Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

Filter by
Sorted by
Tagged with
4 votes
1 answer
152 views

Is NTRU broken?

Today a new paper appeared on ePrint, "Improved Provable Reduction of NTRU and Hypercubic Lattices". It claims that: this is the first provable result showing that breaking NTRU lattices ...
swineone's user avatar
  • 818
-1 votes
1 answer
58 views

Is security of Manuel Blum's Mental Hash function dependent on Security Through Obscurity for it's effectiveness?

I have been practicing using Manuel Blum's Mental Hash Function for personal use, described in the link below: Mental Cryptography and Good Passwords However, Rob Shearer has shown that the function ...
its.just.me's user avatar
0 votes
1 answer
42 views

Vulnerabilities of a word-level substitution cipher

What kind of attacks would be possible against this kind of substitution cipher? Every word in the plaintext is to be replaced with a random string of the same length The encryption of any given word ...
u2892's user avatar
  • 1
1 vote
0 answers
65 views

How secure is this hash combination function for merkle trees?

I am exploring the class of functions that I have seen called "hash combination functions". These functions are arguably distinct from hash functions, generally providing second-preimage ...
Justin Martin's user avatar
1 vote
2 answers
535 views

The future of cryptanalysis

I am an undergraduate (grade three). I am confused about the cryptanalysis. Because a lot people say that the modern ciphers are complete and they can't be cracked. Maybe the prospects for ...
Arthur Alexander's user avatar
0 votes
2 answers
39 views

Instantiation of norm bound in SIS

Recall Short Integer Solution: $\textbf{SIS}_{n, q, \beta, m}$: Given $\textbf{A} \in \mathbb{Z}^{n\times m}_q$, $\vec{b} \in \mathbb{Z}^{n}$, find $\vec{z} \in \mathbb{Z}^{m}$ of norm $||z|| \le \...
user avatar
1 vote
0 answers
37 views

Choice of algorithm for ECDLP when you have information regarding private key

Okay, I have a ECDSA public key $P$. The curve is arbitrary and not necessarily secure. The finite field of curve, $q$, is a $315$ bit prime. I know the following information regarding key: The ...
madhurkant's user avatar
0 votes
1 answer
62 views

Is using the polynomials ring $\mathbb{Z}_{2}[x]/(x^8+1)$ in RLWE secure against brute force attack?

Given the ring $R_2=\mathbb{Z}_{2}[x]/(x^8+1)$, initiate a public key encryption based on RLWE $(A,b=As+e)$ where all the parameters are selected as polynomials over the given ring. Under the ...
Anas Ahmad's user avatar
0 votes
1 answer
57 views

Can I prove AES-GCM nonce reuse just from the bytes?

I have AES-GCM output with GMAC tag. The plaintext consists of some bitfields I know the structure of. When I generate input which should only affect timestamps and counters in very specific bytes, I ...
nusch's user avatar
  • 1
1 vote
1 answer
67 views

Does encrypting a billion short and similar jsons with known structure make encryption less secure?

Let's say we have a billion short individual json files with same regular structure: {"name": "<name>", "id": <id>}. Each ...
aackmann's user avatar
0 votes
1 answer
109 views

How would I go about reverse engineering a hash function given input string and generated hash

I have a wireless capture of data and it's 12 bit hash. I am trying to identify the actual function that would have generated the hash data. I tried all the generic 12 bit CRC polynomials but none of ...
jay's user avatar
  • 1
3 votes
1 answer
183 views

equivalence between entropic perfect secrecy and single probability

i'm new to information theory. I know the standard perfect secrecy definition: $$ P(M=m|C=c) = P(M=m) , $$ for all $m$ and $c$, respectively the message and the cypher. Now, i can use the entropic ...
forgetfuled's user avatar
1 vote
1 answer
73 views

Is a Shift Cipher with Random Insertions Unbreakable?

Imagine an Encryption Algorithm which applies a classic Shift Cipher (also called Caesar or ROT-X) to a text (with only lowercase [a-z] and the space ...
v3l0c1r4ptx0r's user avatar
2 votes
1 answer
173 views

How to identify if a legacy encryption algorithm used in my programming language is secure?

I used an open-source programming language called Lucee / Cfscript that is closely related to Adobe Coldfusion. The default function that developers use to encrypt and decrypt data (usually for ...
ialexander's user avatar
15 votes
1 answer
1k views

Impact of Ryan and Heninger's CRYPTO 2023 paper on post quantum cryptosystems

From Schneier's blog, which seems to have been written in response to a somewhat recent Quanta magazine article: The winner of the Best Paper Award at CRYPTO this year (2023) was a significant ...
kodlu's user avatar
  • 22.5k
3 votes
2 answers
1k views

Can I change the radio frequency according to my encryption algorithm?

