Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

Filter by
Sorted by
Tagged with
0
votes
1answer
72 views

How are Data Science and Cryptography related?

Is there any interesting connections between Data Science And Cryptography. Data Science involves using Statistical Analysis to analyze data while Cryptography also involves Statistics in ...
-1
votes
1answer
63 views

How do discrete logarithm with modulo a prime and a non-prime compare?

Let $c_N = g^i \mod N$ and $N=p \cdot q$ and $c_P = f^j \mod P$ and $P$ a prime We assume $N,P$ has the same bit-length. $P$ is the best type of prime you can choose (e.g. safe prime). $N$ is a ...
0
votes
0answers
36 views

Constructing Differential Characteristics for Feistel Cipher

I have to construct for every i-round of Feistel cipher, for $i \in \{3,4,5,6,7,8\}$, a differential characteristic with there properties: $Pr[\Delta x = a \overset{f_i}{\rightarrow} \Delta y = b] = ...
1
vote
0answers
28 views

Guess the number of characteristics in differential cryptanalysis

I am doing some research on differential cryptanalysis for my master thesis. I analyzed some toy ciphers like the one in the popular tutorial about differential and linear cryptanalysis from heys Link....
16
votes
7answers
6k views

How to check a file was encrypted (really & correctly)

I would like to audit how an implementation of an encryption algorithm is really performed with the following given data of the problem: the encryption mechanism is reversible (this isn’t a signature)...
2
votes
0answers
36 views

Recover secret SHA-1 constants given Oracle

There's a black box that's basically SHA-1, except that the constants (h0, h1,...,h4) are secret. We can pass it arbitrary inputs and get the corresponding outputs. Given this, is it possible to ...
2
votes
0answers
81 views

A proposal for randomization of Niederreiter cryptosystem

The Niederreiter cryptosystem is a public key cryptosystem using Goppa code. Unfortunately it it is insecure unless it is a binary code. So I thought I could insert random linear codes into randomly ...
2
votes
1answer
124 views

Using AI to perform Cryptanalysis

If given a large set of examples of cyphertext and corresponding plaintext, could AI be trained to decrypt a cyphertext as the examples provided?, and if so, are there any examples online ...
0
votes
0answers
62 views

zero knowledge proof of range and set membership

I have a large number of items with a unique serial number and a score (score isn't always unique). There is a list which contains all of the serial numbers and their respective scores. I select 3 ...
0
votes
0answers
36 views

hash tree merkle tree

If I have 32 blocks and I have a fault in two blocks, how many pieces should I touch to detect the error? I tried 20 blocks but this does not work? Anyone who knows what is the difference between ...
13
votes
2answers
569 views

Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?

We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as: $s=\frac{H(m)+xr}{k}$ Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
5
votes
0answers
56 views

FPE current state of art for “small” domains

Is there any survey with the state of art treatment of format-preserving encryption for small domains (i.e. 2^20 for example)? I believe that Stalling's and Rogaway's surveys are out of date due to ...
0
votes
2answers
78 views

how can I test quality of sbox?

I have 11 sboxes, I want to test them and find the best one. How can I do that, I found several criterions for that but I could not understand.
-2
votes
1answer
97 views

Are there any flaws in this pseudocode?

I'm developing an algorithm that cracks small RSA keys (And theoretically bigg ones too, though might take some time), and was wondering if anyone you spot any flaws in this python code: ...
0
votes
0answers
26 views

I'm studying about differential cryptanalysis in DES. I need to make the DDT through python [duplicate]

I just made DES algorithm(encryption, decryption) using python. And I want to attack 1,2 4,8 .. round DES. For that, I need to make the DDT code. Could you guys help me to make the DDT? Thank you.
3
votes
1answer
72 views

How can the Enigma's plugboard settings be found with partially known plaintext?

I don't quite understand the procedure described on wikipedia, is there a generalized procedure you can follow to rule out a pairing on the plugboard? For example, let's say the cipher text is ...
2
votes
0answers
89 views

Solving not so much overdetermined system of multivariate polynomial equations

I'm studying algorithms solving multivariate equations. I'm stuck in solving overdetermined set of quadratic equations. Concretely, with the number $n$ of variables, the number of equations is $m=\...
2
votes
1answer
66 views

Can the original data be extracted from an RSA private key signed message

I'm working on a system that the main objective is to verify the message was written by the right person, but it would also be desirable if the message can't be understood by anyone sniffing it. It ...
0
votes
1answer
32 views

Why do we approximate R-1 rounds during linear or differential cryptanalysis?

