Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

0
votes
1answer
23 views

How much more secure is $c = mg_1^r + g_2(g_1(g_1^r-1)/(g_1-1)) \mod p$ compared to just $c = mg_1^r \mod p$ (dis. log), all known but $r$?

To encode a message $m$ to a cipher $c$ you can use the only hard solvable problem of computing the discrete logarithm with a generator $g$ in base over a prime $p$. $c = mg_1^r$ mod p If an ...
-1
votes
0answers
40 views

Leaked key in cipher text, how to decrypt the rest of it?

This is a task I want to solve, but I don't understand how I can solve it. A password is XOR'ed, but some of the key is in the cipher text/hex. Hex is given after the password was encrypted. Hint: ...
0
votes
0answers
26 views

Difference between Sibling Intractable Function Family and Secret Sharing? [on hold]

What is the difference between any Secret Sharing Scheme Link and Sibling Intractable Function Family (SIFF) Link?
1
vote
2answers
63 views

Searching for a differential characteristic (differential cryptanalysis)

Currently I am doing some research on differential cryptanalysis. In general I got a good idea about the attack and how it is done. I am currently talking about ciphers with multiple rounds. It ...
-1
votes
0answers
31 views
2
votes
2answers
56 views

Extract one unique SBox from Canonical Representative

In paper https://eprint.iacr.org/2011/218.pdf, the author has examined 16! different 4 bit SBoxes and at the end of investigation, introduced an optimal class which named "Golden SBoxes". How can I ...
0
votes
1answer
49 views

Example of product cipher more secure than its components

Can anyone give me an example of a product cipher which more secure than its components. Here is how the explanation should proceed. There is cipher C1 which can be attacked with the technique A1, ...
2
votes
1answer
75 views

What is the approximate effort to break one additional round of a primitive?

Many of the cryptographic primitives currently in use have a number of their rounds already broken. Generally and with no particular primitive in mind, what is the scale of the effort to break one ...
5
votes
2answers
96 views

Origin of values for “security margin”?

It seems that the acceptable "security margin" for ciphers is set to be between 25% and 30% as a target by designers, where this number represents the number of rounds that remain "unbroken" for a ...
1
vote
1answer
89 views

Methods of Learning Cryptography [closed]

We're currently approaching the end of our semester, but I've found that our homework is starting to consist more of encrypting and decrypting using different types of algorithms instead of learning ...
0
votes
0answers
41 views

Choosing K in ECDSA SECP256K1

I am working on a very resource-constrained environment. Using a standard peer reviewed library isn't possible because it won't fit within the RAM requirements of the device (~5K unused ram without ...
2
votes
1answer
73 views

Fault attacks inside a loop

I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below, ...
-1
votes
0answers
36 views

Unix salt for passwords - length doesn't matter in offline dictionary attack?

Lets say an attacker has gained permanent access to the password file and mounts an offline dictionary attack. The passwords are stored as hash values in the file together with a salt values, ...
0
votes
0answers
22 views

XOR operation to uncover plain-text out of given cipher-texts [duplicate]

I have a set of 11 hex coded strings that have been encrypted using XOR operation each with the same stream cipher key. How do I decrypt the 11th hex-coded string to arrive at the plain-text without ...
3
votes
1answer
63 views

Differential cryptanalysis tutorial of Howard M. Heys

I am currently working on some research about differential cryptanalysis. There is a lot of literature about that topic in the internet. One of the most known paper is the tutorial on linear and ...
-1
votes
1answer
52 views

Hashing algorithm with fixed range rather than fixed size output [closed]

I have read that output that varies by key size or file size can leak information. So if it should produce fixed size then what is the scenario if it produces fixed range? By fixed range I mean that ...
1
vote
1answer
71 views

Security of a block cipher if double encryption $E_{K_2} \circ E_{K_1}$ is always single encryption $E_{f(K_1,K_2)}$

If there always existed a $k_3$ such that $\operatorname{DES}(k_2, \operatorname{DES}(k_1, M)) = \operatorname{DES}(k_3, M)$, how would that affect the security of $\operatorname{DES}$?
0
votes
0answers
32 views

Method for Cryptanalysis of a keyword-keyletter cipher?

