Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

-1
votes
2answers
40 views

Practical perfect security in bitwise XOR vs integer addition/subtraction cipher

XOR already provides perfect security in theory but it's hard to apply it in practice due to strict requirements. I was thinking about whether simple addition/subtraction in integer format would not ...
0
votes
0answers
53 views

Hint for needed hardness assumption

Suppose we have a type-3 pairing $(q,\mathbb{G_1},\mathbb{G_2},\mathbb{G_T},g_1,g_2,e)$, that holds $SXDH$ assumption. Given $(g_1,g_1^a,g_1^b,g_1^c,g_1^m,g_1^{m'},g_1^{a\cdot m}, g_1^{b\cdot m'},...
1
vote
0answers
53 views

Cryptanalysis affine cipher and substitution cipher

1) Consider the chosen-plaintext attack on the simple substitution cipher. How many chosen plaintext characters to suffice to uniquely determine the key? My answer was: 26! 2) Consider the ...
1
vote
0answers
51 views

Perfect Secrecy prove

There was a question in my final exam, but I could not get a point. I really want to know the right answer. Question is: Suppose a cryptosystem has perfect secrecy. Prove that H(P|C) = H(P) ...
3
votes
0answers
134 views

Security analysis for a extended ElGamal Signature against selective unforgeability

Let $H$ is a cryptography hash function and $\Pi=(\mathsf{G}, \mathsf{S}, \mathsf{V})$ is a digital signature, as follows: $(h_1=g^x,h_2=g^y) \leftarrow \mathsf{G}(1^n)$, where $x,y$ uniformly ...
2
votes
1answer
38 views

Is it possible to perform a length-extension attack if only the last bit of the new message changes?

Given a Merkle-Damgård hash function H, let's say SHA256, that computes a MAC as follows: ...
0
votes
0answers
26 views

Can someone give an example of no-message attack>

I know that a no-message attack IS THAT if the adversary has access to a signing oracle and a public key, he can sign an arbitrary message. So can someone give an example of this kind of attack?
1
vote
1answer
47 views

New model to convert two bits of data to each other [closed]

In during of my study between Geometry and Cryptography I found a new model to convert any two data to each other in other word let we have two data $A$ and $B$ such that each other consist of $n$ ...
0
votes
1answer
76 views

Challenging Question for the Build a Secure MAC with Special Properties

We would like to ask you to give a construction for requested scheme which provides those properties or give a proof that is not achievable. [Note that unsuccessful attempts to build such a scheme ...
-3
votes
0answers
76 views

Is this “linear combination” of PRFs and Hashes a secure MAC?

Let $F\colon \{0,1\}^n \times \{0,1\}^n \to \mathbb Z_q^* $ is a PRF, and $H\colon \{0,1\}^{2n} \to \{0,1\}^n$ is a secure hash function. Is the following construction $\Pi=(\operatorname{Gen},\...
-1
votes
1answer
52 views

Is this construction a secure MAC?

Let $F:\{ 0,1 \}^n \times \{ 0,1 \}^ n \rightarrow Z^*_q $ is a PRF, and $H:\{ 0,1 \}^{2n} \rightarrow \{ 0,1\}^n$ is a secure hash function. Is the following construction $\Pi=(Gen,Mac,Vrfy)$ is a ...
-1
votes
0answers
38 views

Indistingushability of two tuples

Let $a,b,c, s, z, p, r_1, r_2 , r_3, z_1, z_2 , z_3, z_4, z_5, z_6 \leftarrow Z^*_q$. The two distributions as follows, if are computationally indistinguishable? $$\big[ (a \cdot (s + r_1), b \cdot (...
0
votes
0answers
40 views

Is this a valid algorithm for testing BIC compliance?

It's been very helpful in finding problems in the Feistel cipher I'm working on, which, hobbled to 2 rounds, passes the test in a little over 200,000 block encrypts, same as AES hobbled to 2 rounds. ...
2
votes
1answer
73 views

Will using large keys with Classic cryptographic algorithms beat quantum computers?

