Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

1
vote
1answer
52 views

Can the original data be extracted from an RSA private key signed message

I'm working on a system that the main objective is to verify the message was written by the right person, but it would also be desirable if the message can't be understood by anyone sniffing it. It ...
-1
votes
0answers
25 views

Hill Cipher cryptanalysis unknown key size [closed]

I have the plaintext CONVERSATION which is encoded as SQZHUSSUDYKP, standart alphabet is used(A=0,B=1,...). I have no information about the key and I must find it.
0
votes
1answer
29 views

Why do we approximate R-1 rounds during linear or differential cryptanalysis?

I am currently looking into differential and linear cryptanalysis. I am however unsure why do we only approximate only R-1 out of R rounds - is it because we already know the output or why ? I have ...
3
votes
1answer
25 views

Estimating difficulty of “Memory-Hard Proof-of-Work” based on “size of memory”?

In Bitcoin proof-of-work, the difficulty of Proof-of-Work is estimated and calculated based on total hashing power of the participants. If total hashing power of the participants is higher, then PoW ...
1
vote
0answers
77 views

Security of an Elliptic Curve Public Key with a “Small” x-coordinate

Consider an elliptic curve over a finite field $F_p$ with $p$ prime and order $n$. Let $Q$ be a generator for the field. Given a public key point $P = aQ$, suppose we have an algorithm that finds an ...
8
votes
1answer
3k views

How long does it take to crack RSA 1024 with a PC?

Using an Intel Core i5 CPU, how long does it take to crack RSA using a key size of 1024 bit (generated using a secure key pair generation function)? Suppose for instance that we have thousands of ...
1
vote
0answers
42 views

Implementation of differential cryptanalysis

This question is a little bit more implementation based of differential cryptanalysis. I hope it is okay. I am working with the book "The Block Cipher Companion" on the topic differential ...
2
votes
1answer
70 views

Differential cryptanalysis in “The Block Cipher Companion”

I am practically implementing a differential cryptanalysis on a cipher which can be found in the book "The Block Cipher Companion". Following image shows the cipher: In Fig. 6.10 (page 126) there are ...
26
votes
2answers
5k views

What are the implications of the new alleged key recovery attack preprint on SIMON?

Just recently, a new attack was published against SIMON-32/64 which claims to also be applicable to other versions of the cipher. The paper is titled A Note on SIMON-32/64 Security (archived 2019-05-...
1
vote
0answers
31 views

Why Diffusion and Confusion prevent statistical analysis? [duplicate]

I've studied the concepts of Diffusion and Confusion of cryptographic algorithms, however, I don't understand why they help in preventing a statistical analysis. Are you able to explain to me?
2
votes
1answer
46 views

How to determine if $\{n \cdot g^a \mod P\}$ and $\{m \cdot g^a \mod P\}$ generate the same sets? (set size < $P-1$)

given some examples $k_{n_i},k_{m_i}$ out of each value set: $k_{n_i} \in \{n \cdot g^a \mod P\, \forall a \in \mathbb{N}<P\}=G_m$ $k_{m_i} \in \{m \cdot g^a \mod P, \forall a \in \mathbb{N}<P\}...
-1
votes
1answer
70 views

Is there a fast way to solve $k = n \cdot g^a \mod P$? (get $a$ for unknown $n$)

Would a factor besides the normal discrete logarithm problem increase or decrease the solving time? $k = n \cdot g^a \mod P$ with given $k,g,P$ and the knowledge $P= 2 \cdot N \cdot f+1$, while $...
3
votes
0answers
48 views

Probability equation of rotational cryptanalysis on modulo multiplication

The answer in this question defined how to calculate the probability of rotational cryptanalysis on modulo multiplication $\odot$. This paper defined an algebraic equation of how to calculate the ...
2
votes
0answers
55 views

Recover all keys on differential cryptanalysis

I am practically implementing differential cryptanalysis on a cipher from the book "the block cipher companion" . I am successful to get the last key $k_5$. Just to say some words about the ...
7
votes
1answer
196 views

How safe is a prime with $P=2 \cdot Q \cdot R \cdot S \cdot t+1$ for discrete logarithm? How to enhance/compare?