I know that information can be changed by changing the frequency of electromagnetic vibrations.My question is, can I change the frequency according to my encryption algorithm? That way I can get a ...
Hacer's user avatar
  • 33
0 votes
1 answer
67 views

Can HKDF be safely used as a round function in a Feistel Cipher

Hello my question is it practical to use HKD as a round function in a Feistel Cipher I know you should not roll your own crypto, this is for learning purpose's only. Take a look at my code and let me ...
dasein's user avatar
  • 3
2 votes
1 answer
108 views

Not understanding elliptic curve scalar multiplication to produce Ethereum address

This is the equation Public key = Private key * G Here, ...
Asif Iqbal's user avatar
-1 votes
1 answer
82 views

Given and encrypted message, is it theoretically possible to decrypt a message without the key or guessing it? If so, what methods could be used?

Decrypting an AES-Encrypted Message Without the Key: A Cryptographic Challenge Summary: I am investigating the possibility of decrypting an AES-encrypted message when the encryption key is unknown ...
NeoX's user avatar
  • 1
1 vote
2 answers
317 views

Is it faster to decrypt than to encrypt in all cryptography systems? [closed]

I am using a cryptography system in which the Feistel structure and permutation cipher are combined. I am amazed by the result; decryption is so much faster than encryption. My system is working ...
Dharmendra Thapa's user avatar
0 votes
0 answers
51 views

How to estimate the bias of linear cryptanalysis given the input and output masks

Assume the input linear mask is $a$, and output mask is $b$,for a block cipher $F$ with $r$ round,How to accurately and quickly estimate the bias of linear cryptanalysis? which is \begin{equation*} ...
HelloSpace's user avatar
1 vote
1 answer
106 views

Hard decisional problem on bilinear groups

Problem: Given $g, g^a, g^b, g^c \in G$ and an efficient bilinear map $e:G \times G \longrightarrow G_T$, distinguish $g^{abc}$ from a random element of $G$. Is it a hard problem?
Anna's user avatar
  • 11
0 votes
0 answers
168 views

Speed comparison of encryption algorithms

I am trying to compare various encryption algorithms in terms of encryption duration, decryption duration, information entropy, NPCR, UACI, and correlation coefficients. I used a Lena 256x256 ...
ysnky's user avatar
  • 1
3 votes
1 answer
118 views

Judgment of Results from NIST Randomness Testing

I am using the NIST suite to test the randomness of binary numbers and I have a 64KB dataset. I am confused with the results in finalAnalysisReport.txt. I have the ...
yuting zhang's user avatar
0 votes
0 answers
70 views

AES SBOX Masking in Python

I am trying to create an AES Sbox masking based on this paper. In the paper, they tried to mask the sbox described in this other paper. The inversion is been done in GF(4). I know that it is mostly ...
John's user avatar
  • 1
0 votes
0 answers
66 views

Differential cryptanalysis of modes of operation

It is not quite difficult to understand the idea of differential cryptanalysis applied to a standalone block cipher. The method investigates, how differences of plaintext evolve while going through ...
Georgy Firsov's user avatar
1 vote
0 answers
40 views

Dealing with MITM attack in e-voting systems

I've read many e-voting papers that use El-Gamal scheme which I recall is vulnerable to man-in-the-middle attack, yet I find no discussion or even mentioning of it in those papers. -Does anyone knows ...
ShAr's user avatar
  • 160
1 vote
0 answers
77 views

Which cipher is used in this UDP stream? [closed]

I'm trying to analyze a stream of communication I captured from a game. I know the keys but I don't know how to apply them. I've tried: Various AES-256 modes, splitting the message at different ...
Krab's user avatar
  • 111
4 votes
0 answers
79 views

Cryptanalytic attacks ASCON MAC

I am researching ASCON. I can find cryptanalytic attacks ASCON authenticated encryption and ASCON HASH, But I am not finding anything ASCON MAC. Anyone knows of any attacks, any research on this?
Nicole Foster's user avatar
2 votes
0 answers
91 views

Source of encryption scheme used in blockchain based IoT

I've found the following encryption scheme UserA: $$sk_A, pk_A = sk_A \cdot G$$ UserB: $$sk_B, pk_B = sk_B \cdot G$$ Enc: UserA $$u \in \mathbb{Z}_q^* \\ Y = u \cdot pk_B \\ S = H(U) \oplus m \\ C = (...
coolgirl Leon's user avatar
1 vote
0 answers
45 views

Cryptanalysis of S-box [closed]

Because of implementation constrains, I merge some 4-bit S-boxes to find a 8-bit S-box with good properties such as nonlinearity, resistance against differential and linear cryptanalysis. Does the ...
Vahid's user avatar
  • 11
2 votes
1 answer
118 views

Does combining a stream cipher and block cipher produce any vulnerabilities?

In particular, AES-CBC with Blake2b for HMAC combined with xChacha20-Poly1305. The scheme is to encrypt with xChacha20-poly1305 first, using a key derived from a high entropy password using argon2id ...
bismofunyuns's user avatar
0 votes
1 answer
99 views

How to evaluate the minimum complexity of the key recovery when the success probability p is given?

Since the practical security of a symmetric-key primitive is determined by evaluating its resistance against an almost exhaustive list of known cryptanalytic techniques. My problem is that could we ...
HelloSpace's user avatar
2 votes
1 answer
373 views

Disclosure of Catastrophic Cryptanalytic Breakthroughs

An efficient algorithm for factoring would be a major mathematical achievement giving the person who discovered it anstant fame. About two years ago, C. P. Schnorr claimed such a breakthrough but it ...
kodlu's user avatar
  • 22.5k
0 votes
1 answer
104 views

Does higher key sizes correspond to a higher security parameter?