I am a CS student who is in an introductory Cryptography course. I am not looking for the complete plaintext of this message, as I am not looking to cheat. I am simply stuck, and have no idea what to ...
2
votes
1answer
67 views

Attacking AES using Round 1 output

I was reading the paper Differential Scan Attack on AES with X-tolerant and X-masked Test Response Compactor and I have a question in the section Differential Scan Attack on AES. What I understand is ...
6
votes
1answer
87 views

Differential and Linear trail propagation in Noekeon

In the Noekeon Cipher Specification they write the following : The propagation through Lambda is denoted by $(a \rightarrow A)$, also called a step. Because of the linearity of Lambda it is fully ...
0
votes
0answers
16 views

Cryptanalysis of an OTP RFID tag transmission using multiple transmissions [duplicate]

A scanner encrypts a 32 bit message 'x' using a secret 32 bit key 's1' and sends the resulting cipher y= x XOR s1 to an RFID tag. The Tag decrypts the message 'x' ,and then encrypts the message 'x' ...
0
votes
1answer
60 views

The role of IV when AES is used as $PRF$

We want to use AES as a pseudorandom function. Given a random master key, we want to derive a set of pseudorandom values/keys, e.g say $n$ keys. Then from each of those derived keys, we want to derive ...
-2
votes
1answer
39 views

What information can be gleamed by using a OTP twice with the same message?

So... C0 = K0 ⊕ M and C1 = K1 ⊕ M where K0, K1 are different random numbers. What information can you discern about the K0, K1 and M, if any? Could you use K0,K1 again with another different message ...
2
votes
1answer
80 views

Is a 2 bit one time pad just as secure as a 128 bit one time pad?

Obviously, it would be easier to stumble across the answer, but you still couldn't be sure it's correct. So it's still theoretically secure?
0
votes
1answer
75 views

How 'safe' is a 12-digit alphanumeric key?

To Access my data over a Portal i got a 12-digit alphanumeric key like: VGW8-U98T-TXLV How safe is this key? I don't want to know the chance to win with brute force. I want to know there are several ...
0
votes
0answers
37 views

Errors in LLL cracking knapsack crypto

I am attempting to try some sample knapsack encryption problems and the attack on them using the LLL algorithm. I am using here and here as the guides. They both provide examples to walk through, ...
0
votes
0answers
18 views

Analyzing RC4 with a reduced state array [duplicate]

RC4 is a stream cipher which uses a 256-element array of 8-bit values. All operations are done modulo 256. Is there any research on modified versions of RC4 using a smaller state array? How small can ...
2
votes
3answers
282 views

What are some real world examples where one time pad encryption is used or can be used?

I understood that One-Time Pad (OTP) encryption ensures perfect secrecy. However, I couldn't find any real-world examples where the OTP is used. Also, which are some real-world examples where it won'...
3
votes
1answer
70 views

Definition of symmetric cipher and definition of asymmetric cipher

So I'm currently taking a cryptography class right now and my professor has told the class that she can't even define symmetric cipher for us without getting into asymmetric ciphers and the textbook ...
1
vote
1answer
90 views

Cryptoanalysis using Frequency Analysis

I have read some documents to decrypt ciphertext without a key using Frequency analysis. here are my questions: If the most occurring Char is not 'E' then how do we start? Let's say I have this ...
12
votes
1answer
2k views

Can neural cryptanalysis be applied to AES?

In this Wikipedia article about Neural cryptography (section applications) it states: In 1995, Sebastien Dourlens applied neural networks to cryptanalyze DES by allowing the networks to learn how ...
1
vote
1answer
145 views

Factoring RSA weak modulus

Given a public key for RSA, I have extracted the modulus which looks like this : ...
4
votes
1answer
117 views

$\boxplus$- key addition vs $\oplus$- key addition

GOST cipher , Hight cipher and SEA cipher use key addition based on modular arithmetic addition (module key size $\boxplus$) compared to many ciphers which use arithmetic addition modulo 2 ( $\oplus$)....
0
votes
1answer
69 views

A key-generator outputs an encrypted string that only changes the second half - what weaknesses could that expose?

The company I work for provides a software solution. The software is licensed and I have access to the license generator. We have a company culture of challenging our perceived security but I am a ...
2
votes
0answers
106 views

How can I determine the Hill cipher key in this case?