To get some certain properties for my use case I need a prime $P$ which has the form: $P=2\cdot Q \cdot R \cdot S \cdot t+1$ with $Q,R,S,t$ primes as well. Why that form - Use case Together with ...
1
vote
1answer
86 views

Mutual Index of Coincidence

I can't seem to find a simple explanation of Mutual Index of Coincidence. I am finding explanations of Mutual Index of Coincidence not Index of Coincidence. I don't understand what the formula below ...
0
votes
0answers
51 views

Collision resistance of a function which chooses the hash from a large table of hashes

Let's say you know a (possibly) large table of ids and some corresponsing hashes $h_{ID_j} = H(ID_j | secret_j)$. The resulting table looks like $$ ID_1 | h_{ID_1} $$ $$ ID_2 | h_{ID_2} $$ $$ ... $$ $...
1
vote
1answer
48 views

Calculate number of required pairs for differential cryptanalysis

I am currently doing some study on differential cryptanalysis. However, I have two open questions in the field. The first question is: How can I calculate the number of messages necessary for a ...
1
vote
1answer
50 views

Does a different exponent and base but same key help to resolve discrete logarithm?

E.g.: $k = N^a \mod P$ The attacker knows the prime $P$ and $N$, which is also a prime and (1.) prime root of $P$ or (2.) has a cycle size of $s$, so $1 = N^s \mod P$, (and for $\forall s'<s$, $...
1
vote
1answer
163 views

How should the key schedule be designed for this general block cipher?

After looking at the Wikipedia page for the Fiestel cipher, I thought about making a variation of it that is very general. I basically followed the diagram on Wikipedia in order to structure the ...
0
votes
0answers
45 views

Unique numbers with $P^aQ^bR^c \mod N$ for each combination of $a,b,c$ possible? Would it be safer than separate form (like $T^a \mod P$ for each)?

Main question: Is the computation of $a,b,c$ in $P^aQ^bR^c \mod N$ (much) harder than in $T_p^a \mod P$, $T_q^b \mod Q$, $T_r^c \mod R$ ? (assuming the first form exists) $P^aQ^bR^c \mod N$ With $P^...
0
votes
1answer
41 views

How much more secure is $c = mg_1^r + g_2(g_1(g_1^r-1)/(g_1-1)) \mod p$ compared to just $c = mg_1^r \mod p$ (dis. log), all known but $r$?

To encode a message $m$ to a cipher $c$ you can use the only hard solvable problem of computing the discrete logarithm with a generator $g$ in base over a prime $p$. $c = mg_1^r$ mod p If an ...
1
vote
2answers
95 views

Searching for a differential characteristic (differential cryptanalysis)

Currently I am doing some research on differential cryptanalysis. In general I got a good idea about the attack and how it is done. I am currently talking about ciphers with multiple rounds. It ...
2
votes
2answers
62 views

Extract one unique SBox from Canonical Representative

In paper https://eprint.iacr.org/2011/218.pdf, the author has examined 16! different 4 bit SBoxes and at the end of investigation, introduced an optimal class which named "Golden SBoxes". How can I ...
0
votes
1answer
52 views

Example of product cipher more secure than its components

Can anyone give me an example of a product cipher which more secure than its components. Here is how the explanation should proceed. There is cipher C1 which can be attacked with the technique A1, ...
1
vote
1answer
107 views

What is the approximate effort to break one additional round of a primitive?

Many of the cryptographic primitives currently in use have a number of their rounds already broken. Generally and with no particular primitive in mind, what is the scale of the effort to break one ...
5
votes
2answers
106 views

Origin of values for “security margin”?

It seems that the acceptable "security margin" for ciphers is set to be between 25% and 30% as a target by designers, where this number represents the number of rounds that remain "unbroken" for a ...
1
vote
1answer
95 views

Methods of Learning Cryptography [closed]

We're currently approaching the end of our semester, but I've found that our homework is starting to consist more of encrypting and decrypting using different types of algorithms instead of learning ...
0
votes
0answers
53 views

Choosing K in ECDSA SECP256K1

I am working on a very resource-constrained environment. Using a standard peer reviewed library isn't possible because it won't fit within the RAM requirements of the device (~5K unused ram without ...
2
votes
1answer
74 views

Fault attacks inside a loop

I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below, ...
0
votes
0answers
24 views

XOR operation to uncover plain-text out of given cipher-texts [duplicate]

I have a set of 11 hex coded strings that have been encrypted using XOR operation each with the same stream cipher key. How do I decrypt the 11th hex-coded string to arrive at the plain-text without ...
3
votes
1answer
75 views

Differential cryptanalysis tutorial of Howard M. Heys

I am currently working on some research about differential cryptanalysis. There is a lot of literature about that topic in the internet. One of the most known paper is the tutorial on linear and ...
-1
votes
1answer
61 views

Hashing algorithm with fixed range rather than fixed size output [closed]

I have read that output that varies by key size or file size can leak information. So if it should produce fixed size then what is the scenario if it produces fixed range? By fixed range I mean that ...
1
vote
1answer
75 views

Security of a block cipher if double encryption $E_{K_2} \circ E_{K_1}$ is always single encryption $E_{f(K_1,K_2)}$

If there always existed a $k_3$ such that $\operatorname{DES}(k_2, \operatorname{DES}(k_1, M)) = \operatorname{DES}(k_3, M)$, how would that affect the security of $\operatorname{DES}$?
0
votes
0answers
37 views

Method for Cryptanalysis of a keyword-keyletter cipher?