If a system provide n bits of security, it is known that the best possible attack against the system would be 2^n (security parameter). However, why are the key sizes of some cryptosystems much larger ...
rin ichinose's user avatar
1 vote
1 answer
111 views

Construction of Blake2 and Cha Cha

Recently, I was reading about Blake2B and its properties regarding randomness and security, and its connection to Daniel Bernstein's CHA CHA digest. As a budding cryptographer, I find it doable to ...
Neev Penkar's user avatar
1 vote
1 answer
154 views

Double- and -add algorithm

I am currently doing the elliptic curves and I'm stuck for 8 hours without finding solutions. I under stand the process of double and add but don't know how to obtain 5 * 8P = 4OP =11 P. 11 P was in ...
Stefan's user avatar
  • 11
2 votes
1 answer
69 views

n-bit addition over $GF(2^n)$ vs. addition modulo $2^n$

I am currently studying the cryptanalysis of Speck, but I am feeling confused about the addition in Speck. I am not sure whether the addition in Speck is done through n-bit addition over $GF(2^n)$ or ...
35 honglang's user avatar
0 votes
0 answers
30 views

Writing a specific position of AES state in a specific round in terms of Key bytes

Suppose we manipulate the zeroth byte of AES state after the 9th round ShiftRow operation and we want to see its effect on the ciphertext. The propagation of the error effect is demonstrated in the ...
Mohammadsadeq Borjiyan's user avatar
4 votes
11 answers
9k views

For Symmetric Cryptography, why is it considered more important to safeguard a key than the function/algorithm for encrypting/decrypting a message?

As stated for the question above here's an analogy: You are a robber looking for a house to rob with two different scenarios that might occur. 1. You have a key that you know belongs to a house and ...
omar7439's user avatar
0 votes
0 answers
51 views

Cryptanalyzing a hash compression function

I'm designing a hash function which uses a double-tree construction and a compression function $c(s,A,B,C,a)$ ($s$ and $a$ may be omitted when there's only one of them) where $s$ is a set of three ...
Pierre Abbat's user avatar
1 vote
0 answers
159 views

If G is a PRG, is G' necessarily a PRG?

Given: A function $$G: \{0,1\}^{3n} \to \{0,1\}^{6n}$$ which is known to be a secure Pseudorandom Generator (PRG). A derived function $$G'(x_1 \| x_2) = G_b(x_1\|0^n\|x_2), \text{ where } x_1, x_2 \...
Steven's user avatar
  • 11
0 votes
0 answers
34 views

Security Analysis: Adversary's Ability to Recover Concatenated and Hashed Secret with Partial String Knowledge

Suppose I have the following secret, calculated by concatenating and hashing the results of two random strings: secret = H( H( random_string1 ) || H( random_string2 ) ) Let's assume that the adversary ...
Kadir Korkmaz's user avatar
0 votes
0 answers
35 views

How by changing ciphertext can the attacker know the length of the padding in POODLE attack

I try to understand the POODLE attack. I read that the attacker try to change one byte of the last block of the ciphertext. Becasue the last block is only have padding and the last byte is the padding ...
eitan's user avatar
  • 31
1 vote
1 answer
81 views

DDT for boolean functions must contain only powers of two

I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
Alessio Proietti's user avatar
5 votes
1 answer
135 views

Cryptanalysis of the GOC

The GOC (Générateur d'Octets Chiffrants, Ciphering Byte Generator) is a PseudoRandom Generator that was used during the late 20th century for content encryption in pre-internet Videotex terminals, ...
fgrieu's user avatar
  • 141k
2 votes
1 answer
65 views

How to convert a Modular addition to conjunctive normal form (CNF)? [closed]

If I have three integers $x,y,z\in \mathbb{F}_{2^n}$, How do I convert the modulo addition operation into conjunctive normal form (CNF)? $$ (x+y)\pmod{2^n-1}=z $$
mini minions's user avatar
0 votes
2 answers
87 views

May specifying the position of swapfile help defeat LUKS encryption?

I need to enable hybernation to the LUKS-encrypted drive. My /boot partition is unencrypted hence it stores all kernel images as well as kernel parameters in unencrypted form. For hybernation to work ...
CurtisB's user avatar
3 votes
3 answers
319 views

How big of a threat are *diffusion model* based AIs to cryptographic systems?

The diffusion model, which is used by products like Midjourney and Dall-E, trains AI systems to de-noise (remove added randomness) from data to infer what the original de-noised data is. That would ...
aiootp's user avatar
  • 773
0 votes
1 answer
84 views

Finding out corrupted S Box value in DES implementation?

I am using DES encryption when writing a file in an embedded device. When I decrypt the file. I get a partially corrupted file. Kind of randomly some 8-byte blocks are corrupted. Some are not. When I ...
Monem Ahmed's user avatar

1
2 3 4 5
32