I am currently looking into differential and linear cryptanalysis. I am however unsure why do we only approximate only R-1 out of R rounds - is it because we already know the output or why ? I have ...
3
votes
1answer
32 views

Estimating difficulty of “Memory-Hard Proof-of-Work” based on “size of memory”?

In Bitcoin proof-of-work, the difficulty of Proof-of-Work is estimated and calculated based on total hashing power of the participants. If total hashing power of the participants is higher, then PoW ...
1
vote
0answers
83 views

Security of an Elliptic Curve Public Key with a “Small” x-coordinate

Consider an elliptic curve over a finite field $F_p$ with $p$ prime and order $n$. Let $Q$ be a generator for the field. Given a public key point $P = aQ$, suppose we have an algorithm that finds an ...
9
votes
1answer
3k views

How long does it take to crack RSA 1024 with a PC?

Using an Intel Core i5 CPU, how long does it take to crack RSA using a key size of 1024 bit (generated using a secure key pair generation function)? Suppose for instance that we have thousands of ...
1
vote
0answers
48 views

Implementation of differential cryptanalysis

This question is a little bit more implementation based of differential cryptanalysis. I hope it is okay. I am working with the book "The Block Cipher Companion" on the topic differential ...
2
votes
1answer
77 views

Differential cryptanalysis in “The Block Cipher Companion”

I am practically implementing a differential cryptanalysis on a cipher which can be found in the book "The Block Cipher Companion". Following image shows the cipher: In Fig. 6.10 (page 126) there are ...
28
votes
2answers
5k views

What are the implications of the new alleged key recovery attack preprint on SIMON?

Just recently, a new attack was published against SIMON-32/64 which claims to also be applicable to other versions of the cipher. The paper is titled A Note on SIMON-32/64 Security (archived 2019-05-...
1
vote
0answers
32 views

Why Diffusion and Confusion prevent statistical analysis? [duplicate]

I've studied the concepts of Diffusion and Confusion of cryptographic algorithms, however, I don't understand why they help in preventing a statistical analysis. Are you able to explain to me?
2
votes
1answer
56 views

How to determine if $\{n \cdot g^a \mod P\}$ and $\{m \cdot g^a \mod P\}$ generate the same sets? (set size < $P-1$)

given some examples $k_{n_i},k_{m_i}$ out of each value set: $k_{n_i} \in \{n \cdot g^a \mod P\, \forall a \in \mathbb{N}<P\}=G_m$ $k_{m_i} \in \{m \cdot g^a \mod P, \forall a \in \mathbb{N}<P\}...
-1
votes
1answer
76 views

Is there a fast way to solve $k = n \cdot g^a \mod P$? (get $a$ for unknown $n$)

Would a factor besides the normal discrete logarithm problem increase or decrease the solving time? $k = n \cdot g^a \mod P$ with given $k,g,P$ and the knowledge $P= 2 \cdot N \cdot f+1$, while $...
3
votes
0answers
49 views

Probability equation of rotational cryptanalysis on modulo multiplication

The answer in this question defined how to calculate the probability of rotational cryptanalysis on modulo multiplication $\odot$. This paper defined an algebraic equation of how to calculate the ...
2
votes
0answers
57 views

Recover all keys on differential cryptanalysis

I am practically implementing differential cryptanalysis on a cipher from the book "the block cipher companion" . I am successful to get the last key $k_5$. Just to say some words about the ...
7
votes
1answer
264 views

How safe is a prime with $P=2 \cdot Q \cdot R \cdot S \cdot t+1$ for discrete logarithm? How to enhance/compare?

To get some certain properties for my use case I need a prime $P$ which has the form: $P=2\cdot Q \cdot R \cdot S \cdot t+1$ with $Q,R,S,t$ primes as well. Why that form - Use case Together with ...
1
vote
1answer
108 views

Mutual Index of Coincidence

I can't seem to find a simple explanation of Mutual Index of Coincidence. I am finding explanations of Mutual Index of Coincidence not Index of Coincidence. I don't understand what the formula below ...
0
votes
0answers
51 views

Collision resistance of a function which chooses the hash from a large table of hashes

Let's say you know a (possibly) large table of ids and some corresponsing hashes $h_{ID_j} = H(ID_j | secret_j)$. The resulting table looks like $$ ID_1 | h_{ID_1} $$ $$ ID_2 | h_{ID_2} $$ $$ ... $$ $...
1
vote
1answer
49 views

Calculate number of required pairs for differential cryptanalysis

I am currently doing some study on differential cryptanalysis. However, I have two open questions in the field. The first question is: How can I calculate the number of messages necessary for a ...
1
vote
1answer
55 views

Does a different exponent and base but same key help to resolve discrete logarithm?