I am a CS student who is in an introductory Cryptography course. I am not looking for the complete plaintext of this message, as I am not looking to cheat. I am simply stuck, and have no idea what to ...
2
votes
1answer
71 views

Attacking AES using Round 1 output

I was reading the paper Differential Scan Attack on AES with X-tolerant and X-masked Test Response Compactor and I have a question in the section Differential Scan Attack on AES. What I understand is ...
6
votes
1answer
99 views

Differential and Linear trail propagation in Noekeon

In the Noekeon Cipher Specification they write the following : The propagation through Lambda is denoted by $(a \rightarrow A)$, also called a step. Because of the linearity of Lambda it is fully ...
0
votes
0answers
16 views

Cryptanalysis of an OTP RFID tag transmission using multiple transmissions [duplicate]

A scanner encrypts a 32 bit message 'x' using a secret 32 bit key 's1' and sends the resulting cipher y= x XOR s1 to an RFID tag. The Tag decrypts the message 'x' ,and then encrypts the message 'x' ...
0
votes
1answer
79 views

The role of IV when AES is used as $PRF$

We want to use AES as a pseudorandom function. Given a random master key, we want to derive a set of pseudorandom values/keys, e.g say $n$ keys. Then from each of those derived keys, we want to derive ...
-2
votes
1answer
40 views

What information can be gleamed by using a OTP twice with the same message?

So... C0 = K0 ⊕ M and C1 = K1 ⊕ M where K0, K1 are different random numbers. What information can you discern about the K0, K1 and M, if any? Could you use K0,K1 again with another different message ...
2
votes
1answer
83 views

Is a 2 bit one time pad just as secure as a 128 bit one time pad?

Obviously, it would be easier to stumble across the answer, but you still couldn't be sure it's correct. So it's still theoretically secure?
0
votes
1answer
77 views

How 'safe' is a 12-digit alphanumeric key?

To Access my data over a Portal i got a 12-digit alphanumeric key like: VGW8-U98T-TXLV How safe is this key? I don't want to know the chance to win with brute force. I want to know there are several ...
0
votes
0answers
44 views

Errors in LLL cracking knapsack crypto

I am attempting to try some sample knapsack encryption problems and the attack on them using the LLL algorithm. I am using here and here as the guides. They both provide examples to walk through, ...
0
votes
0answers
18 views

Analyzing RC4 with a reduced state array [duplicate]

RC4 is a stream cipher which uses a 256-element array of 8-bit values. All operations are done modulo 256. Is there any research on modified versions of RC4 using a smaller state array? How small can ...
3
votes
3answers
351 views

What are some real world examples where one time pad encryption is used or can be used?

I understood that One-Time Pad (OTP) encryption ensures perfect secrecy. However, I couldn't find any real-world examples where the OTP is used. Also, which are some real-world examples where it won'...
3
votes
1answer
75 views

Definition of symmetric cipher and definition of asymmetric cipher

So I'm currently taking a cryptography class right now and my professor has told the class that she can't even define symmetric cipher for us without getting into asymmetric ciphers and the textbook ...
1
vote
1answer
115 views

Cryptoanalysis using Frequency Analysis

I have read some documents to decrypt ciphertext without a key using Frequency analysis. here are my questions: If the most occurring Char is not 'E' then how do we start? Let's say I have this ...
12
votes
1answer
2k views

Can neural cryptanalysis be applied to AES?

In this Wikipedia article about Neural cryptography (section applications) it states: In 1995, Sebastien Dourlens applied neural networks to cryptanalyze DES by allowing the networks to learn how ...
1
vote
1answer
162 views

Factoring RSA weak modulus

Given a public key for RSA, I have extracted the modulus which looks like this : ...
4
votes
1answer
123 views

$\boxplus$- key addition vs $\oplus$- key addition

GOST cipher , Hight cipher and SEA cipher use key addition based on modular arithmetic addition (module key size $\boxplus$) compared to many ciphers which use arithmetic addition modulo 2 ( $\oplus$)....