I have been struggling with a Hill cipher problem for many days, without any luck. I have the following ciphertext, which I know is an encrypted excerpt from an Edgar Allan Poe story: ...
1
vote
1answer
63 views

$m^b = z^b \pmod{n}$ - single solution $m = z$?

If i have the following equation: $$m^b = z^b \pmod{n}$$ Where all numbers are taken from the multiplicative group $\mathbb{Z}_n^*$. Suppose I know the values $z$ and $b$. Can I state that $z = m$, ...
1
vote
0answers
95 views

Finding generator element for multiplicative group of order $n$ - feasible?

Given a multiplicative group of order $n$, how hard is it to find a generator element (such that all other elements can be expressed as powers of that generator)? What would be the complexity?
1
vote
1answer
69 views

One-time pad encryption - how does the receiving side decrypt the message?

If a message is sent using one-time pad scheme, which generates random bits in order to, for example, XOR them with the message's bits - how does the receiving side generate the exact series of bits ? ...
0
votes
1answer
44 views

Using the same RSA key for verifying a website and digital signature

We have the (same) RSA key for verifying a website and for digital signature. A user would send a nonce encrypted using the public key, the websites returns the nonce by decrypting it using the ...
0
votes
1answer
50 views

How to change the following commitment scheme to Pedersen commitment?

In my question here Zero knowledge set membership protocol The suggested solution allows a prover to choose a commitment $C$. Then, A trusted third party ($T$) can validate if $C$ is valid or not. ...
0
votes
0answers
40 views

Problem while decrypting Hill cipher

I have a plaintext "monday" and ciphertext "IKTIWM" and $m=2$. I want to find the key of the Hill cipher. I made a matrix $$ \begin{bmatrix} a_1 & a_2 \\ a_3 & a_4 \end{bmatrix}\begin{...
1
vote
1answer
96 views

Zero knowledge set membership protocol

I read that paper Efficient Protocols for Set Membership and Range Proofs of Camenisch et. al that describes the zero knowledge range proof. The paper applications looks interesting like if you want ...
0
votes
0answers
50 views

Could any one suggest alternative Zero knowledge proof protocol to Schnorr protocol ZKP?

I read that Schnorr protocol cannot be proved zero knowledge on that link: Perfect zero knowledge for the Schnorr protocol? Could any one suggest alternative Zero knowledge proof protocol so a prover ...
2
votes
1answer
120 views

Unbreakable Hill cipher

Why don't we use hill cipher of 100 × 100? or even bigger. That would be closely unbreakable. The number of keys possible 2 × 2 hill cipher is 157248. for 100 × 100 number is beyond limits.
2
votes
1answer
116 views

Zero Knowledge range proof

I like the idea of a Zero Knowledge range proof. But I read that, to prove my age in a range, a commitment is required by a trusted party (TP) stating my age. How does that work? is the commitment a ...
7
votes
1answer
99 views

How complex must round constants be to resist slide attacks?

A key schedule that generates round keys by XORing a round constant with the key is linear and can be vulnerable to related key attacks, but let's ignore that for now. Constants are necessary to avoid ...
1
vote
1answer
68 views

flaw in perfect secrecy of shift cipher?

Why do we say shift cipher is perfectly secure when it is easy to break it (source)? Let's say I have a plaintext. "Australia is a big country"; I encrypt it using a shift of 2; That ciphertext can be ...
2
votes
0answers
58 views

Hamming Weight of Solutions to the Frobenius Equation

My area of research is algorithms for calculating optimal addition chains. I have a new high performance algorithm that at its core benefits from estimating the number of set bits ($v(n)$ Hamming ...
2
votes
0answers
61 views

Why commutativity gives an invariant subspace?

In A Generic Approach to Invariant Subspace Attacks the authors defined an invariant subspace as: $$F(u + A) = v + A$$ Where $F:\mathbb{F}_2^n \to \mathbb{F}_2^n$,$u, v \in \mathbb{F}_2^n$, and $A$ ...
0
votes
0answers
28 views

Given Seed, keyfragment and cipher text, how to get actual text using LFSR? [duplicate]

$\text{seed = 1100010001101001}$ $\text{key fragment = 110001010000101011001011111101100}$ $\text{cipher text = 0xa50b839547f7fe7cf882}$ What is the actual text and how to evaluate it? I would ...