As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

Filter by
Sorted by
Tagged with
2 votes
2 answers
81 views

Best Known Attacks on Discrete Logarithm in Generic Groups

This is a followup to my recent question Discrete Logarithm Challenges and Records. I am interested in confirming my understandings from the answer to that question, stated below: For a discrete ...
kodlu's user avatar
  • 20k
1 vote
0 answers
43 views

Bit based division property

Bit based division property is a great method of Integral attack on block ciphers, which was invented by Y. Todo. According to the paper Bit-Based Division Property and Application to Simon Family (in ...
R. Jalaei Salahi's user avatar
1 vote
1 answer
53 views

Is it fatal if a blockcipher uses a sbox with a fixed point at 0?

In a previous question, I asked how to implement arbitrary s-box in side-channel-free fashion. The code I posted in the question loops over all 256 values of a byte to avoid timing channel, and I want ...
DannyNiu's user avatar
  • 8,283
-6 votes
1 answer
70 views

Are Schnorr's algorithm really subject to q-computer attacks?

I was wondering whether quantum-computers really break Schnorr's signature scheme. Schor's algorithm works via the quantum Fourier transform, which reveals the cycle time and thus phi. However, with a ...
Luke Bright's user avatar
0 votes
0 answers
42 views

New POST heaviest-chain finder without downloading any blocks or trusting a checkpoint?

In a POST consensus mechanism with no starting stake needed, I may have found a way to sync with the correct chain without a.) trusting checkpoinnts or b.) downloading the whole chain (or even part of ...
Luke Bright's user avatar
0 votes
0 answers
47 views

Why using linear increasing nonce in DSA in a bad idea?

Suppose we sign and verify messages with a DSA scheme. Before signing the first message the necessary parameters $(p,q,h,g,x,y)$ are initialized, including the nonce $k$ as an integer between $(1,q-1)$...
rL0sr's user avatar
  • 1
1 vote
2 answers
64 views

decrypting full ciphertext of (AES CTR/GCM) based on partial knowledge of the cleartext

I have found myself in a position where I need to encrypt multiple objects (vCards) with AES Counter mode or Galois/Counter Mode using the same key. Now here is the problem the structure of the vCard ...
Tito's user avatar
  • 153
1 vote
1 answer
45 views

DH Finding A Public Key from Public key and shared secret

Is there a known feasible method for determining an unknown public key from a Diffie Helman shared secret and the other public/private key pair? This would be rarely useful, but I am curious if the DH ...
Wesley Jones's user avatar
1 vote
0 answers
42 views

Tensor and power bases for SIS?

What is there to say about using a power basis or a tensor basis or some combination of them for the RSIS problem in lattice cryptography? Restricting to dimension 3 for illustration, usually the ...
Joseph Johnston's user avatar
1 vote
0 answers
25 views

Secure ciphersuite from security-wise sub-optimal unkeyed permutation?

Hypothetically, IF we were to create a SSL/TLS or QUIC ciphersuite from a single (unkeyed) permutation operating in sponge mode to provide hashing and duplex mode to provide AEAD cipher, AND IF the ...
DannyNiu's user avatar
  • 8,283
2 votes
0 answers
25 views

Exploit 3DES-CBC with known checksum of plaintext and repeated IV

I came across the following enterprise encryption scheme. I laughed when I first saw it, but I'm not a specialist and I'd like to know how bad it really is. 3DES-CBC k1=k2=k3 for 3DES IV for CBC is ...
j123b567's user avatar
  • 121
3 votes
0 answers
104 views

Are there "light" versions of cryptographic hash functions?

