Though obviously not an alternative for proper cryptanalysis, I was wondering about statistical/black box analysis. Should I produce a new key exchange protocol. With the same shape as Diffie-Hellman:

Each side picks a random number $r_i$, calculates $f(r_i)$ sends it and receives $f(r_{1-i})$ then calculate a shared key $g(f(r_{1-i}),r_i)$ = $g(f(r_i),r_{1-i})$

Obviously for the key exchange to be secure $f$ needs to be one way, I'm aware of NIST tests for PRNGs I assume they could be used to evaluate a one way function. Though obviously showing $f$ is a one way function isn't sufficient, what more can be tested empirically? Are there any existing sets of tests you can run?

  • $\begingroup$ You can only check (but not prove) that the algorithm is correct by performing some black box tests. But you can never show that the algorithm is secure by testing. $\endgroup$
    – user27950
    Mar 11, 2018 at 18:49
  • $\begingroup$ Well yeah, that's the first sentence in my question. $\endgroup$
    – Meir Maor
    Mar 11, 2018 at 20:02
  • $\begingroup$ Your first sentence implies that testing makes sense. My statement says that testing makes no sense. $\endgroup$
    – user27950
    Mar 11, 2018 at 20:25
  • $\begingroup$ I assert it does make sense, testing is easy and necessary. It is common practice to apply statistical tests as a sniff test, like the NIST tests for RNGs. And problematic properties which appear in statistical tests are later discussed deeply, for example the Solliter cipher has a known bias in it. I argue black box testing though insufficient it is not only useful but even necessary. $\endgroup$
    – Meir Maor
    Mar 11, 2018 at 21:00


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.