This is a purely theoretical question. Everyone is talking about quantum cryptography being the next big thing as quantum computers will be much faster than the computers we have today. So, from my ...
0
votes
0answers
31 views

in matsui paper, how to compute the lower limit of integration in the success rate formula?

i can reach to the formula but the next equation i cant get it from the previous
-3
votes
2answers
61 views

sha256 of a file [duplicate]

I scanned a file in this site : https://www.virustotal.com/#/file/70902a0e2e5608b5ce980f0a28d23b6943287b3955e2fddb12e6c805c7be906b/detection and got this : SHA-256 ...
2
votes
0answers
32 views

Adding the key in the first state of keyed sponge-based hash function

What are the advantages to add the key in the inner or outer part of first state in keyed sponge hash functions?
2
votes
1answer
52 views

Understanding the q-SDH Problem (on elliptic curves)

I have some troubles in understanding the q-SDH problem. The discrete logarithm problem states the following. Given a point P of order on an elliptic curve and a point Q on the same curve. It is hard ...
0
votes
1answer
89 views

How can I generate key scheduling for AES 256 bit key

I want to implement AES algorithm,instead of 128 bit key encryption I wanted to do it for 256.But I’m stuck at point creating scheduling for 256 key generation. Can anyone help in this.
2
votes
1answer
54 views

RSA padding and Least Significat Bit Oracle Attack

So my question is do padding schemes used in RSA protect it against Least Significant Bit Oracle attack? The attack I am talking about is described here: RSA least significant bit oracle attack As ...
3
votes
2answers
95 views

Questions about the double ratchet mechanism in Signal

I am trying to understand the threats the double ratchet system is trying to prevent against. The threats mentioned in the paper do not quite make sense to me. May be someone can explain where I am ...
0
votes
0answers
62 views

Having trouble with padding oracle attack (in AES-256-CBC)

I have problems in understanding padding oracle attack and testing it on a given ciphertext on a server. The ciphertext is encoded with AES-256-CBC and padding is used such that the encoded message ...
3
votes
1answer
150 views

Find a LFSR given 2n (or more) non-consecutive keystream bits

How can I calculate the polynomial and state of a LFSR given 2n (or more) non-consecutive keystream bits? It is known to be n bit. If they were consecutive, I could use the Berlekamp–Massey algorithm. ...
2
votes
1answer
76 views

Security of expanded key

Can somebody analyze this scheme and explain how (in?)secure it is? Assume that: The keys were initially securely exchanged All keys are truly random In this scheme: The key size is of length <...
1
vote
2answers
89 views

What is preventing chaotic cryptology from practical use? [closed]

What factor is preventing cryptography based on chaos theory from being of practical use? Is it because of the unpredictability of the system?
-1
votes
1answer
108 views

Compression function cryptanalysis

A compression function converts a fixed-sized input into a smaller fixed size output. Suppose that one has a large collection of input-output pairs for an unknown compression function. We can assume ...
4
votes
0answers
96 views

What is the difference between Elliptic curves and Hyper-elliptic curves in terms of security?

What is the difference between Elliptic curves and Hyperelliptic curves in terms of security? I am relatively new to cryptography and have heard a great deal more about Elliptic curves than ...
11
votes
3answers
3k views

How effective is quantum computing against elliptic curve cryptography?

I've been reading the Wikipedia page on Elliptic-Curve Cryptography and I came across the following. in August 2015, the NSA announced that it plans to replace Suite B with a new cipher suite due ...
1
vote
0answers
137 views

Leak information (new setting)

This question is similar to Leak Information?, but with new settings. Let $a,b,c,d,e,f$ be selected at random from $\mathbb Z^*_q$. Also, let $r_1,r_2,r_3,z_1,z_2,z_3,p_1,p_2,p_3$ be selected at ...
0
votes
0answers
82 views

How trapdoor key exposure affects security of trapdoor-based simulatable NIZKs?

I wonder if revealing a trapdoor key would help the verifier to distinguish real and fake proofs in NIZKs that are based on substituting the challenge with the result of a chameleon hash. I don't ...
0
votes
1answer
80 views

AES Cryptanalysis

I have a list of 128bit ciphertexts. I know that the plaintexts were encrypted with AES, 256bit key, ECB mode. Same key was used every time. So I know that if I see ciphertexts that are the same, the ...
1
vote
1answer
55 views

Retrieve AES Key

If I have a set of AES ciphertexts, and I know all possible plaintext values. I do not however know which plaintext corresponds to which ciphertext. I also know that the same KEY and IV was used to ...
1
vote
2answers
82 views

What are the properties of secure Elliptic Curves?

