Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

Which among the following is a method of encryption where units of plain text are replaced with cipher text according to a fixed system? [closed]

Substitution Cipher DES AES All of the above Basically, I am confused between all three. Because all of them are symmetric. Yet, AES and DES are block ciphers. Any idea?
user avatar
0 votes
0 answers
53 views

Problem with implementation of Enigma Machine

I'm having trouble making an implementation of Enigma Machine in VBA. My question is about implementing the rotors and their move. To be more precise, I will show below the way that I code my Enigma ...
user avatar
0 votes
1 answer
41 views

Is Mersenne Twister hard to break if it has a reduced output?

I was reading this challenge, which proposes to clone (or recover) the internal state of the MT19937 just by applying the inverse process to each output (624 consecutively words). Mersenne Twister's ...
user avatar
  • 1
4 votes
0 answers
104 views

About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?

Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$ with $$p=(p_1, p_2)$$ $$q=(q_1,q_2)$$ $$p_1,q_1 \in [0,s)$$ $$p_2,q_2 \in [0,s^2)$$ We want to find a path in between ...
user avatar
  • 475
2 votes
1 answer
67 views

Why would the same cipher structure have a different optimal attack for different bit widths?

I'm going to use the Simon Cipher as an example, but I want to frame the question to be more general. Why would the same cipher structure have a different optimal attack for different bit widths? I ...
user avatar
  • 4,234
0 votes
1 answer
63 views

Why is ShiftRow important in AES?

I came across a comment about AES 128 without ShiftRow. I want to use this weakness to perform an attack. So far, I get that It possible to divide in 4 independent blocks of 32 bits. So we can launch ...
user avatar
1 vote
1 answer
46 views

Linear cryptanalysis resistance of AES Sbox

If you look at the AES Linear Approximation Table (computed for example with Sage) you will see there are many entries with what looks like a high bias of -16 ("absolute bias" scale). I ...
user avatar
0 votes
0 answers
48 views

What is digram analysis?

so I wanted to ask something since I just learned about cryptography. Here where I have the task to write an essay on cryptography and the title I have to do is introduction digram analysis. However, ...
user avatar
  • 1
2 votes
0 answers
36 views

Scyther related questions for handling/splitting values and verifying hashes

While implementing a protocol in Scyther, I need help with the following questions - How do we split a particular message/variable into two parts in Scyther? (For eg. if I have value R in my protocol ...
user avatar
1 vote
1 answer
53 views

Differential cryptanalysis - how to extend the attack to rounds before the last?

Suppose that we have a block cipher such that the last round of the cipher depends on half of the key and the penultimate round uses the other half. Suppose also that I attacked the last round using ...
user avatar
0 votes
0 answers
63 views

Attack against stream cipher (LFSR with ASCII)

I'm reading Understanding Cryptography by Christof Paar and Jan Pelzl. In chapter 2 (Stream Ciphers) there's a question that goes like this: Assume we have a stream cipher whose period is quite short....
user avatar
  • 123
2 votes
1 answer
105 views

For any numbers $a, b$, what are the operators $X, Y$ such that revealing $a\ X\ b$ and $a\ Y\ b$ doesn't reveal info about $a,b$?

Previously I thought about a pair of 8-bit uniformly distributed random numbers $(a,b) \in \{0,1\}^8$, and $X$ to be bitwise XOR, $Y$ to be 8-bit addition. But it turned out that revealing $a \text{ ...
user avatar
  • 519
2 votes
3 answers
206 views

What does $(a+b) \bmod{256}$ and $a$ XOR $b$ reveal about $a, b$?

Say $a$ and $b$ are some uniform random $8$ bits so that the entropy of $a$ and $b$ is 8 bits each. If I show you $(a+b) \bmod{256}$ and $a$ XOR $b$, then what can you tell about $a$ and $b$? Or how ...
user avatar
  • 519
-1 votes
2 answers
63 views

predict random keys using python [closed]

How can I write a program in python to predict the random key (urandom) that is used for encryption? I tried to search and I couldn’t find anything related to guessing and predicting urandom in python
user avatar
  • 17
0 votes
0 answers
90 views

Hashing and Password Cracking

I was playing a game on cryptography where I encountered this problem: Hashed Value of password: 24 109 76 35 22 94 83 25 106 104 73 87 56 38 56 50 10 92 58 84 44 88 24 112 125 121 125 43 122 55 106 ...
user avatar
  • 111
0 votes
0 answers
39 views

What is the general equation for determining the viability of a brute force attack on BIP-39? (Only performing access with pre-image - 12 seed words)

I'd like to be able to better define the security of a BIP-39 algorithm where I just consider the process of giving me a "seed phrase". Imagining a scenario where a hacker would try to gain ...
user avatar
5 votes
1 answer
252 views

Which is the smallest, cyclic in 3 directions, consistent structure of random values which can be hidden at the adversaries machine? (some comparison)

Or more general each member can be part of up to three 2D locally euclidean planes of 2 different dimensions each. (each of those planes is cyclic in two orthogonal directions, like a torus) Given ...
user avatar
  • 475
1 vote
0 answers
54 views

Can I decrypt AES-CBC ciphertext if I have the key without IV? [duplicate]

Can I decrypt ciphertext from AES-CBC encryption, if I have the key and ciphertext only?
user avatar
  • 17
4 votes
1 answer
153 views

What is the effect of low rank dual sublattices on the dual lattice attack on LWE?