After tinkering with cryptographic hash functions, I started wondering if they do have counterpart functions that would imitate their cryptographic properties but with a lower level of strength in ...
Ryan B.'s user avatar
  • 153
2 votes
1 answer
107 views

Attack on the chosen plain-text RSA

Reading another user's question, a doubt came to me. Suppose an RSA oracle exists, with which it is possible to interact to encrypt and decrypt some text. The oracle output is not the decrypted text ...
Jake's user avatar
  • 33
1 vote
0 answers
24 views

How can I perform a one-client MITM attack in a Diffie-Hellman key exchange? [closed]

Suppose we have intercepted a public key exchange (via Diffie-Hellman protocol). In addition to the keys A and B, the generator g and the module p are known. Assuming that it is possible to exchange ...
Albert's user avatar
  • 11
2 votes
0 answers
17 views

Product Cipher with Two Autokey Cipher

I have a cypher text with I know encrypted two times with Autokey Cipher with same lengths of keys. I am following the statistical cryptanalysis in here when it is ciphered with one time with Autokey ...
stigmata2's user avatar
3 votes
0 answers
88 views

Cryptanalysis of ARX Ciphers

Rotational Cryptanalysis of ARX show that rotational probability of an ARX primitive can be computed by $p^q$ where $p$ is rotational probability of modular addition and $q$ is number of modular ...
crypt's user avatar
  • 2,377
1 vote
0 answers
72 views

Which encryption method support 256 bytes block size?

I am looking at some secret encryption method that apparently uses CBC and a block size of 256 bytes. I can do a chosen-ciphertext-attack. When I modify a single byte in the ciphertext a complete ...
Flole's user avatar
  • 11
1 vote
2 answers
73 views

Rule 30 based block cipher

So I went ahead an wrote this little program. What it does is it takes a password for a seed and generates a (pseudo-random) bit-pattern using rule 30 from cellular automata. It then XORs our input ...
WhatIsName's user avatar
1 vote
2 answers
461 views

Stuck on a cryptanalytical research project [closed]

This is not a technical question, but rather it seeks advice on what to do if cryptanalytical research goes wrong. I've discovered a new attack that works great in theory, but in practice, it fails. I ...
MayDen's user avatar
  • 11
0 votes
0 answers
231 views

RSA : Is there a way to compute phi(n) or N itself if we only know e, d and a ciphertext?

I am trying to solve a problem where private key exponent d, ciphertext c, and public key exponent e (65537) are known. How can I calculate φ(n) or n itself? An extended version of the problem would ...
bd55's user avatar
  • 13
2 votes
1 answer
106 views

Confusion+Diffusion comparison table? (e.g. with Avalanche Criterion / SAC)

I'm looking for a general comparison of encryption algorithms in regard to Confusion and Diffusion (as defined by Claude Shannon), and if possible, specifically for their SAC and BIC quality. For ...
foo's user avatar
  • 145
4 votes
0 answers
53 views

Where did the number of initial plaintexts required for impossible cryptanalysis on Mini-AES came from?

I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference. But I don't ...
siba36's user avatar
  • 191
0 votes
1 answer
57 views

Differential trails in differential cryptanalysis

From section 4.4 of this book https://www.ic.unicamp.br/~rdahab/cursos/mo421-mc889/Welcome_files/Stinson-Paterson_CryptographyTheoryAndPractice-CRC%20Press%20%282019%29.pdf I'm confused on how the ...
Simon Balfe's user avatar
2 votes
0 answers
25 views

how to build the plaintext structure for impossible differential cryptanaysis on IDEA?

I'm trying to implement impossible differential cryptanalysis on 3.5 round IDEA using Miss in the Middle Attack on IDEA and Khufu paper as a reference and I'm stuck on the first two steps of the ...
siba36's user avatar
  • 191
1 vote
1 answer
122 views

Calculate the key of a Hill-cipher using known plain- and ciphertext

I know I should calculate the multiple inverse of plaintext with ciphertext $\pmod {26}$. However, the problem I have is that the plaintext is a $3 \times 4$ matrix which is not square, so how would I ...
Amer Yassir's user avatar
1 vote
1 answer
76 views

Size of nonlinear filter sequence to recover LFSR feedback polynomial

Let's suppose that there is a filter generator which based on $n$-size LFSR. Denote a feedback polynomial as $g(x_1, x_2, \dots, x_n)$ and nonlinear filter function as $f(x_1, x_2, \dots, x_n)$. Let $...
Grigoriy's user avatar
0 votes
1 answer
104 views

How does AES-CBC encryption achieve non-repeating blocks of ciphertext?