I have heard about the standard elliptic curves called NIST curves. What are the properties of such cryptographically secure elliptic curves? Are they standardized according to certain protocols? Also,...
4
votes
0answers
74 views

Encrypt using ECDH with two different EC public keys, minimizing payload size

Let's say Alice has the private EC keys $a$ and $b$, with a base point of prime order $G$. Alice computes the corresponding public keys $A = aG$ and $B = bG$, and sends them to Bob. Bob now wants to ...
2
votes
1answer
35 views

Is Paillier secure from known plaintext attack for single character message?

Assuming I have three messages m1,m2,m3 where m1=m2=m3=1 and I compute c1,c2 and c3. Does that mean that c1=c2=c3 in cipher-text from ? If not, how many times can I encrypt a message m=1 and still ...
7
votes
2answers
2k views

How many trials does it take to break HMAC-MD5?

I know that you can find collision in MD5 with 2^64 trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I ...
-2
votes
1answer
71 views

Is AES practically unbreakable? [duplicate]

Is AES practically unbreakable? Is brute force attack practical on AES?
3
votes
1answer
65 views

RSA Timing Attack and Prevention through blinding

I am kind of confused regarding timing attacks on RSA. I do understand that the attack exploits the fact that the modular exponentiation (square and multiply) has key dependent branching. That is, if ...
1
vote
0answers
41 views

Can I deduce the info such as the bitsize of an LFSR from multiple ciphertext messages?

If I encrypt the same message multiple times (>10000 times) with the same LFSR can I then somehow retrieve some information on the LFSR? I'm looking for information like bit size, polynomial used. The ...
2
votes
2answers
68 views

Number of bits specified in standards implementation?

Currently deployed RSA and discrete logarithm implementation uses $1024$ to $2048$ bits. Hypothetically speaking if a crypto team produces a faster algorithm that moves current factoring and discrete ...
0
votes
1answer
27 views

How to test the robustness of the cipher image against chosen and known plaintext attacks?

Is there any algorithm to test the robustness of the cipher image against chosen and known plaintext attacks?
4
votes
4answers
145 views

Mitigating Side Channel Attack (SCA)

The SCA power attack described in 2016 article called "Power Side Channels in Security ICs: Hardware Countermeasures", depends on the measurement of power consumption fluctuations during AES-128 ...
2
votes
0answers
45 views

OAEP Cryptanalysis with broken hash

Keeping OAEP Cryptanalysis in mind, about the inability to get to $M_1$ or $M_2$ given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$. Would it be possible to get to $M_1$ or $M_2$, given ...
1
vote
2answers
186 views

Rolling your own crypto

I know this is usually frowned upon, but supposing you were to roll your own encryption cipher (completely on your own or with a small group of friends, with no peer review possible), what could you ...
1
vote
1answer
48 views

Clarifications regarding ciphers and Nmap scan

I'm running the below Nmap command to test the strength of the cipher suites I have used in my host nmap -sV --script ssl-enum-ciphers -p 443 <host> The ...
0
votes
1answer
101 views

Brute-force attack on OAEP

Assume $M_1$ is $\operatorname{OAEP}$ padded and encrypted and the ciphertext is 1024 bytes as an example. If an adversary somehow gets around the encryption and manages to get half of the bits of $\...
2
votes
1answer
163 views

Breaking Truncated Linear Congruential Generator with known parameters

There is an elaborate discussion on the breaking of TLCG on the link below, where they show how to break the generator with known parameters given the most significant bits. Problem with LLL reduction ...
1
vote
0answers
53 views

What is the attack complexity if two stream ciphers are connected in cascade?

What is the attack complexity when Grain-128 and Trivium are cascaded? Is it 2^(256 + 128) since internal state of Grain is 256 bits and assuming that IV is unknown before encryption?
2
votes
1answer
114 views

OAEP Cryptanalysis

If $M_1$ and $M_2$ are $\operatorname{OAEP}$ padded, encrypted and sent and an adversary somehow manages to get around the encryption and retrieve $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(...
0
votes
1answer
65 views

Calculating the number of rounds required for block cipher with known differential

Suppose we have a 128-bit block cipher for which the best two-round differential holds with probability $p = 2^7$. Suppose as well that this differential is iterative and that the best differential ...