In the dual lattice attack of Espitau, Joux and Kharchenko (On a dual/hybrid approach to small secret LWE), the authors propose distinguishing (and subsequently recovering secret values) of LWE ...
user avatar
  • 10.4k
0 votes
1 answer
60 views

Computational indistinguishability of two LWE type samples

Consider the problem of distinguishing between polynomially many samples of either \begin{equation} (x, b, As + e) ~~\text{or}~~\left(x, b, ~Ax + b\cdot(As + e) + e'\right). \end{equation} Here, $A$ ...
user avatar
1 vote
0 answers
22 views

On the effectiveness of Sidelnikov-Shestakov attack under a bad guess

I have been studying Wieschebrink paper "Cryptanalysis of the Niederreiter Public Key Scheme Based on GRS Codes". In the paper a cryptosystem using GRS codes is exhibited with an attack ...
user avatar
1 vote
1 answer
81 views

Why does differential cryptanalysis always start from the last round?

Suppose we are working with a cipher with the same general structure as AES. I want to attack the cipher in the following way: suppose that the differential holds only for the first round (much higher ...
user avatar
0 votes
0 answers
16 views

Using Coppersmith for a second trivariate polynomial

I have a trivariate polynomial whose roots I am interested. The polynomial has monomials in $\{X^4,X^2,X^2Y,X^2Z,1\}$. What is the best way to generate the lattice and apply $LLL$ so that I can get a ...
user avatar
  • 882
0 votes
0 answers
32 views

Enumerating values from a linear congruential generator java Random()

During my research on a java application, I discovered that the nextInt(64) function of the java.Random() class is used to ...
user avatar
0 votes
0 answers
50 views

Indistinguishability proof of an encryption scheme

Is there any indistinguishability proof (e.g., IND-CPA, IND-CCA, IND-CCA1, IND-CCA2, IND-CKA) based on games that involve breaking the AES security? Usually the proof involve breaking hard problems ...
user avatar
2 votes
1 answer
78 views

Shift cypher, perfectly secure?

I know that if only one character is encrypted using a shift cipher, then the shift cipher is perfectly secure. But what if the space of keys is greater than the space of messages? Would it still be ...
user avatar
  • 23
0 votes
1 answer
29 views

limiting number of queries to Enc. or Dec

Why do we limit the number of queries to Encryption or Decryption oracles in the security analysis of various encryption schemes to be polynomial in the security parameter n?
user avatar
  • 15
0 votes
1 answer
55 views

Does the searchable encryption scheme satisfy trapdoor indistinguishability?

In a searchable encryption scheme based on the certificateless cryptosystem, the trapdoor generation algorithm only has a hash function that outputs an integer value. Does the scheme satisfy trapdoor ...
user avatar
0 votes
1 answer
83 views

RSA rsa residue class ring

I've been working on the RSA method for several weeks and I don't understand what this residual class ring is all about. I understand that if $ x^e \bmod n$ there must be $x<n$ because of ...
user avatar
  • 11
2 votes
1 answer
193 views

Is DSA still secure without the factor "r"?

If I understand correctly, the way DSA in a group $G$ with a hash function $H$ works is: Peggy (signer) has a private/public key pair $x$, $g^x$. For signing, she produces a random session key $k$, $g^...
user avatar
  • 23
4 votes
0 answers
85 views

Security analysis of North Korean block cipher Jipsam1

The cipher is a modification to AES and is described on this website: The only difference between Jipsam1 and AES-256 is the S-box. Whereas in AES the S-box is public and constant, namely $$ \begin{...
user avatar
  • 13.3k
0 votes
0 answers
65 views

RSA: decrypting short message with a different public key

I am having a hard time understanding what I have come across using RSA-textbook. So I have: e = 3 as an exponent a VERY long public key N of 1991 bits (clearly useless trying to factor) a very short ...
user avatar
7 votes
1 answer
490 views

Notion of elementary operation when complexities in the form of $2^{128}$

In lots of cryptoanalytic papers I read, attack complexities are stated in the form of a constant. For example, this related key attack on of AES states: [...] For AES-256 we show the first key ...
user avatar
2 votes
0 answers
52 views

Linear approximation of modular addition of a constant?