I am very interested in encryption algorithms, especially AES encryption algorithm in symmetric encryption. To this end, I have studied a lot of theoretical knowledge about AES encryption algorithm ...
SN-Grotesque's user avatar
2 votes
1 answer
63 views

Conceal time-based GUIDs with an affine-cipher?

I'd like to create a custom type of sortable GUID by concatenating an 8-byte nanosecond timestamp, 6 random bytes, a 1-byte node number, and a 1-byte counter. But, such a precise timestamp can be used ...
aiootp's user avatar
  • 53
1 vote
1 answer
198 views

Chosen-plaintext attact on AES with MixColumns omitted

Jean-Philippe Aumasson' "Serious Cryptography" says: "Without MixColumns, changes in a byte would not affect any other bytes of the state. A chosen-plaintext attacker could then decrypt ...
Zyx's user avatar
  • 11
5 votes
2 answers
191 views

In a PGP like Application , would compress and encrypt leak information

would compress and encrypt on data comromise security for PGP like application, would it be secure for use in Encrypted Messaging? I have heard its safe for data at rest encryption , i have heard ...
ANISH M 18CS006's user avatar
4 votes
1 answer
154 views

A modern rotor machine, could it be any safe?

I wonder if a rotor machine similar to enigma can be considered secure by today's standards under four conditions: A rotor machine which consists of 50 rotors picked out of a set of 100. A rotor ...
Princeofmillerovo's user avatar
2 votes
1 answer
76 views

Significance of theoretical weaknesses?

What is the significance of theoretical weaknesses? Any real life incident where a theoretical weakness was ignored and later it compromised the system? Whats the dividing line between theoretical and ...
crypt's user avatar
  • 2,377
1 vote
1 answer
132 views

What are the best known cryptanalytic attacks against AES-128 with 9 rounds?

What are the best known cryptanalytic attacks against AES-128 with 9 rounds? I found many such attacks on AES-192 and AES-256 with 9 rounds, but not for AES-128 with 9 rounds. Are there any ...
xhuliano's user avatar
1 vote
0 answers
48 views

By using a block cipher multiple times in a row is a 128-bit BC as secure as a 256-bit BC which uses his 128-key only as part of the message?

For given 128-bit numbers $S$ and $E$ we want to find a series of keys $k_i$ with $$ E = BC(BC(BC(.....BC(S, k_1),k_2) ..k_n)$$ We can either use a 128-Bit blocksize block cipher similar to AES (ECB ...
J. Doe's user avatar
  • 557
1 vote
1 answer
69 views

How does the security of AES change if we allow multiple uses in a row? How does it change if we limit the key space? And introduce a filter function?

$$f_0 = A$$ $$f_{n+1}=AES(f_n,k_n)$$ $$f_i = B$$ For given 128-bit values $A, B$ we want to find a chain of suitable 128-bit keys $k_1$ to $k_i$. The total length $i$ is undetermined. Every valid key ...
J. Doe's user avatar
  • 557
3 votes
1 answer
145 views

Why is the best way to solve LWE (and Cryptographic related Systems) with SVP (approx)?