E.g.: $k = N^a \mod P$ The attacker knows the prime $P$ and $N$, which is also a prime and (1.) prime root of $P$ or (2.) has a cycle size of $s$, so $1 = N^s \mod P$, (and for $\forall s'<s$, $...
1
vote
1answer
168 views

How should the key schedule be designed for this general block cipher?

After looking at the Wikipedia page for the Fiestel cipher, I thought about making a variation of it that is very general. I basically followed the diagram on Wikipedia in order to structure the ...
0
votes
0answers
49 views

Unique numbers with $P^aQ^bR^c \mod N$ for each combination of $a,b,c$ possible? Would it be safer than separate form (like $T^a \mod P$ for each)?

Main question: Is the computation of $a,b,c$ in $P^aQ^bR^c \mod N$ (much) harder than in $T_p^a \mod P$, $T_q^b \mod Q$, $T_r^c \mod R$ ? (assuming the first form exists) $P^aQ^bR^c \mod N$ With $P^...
0
votes
1answer
43 views

How much more secure is $c = mg_1^r + g_2(g_1(g_1^r-1)/(g_1-1)) \mod p$ compared to just $c = mg_1^r \mod p$ (dis. log), all known but $r$?

To encode a message $m$ to a cipher $c$ you can use the only hard solvable problem of computing the discrete logarithm with a generator $g$ in base over a prime $p$. $c = mg_1^r$ mod p If an ...
1
vote
2answers
113 views

Searching for a differential characteristic (differential cryptanalysis)

Currently I am doing some research on differential cryptanalysis. In general I got a good idea about the attack and how it is done. I am currently talking about ciphers with multiple rounds. It ...
2
votes
2answers
64 views

Extract one unique SBox from Canonical Representative

In paper https://eprint.iacr.org/2011/218.pdf, the author has examined 16! different 4 bit SBoxes and at the end of investigation, introduced an optimal class which named "Golden SBoxes". How can I ...
0
votes
1answer
56 views

Example of product cipher more secure than its components

Can anyone give me an example of a product cipher which more secure than its components. Here is how the explanation should proceed. There is cipher C1 which can be attacked with the technique A1, ...
1
vote
1answer
111 views

What is the approximate effort to break one additional round of a primitive?

Many of the cryptographic primitives currently in use have a number of their rounds already broken. Generally and with no particular primitive in mind, what is the scale of the effort to break one ...
5
votes
2answers
107 views

Origin of values for “security margin”?

It seems that the acceptable "security margin" for ciphers is set to be between 25% and 30% as a target by designers, where this number represents the number of rounds that remain "unbroken" for a ...
1
vote
1answer
102 views

Methods of Learning Cryptography [closed]

We're currently approaching the end of our semester, but I've found that our homework is starting to consist more of encrypting and decrypting using different types of algorithms instead of learning ...
0
votes
0answers
67 views

Choosing K in ECDSA SECP256K1

I am working on a very resource-constrained environment. Using a standard peer reviewed library isn't possible because it won't fit within the RAM requirements of the device (~5K unused ram without ...
2
votes
1answer
75 views

Fault attacks inside a loop

I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below, ...
0
votes
0answers
24 views

XOR operation to uncover plain-text out of given cipher-texts [duplicate]

I have a set of 11 hex coded strings that have been encrypted using XOR operation each with the same stream cipher key. How do I decrypt the 11th hex-coded string to arrive at the plain-text without ...
3
votes
1answer
91 views

Differential cryptanalysis tutorial of Howard M. Heys

I am currently working on some research about differential cryptanalysis. There is a lot of literature about that topic in the internet. One of the most known paper is the tutorial on linear and ...
-1
votes
1answer
63 views

Hashing algorithm with fixed range rather than fixed size output [closed]

I have read that output that varies by key size or file size can leak information. So if it should produce fixed size then what is the scenario if it produces fixed range? By fixed range I mean that ...
1
vote
1answer
77 views

Security of a block cipher if double encryption $E_{K_2} \circ E_{K_1}$ is always single encryption $E_{f(K_1,K_2)}$

If there always existed a $k_3$ such that $\operatorname{DES}(k_2, \operatorname{DES}(k_1, M)) = \operatorname{DES}(k_3, M)$, how would that affect the security of $\operatorname{DES}$?