In Linear Approximations of Additions Modulo $2^n$, Wallén shows how to compute the correlation of the modular addition of two binary bit vectors. A simple recursive procedure was given by Schulte-...
user avatar
0 votes
1 answer
93 views

What would be the benefits of a fast PRNG that produces an 8-bit output and could pass 1 Peta Byte of the PractRand test?

Assuming that all other elements like the internal state of the algorithm are considered secured and very hard to discover from a cryptanalytic standpoint. How significant would be for the algorithm ...
user avatar
0 votes
0 answers
65 views

Difference between WhatsApp and Signal implementation of the Open Whisper Protocol

WhatsApp has taken the step of using the Open Whisper Protocol for their message encryption, borrowed from the Signal application. I was wondering if there was any obvious, high level, difference in ...
user avatar
2 votes
2 answers
93 views

How to find the optimal trail in linear cryptanalysis

I'm reading and implementing this tutorial, the author explains everything pretty clearly, the only thing I'm missing is how he decides which trail to use (pg. 12). I understand that one should prefer ...
user avatar
1 vote
0 answers
36 views

How does one produce this in the linear cryptanalysis of DES

I understand how this linear approximation board below is produced, but I can't understand how this second board is produced using the first one and finally how the pilling-up lemma values are ...
user avatar
0 votes
1 answer
66 views

Finding collisions of polynomial rolling hashes

A polynomial hash defines a hash as $H = c_1a^{k-1} + c_2a^{k-2} ... + c_ka^0$, all modulo $2^n$ (that is, in $GF(2^n)$). For brevity, let $c$ be a $k$ dimensional vector (encapsulating all the ...
user avatar
0 votes
0 answers
63 views

Meet-in-the-middle attack on Double DES

This question is straight out of the book, I cant grasp my head around what it is stating, if someone can elaborate I would appreciate it. A meet in the middle attack on a double DES if the chosen ...
user avatar
1 vote
1 answer
149 views

Why do stream ciphers repeat and how is that a threat?

If you have to generate a sufficiently long keystream, why would the keystream eventually repeat? If the keystream repeats does it pose the threat of being decrypted by a hacker? How could one use it ...
user avatar
4 votes
1 answer
126 views

Matsui's linear attack on 5-round DES

I'm trying to understand Mitsuru Matsui's "Linear Cryptanalysis Method for DES Cipher", specifically the attack he describes at the end of section 5, on 5-round DES. I followed the attack on ...
user avatar
0 votes
0 answers
107 views

Is this the right directions for the NSUCRYPTO-2021 Let's Decode Problem?

https://nsucrypto.nsu.ru/archive/2021/round/2/task/4/#data The main idea of the exercise: Find the secret key $k$, having access to the $Enc(x, d) = Enc(x^d \bmod n), n = 1060105447831$. I will assume ...
user avatar
1 vote
1 answer
65 views

Public-Key Encryption with Privilege Access: is it possible?

Let be Alice, Bob, and David three people. They all have public-key cryptographic system: private key and public key. Is there any way, in some known cryptographic system (RSA, Elliptic Curve, etc.), ...
user avatar
3 votes
1 answer
161 views

Probability of choosing a base successfully in Pollard p-1 factorization method

In a problem about pollard p-1 factorization method, where $n=pq$. We choose some random base $a$ , and an exponent $B$, where hopefully $p-1$ has small prime factors, and if so we hope to estimate $p ...
user avatar
2 votes
1 answer
61 views

How would having multiple independently encrypted versions of the same plaintext impact confidentiality?

Suppose I have some unknown plaintext P which I encrypt N times, each time with a completely new and random key and IV. Would knowing that all the encrypted output came from the same identical ...
user avatar
  • 23
2 votes
1 answer
96 views

Katz/Lindell 2.4 - Generalizing from 2 messages to any message space?

I'm trying to solve problem 2.4 in "Introduction to Modern Cryptography" (2nd edition) for self-study. The problem asks to prove that perfect secrecy $$ Pr[M = m | C = c] = Pr[M = m] $$ ...
user avatar
  • 247
2 votes
1 answer
76 views

Calculating statistical distance for simple addition cipher?

I'm looking at the solutions to this problem set for self study. One of the questions is to calculate the statistical distance for the following scheme: The message space is equal to the key space, ...
user avatar
  • 247
3 votes
0 answers
48 views

Why is WalnutDSA specified for COSE?

WalnutDSA was a 1st-round entrant in the NIST Post-Quantum Cryptography project. It had a significant cryptanalytic break close to almost breaking the security of the cryptosystem, only survived due ...
user avatar
  • 6,621
1 vote
0 answers
37 views

How to Prove matrix $m \times m$ is invertible is equivalent to be $LI$ over $\mathbb{Z_{2}}$?

I came up with one problem that says that a $m \times m$ matrix is invertible is the same as to say that its rows are LI (linearly independent) over $\mathbb{Z_{2}}$. First of all, I'd like to know ...
user avatar

1
2 3 4 5
29