \oplus DES_{k1}(DES_{k2}(m'))$, but that does not get to the needed pair.
Jan
23
comment Best attack on double DES followed by XOR with third key
The usual meet-in-the-middle attack against double-DES isn't applicable if all the attacker knows is $m$, $m'$ and $DES_{k1}(DES_{k2}(m)) \oplus DES_{k1}(DES_{k2}(m'))$. You really need to have at least one known plaintext-ciphertext pair, like $m$ and $DES_{k1}(DES_{k2}(m))$.
Jan
23
comment Best attack on double DES followed by XOR with third key
@org - are you sure you have the parentheses right in the question? i.e. Are you sure it isn't: $E_k(m) = DES_{k1}(DES_{k2}(m) \oplus k3)$?
Jan
11
awarded  Enlightened
Jan
11
awarded  Nice Answer
Jan
4
comment Why does DES implement so much Cross Wiring?
@RichieFrame - perhaps you are thinking of the initial and final permutation in Serpent, which is designed to enable software implementations to use bit-slicing techniques that dramatically improve performance at very little cost to hardware implementations. While bit-slicing DES can be done, I am not aware of the initial and final permutations helping with that.
Oct
20
awarded  Popular Question
Sep
17
awarded  Yearling
Jul
25
comment How to prove that a function is not pseudorandom?
@pa5h1nh0 - If the XOR of the two inputs equals the XOR of the two outputs, then with high probability the function is $F_k(x)$ and not a random function. This shows that $F_k(x)$ is not pseudorandom (because it can be distinguished from random with non-negligible Advantage).
Jul
25
comment How to prove that a function is not pseudorandom?
In that example, for two inputs $x$ and $y$, where $|x| = |y|$, then $F_k(x) \oplus F_k(y) = x \oplus y$ with probability one, while that equality holds with small probability for a true random function. An Adversary basing its guess on the truth of that equality will have very high Advantage in distinguishing the Function from a random function. Therefore the Function is not pseudorandom.
Jul
14
comment Why have round constants in hashes?
@PaulUszak - If you don't need the hash function to be cryptographically secure then many design requirements can be dropped. That said, there are much faster (insecure) checksum functions than Keccak or Skein without the round constants. e.g. The simple Modular sum of all the words in a message produces a fingerprint (the sum) enormously faster than any hash function, and is often sufficient in 'benign' situations.
Jul
10
answered Why have round constants in hashes?