Community, I'm new into lattice based cryptography, and I'm interested about the security of cryptography schemata like Kyber and why the focus of solving this problem lead into solving approx. SVP. ...
Max Weber's user avatar
1 vote
1 answer
231 views

Best attack estimates on AES

The wikipedia article on the Advanced Encryption Standard claims an attack against AES-128 with complexity $2^{126.1}$. The NIST call for proposals for post-quantum cryptography (table on page 18) ...
Myath's user avatar
  • 835
0 votes
0 answers
58 views

Security proof of the Schnorr Signature

How Schnorr signature security can be proved for signature forgery, replacement, and Replay attacks?
SHI MA's user avatar
  • 1
1 vote
0 answers
63 views

Non-uniform plaintext distribution -- AES attack

Are their any attacks on AES (any mode) in which before the attack is mounted, the adversary is aware that the input distribution is non-uniform? Most of the work assume that the plaintext is ...
nivedita's user avatar
2 votes
0 answers
98 views

Automated Security Protocol tool that models algebraic operations

Are there any automated security protocol verification tools that model algebraic operations; specifically addition. I am familiar with AVISPA and Verifpal, and they are both great and user-friendly ...
Mona's user avatar
  • 157
1 vote
2 answers
59 views

How fast does revealing parity bits leak information?

I've got a scheme where I XOR a secret key value with a public (but random) value, XOR together all the bits of the result, and publish that bit (0 or 1), which is the parity of the result of the XOR. ...
interfect's user avatar
  • 111
6 votes
0 answers
458 views

How the mimc bug from circomlib was safely exploited in practice?

Several years ago, there was an unenforced constraint on verification in the cirmcomlib library : a tool for building projects using ZsNarks. The error allowed to forge cryptographic nullifiers/proofs ...
user2284570's user avatar
2 votes
1 answer
119 views

How bad exactly are repetitions in the plaintext?

When the last n bytes of the plaintext are themselves suitably random, but predictably repeat m times in the same message - how bad is that? I'm convinced it is detrimental, but I am uncertain how ...
foo's user avatar
  • 145
1 vote
0 answers
61 views

RSA decryption problem knowing public key and ciphertext [closed]

new member here. I am taking a course in computer security, and we just got introduced in Cryptography and especially in RSA Algorithm. Although i got the 'basic idea' behind the RSA algorithm and the ...
Nikovlakopoulos's user avatar
2 votes
1 answer
165 views

Info AES cryptanalysis

I have some doubts regarding AES weakness and AES cryptanalysis. While it is relatively simple to find Cryptanalysis info on previous ciphers, I get confused about understanding various types of ...
LianoQ's user avatar
  • 71
1 vote
1 answer
22 views

Statistical closeness of distributions and time-unbounded distinguisher

If two ensembles are statistically indistinguishable, we all know that they are also computationally indistinguishable, i.e., for any PPT algorithm, the probability to distinguish them is negligible. ...
mactep Cheng's user avatar
0 votes
2 answers
77 views

What is the standard checklist for designing a Key Derivation Function?

What kinds of properties does a KDF need to have in order to be considered secure? What steps should be taken during analysis to test for flaws? In particular, I mean a KDF that is going to be used as ...
Wesley Jones's user avatar
2 votes
1 answer
196 views

How to solve this Baby Bleichenbacher Attack?

I am trying to solve this problem from https://toc.cryptobook.us/book.pdf. I am having trouble with this question : (Baby Bleichenbacher attack). Consider an RSA public key (n, e), where n is an RSA ...
Lightening's user avatar
0 votes
1 answer
89 views

How do I know the most efficient image encryption algorithm?

I am familiar with any algorithm that is based on the number of bits in a key (n-bit) and how to restore a key, such as the Discrete Logarithm Problem or Factorization.  When I use any algorithm for ...
Mhsz's user avatar
  • 431
2 votes
1 answer
544 views

A probable attack for RSA (factorization): how to improve it?

A probable attack for RSA (factorization): how to improve it? $N=8*G+3$ can be factored if there is a non-trivial negative $k$ such that $\frac{(N*(9+24*k)-3)}{8}=-6*m^2 $ [to exclude the two trivial ...
Alberico Lepore's user avatar

1
2 3 4 5
30