Questions tagged [cryptanalysis]
Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).
1,524
questions
0
votes
0
answers
31
views
Security Analysis: Adversary's Ability to Recover Concatenated and Hashed Secret with Partial String Knowledge
Suppose I have the following secret, calculated by concatenating and hashing the results of two random strings:
secret = H( H( random_string1 ) || H( random_string2 ) )
Let's assume that the adversary ...
0
votes
0
answers
32
views
How by changing ciphertext can the attacker know the length of the padding in POODLE attack
I try to understand the POODLE attack. I read that the attacker try to change one byte of the last block of the ciphertext. Becasue the last block is only have padding and the last byte is the padding ...
- 31
1
vote
1
answer
47
views
DDT for boolean functions must contain only powers of two
I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
5
votes
1
answer
106
views
Cryptanalysis of the GOC
The GOC (Générateur d'Octets Chiffrants, Ciphering Byte Generator) is a PseudoRandom Generator that was used during the late 20th century for content encryption in pre-internet Videotex terminals, ...
- 137k
2
votes
1
answer
45
views
How to convert a Modular addition to conjunctive normal form (CNF)? [closed]
If I have three integers $x,y,z\in \mathbb{F}_{2^n}$,
How do I convert the modulo addition operation into conjunctive normal form (CNF)?
$$
(x+y)\pmod{2^n-1}=z
$$
- 25
0
votes
2
answers
67
views
May specifying the position of swapfile help defeat LUKS encryption?
I need to enable hybernation to the LUKS-encrypted drive. My /boot partition is unencrypted hence it stores all kernel images as well as kernel parameters in unencrypted form. For hybernation to work ...
- 1
3
votes
3
answers
264
views
How big of a threat are *diffusion model* based AIs to cryptographic systems?
The diffusion model, which is used by products like Midjourney and Dall-E, trains AI systems to de-noise (remove added randomness) from data to infer what the original de-noised data is. That would ...
- 703
0
votes
1
answer
56
views
Finding out corrupted S Box value in DES implementation?
I am using DES encryption when writing a file in an embedded device. When I decrypt the file. I get a partially corrupted file. Kind of randomly some 8-byte blocks are corrupted. Some are not. When I ...
0
votes
1
answer
66
views
Safe implicit value validation: $H_k(k \oplus m) \sim H_k(m)$?
$H_k$ is a cryptographic hash function that's keyed using a section of key material $k$ (for whatever definition of "keyed" that's appropriate for the given hash function $H$).
Are the ...
- 703
0
votes
0
answers
19
views
Finding key using Mutual Index of coincidence / Mg from vigenere ciphertext [duplicate]
I'm new to cryptography and I was trying to find key to an intercepted vigenere ciphertext using ciphertext-only attack, I'm following book "cryptography and network security" by Forouzan.
...
- 1
0
votes
1
answer
40
views
Is there a way to short circuit (speed up) hashing a large but sparse array?
Imagine a large array (Megabytes) that is virtually empty, i.e. contains 0 in almost all locations. But also imagine there's 1000 pseudo random locations that contain a pseudo random byte. There is ...
- 15k
2
votes
1
answer
103
views
Can I predict CryptGenRandom on my own device?
I have a Windows 10 laptop with an algorithm that creates a random number using the PRNG CryptGenRandom. According to Wikipedia:
Because CryptGenRandom is the de facto standard CSPRNG in Win32 ...
- 173
2
votes
1
answer
85
views
Is hash function cryptanalysis the same or more difficult for iterated hashing, as H(H(H(H(H))))?
The effectiveness of hash function attacks is typically measured in $x$ broken rounds of $N$ total designed rounds. And some constructs containing iterated hash functions include proof of work schemes,...
- 15k
1
vote
2
answers
74
views
Given $i$ keyed-$PRP$ labels $\ell_{i,x}$ from a $2^{256} \times 2^{256}$ Sudoku (Latin-square), how difficult is it for an adversary to solve?
There's a keyed-permutation I'm playing with, $\ell_{i,x} = \pi_i(x_i)$, which is a bijection $X \leftrightarrow X$, where $|X| = 2^{256}$, and whose evaluations on plaintext inputs $x_i$ perfectly ...
- 703
0
votes
0
answers
29
views
Is combining Elgamal algorithm and RSA algorithm for key generation and AES+RSA algorithm for encryption and decryption a novel approach?
Key generation: Key Generation
Firstly, the RSA algorithm will be used to generate a public and a private key.
Generate two random prime numbers p, q.
Select RSA public key, P k such that gcd(P k, Φ)=...
1
vote
0
answers
54
views
Literature on (concrete) hardness of Short Integer Solution (SIS)
I am interested in what the state of the art results on the hardness of the Short Integer Solution (SIS) instances are. The one I am the most familiar with (and the most discussed) is to use lattice ...
- 299
0
votes
0
answers
58
views
Trouble detecting cyclic group order crossovers in SECP256K1
There's a problem in detecting whether the sum of public key addition has crossed the cyclic group order boundary
For this example, think of public keys $Pub$ as private keys $Priv$, (private scalars),...
1
vote
4
answers
165
views
Good references to breakable limits: $2^{60}$
Recently, I read here on Crypto SE that $2^{60}$ doesn't provide enough resistance to current adversaries. Could someone please provide me with good references related to that threshold, or any ...
1
vote
0
answers
54
views
Misuse Attacks on Lattice Crypto
I've been reading "Misuse Attacks on Post-Quantum Cryptosystems" (https://eprint.iacr.org/2019/525). In what scenarios are the attacks described in the paper applicable? Is it specifically ...
- 415
0
votes
0
answers
41
views
Can I skip ahead with a quadratic congruential generator?
I have a congruential generator where
$$
r_{n+1} = r_n^2 - c\;(mod\;p)
$$
known $r_0$, $c$ and $p$ can i get $r_n$ without having to compute all the previous values?
- 1
4
votes
2
answers
116
views
How certain is it that a shorter password can't match the salted hash of a long one?
We (collectively) salt passwords, then hash them; maybe even run them through something like PBKDF2 first (depending on how the password will be used).
The end result is that we have a string $p$ and ...
- 143
0
votes
1
answer
81
views
How much of SHA3's internal state can be reached?
After reading that about "37% of the 256-bit outputs" of SHA-256 are unreachable when fed only 256-bit inputs [1] I'm curious & confused. The formula from the proof here considers a ...
- 703
1
vote
0
answers
62
views
Is it possible to get the negative point with −x in that version of the Pedersen hash over the BaybyJubJub curve?
The Pedersen hash is a low constraints friendly hash for Zk-Snarks.
Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
- 153
2
votes
1
answer
93
views
Is Python secrets module using a unsafe RNG on Windows?
The Python secrets module claims to produce cryptographically secure random numbers. I did some research on which random number generator is used when you call the secrets module on Windows. I found ...
- 173
1
vote
0
answers
45
views
How many characters to do frequency analysis?
Is there any study that has looked into what is the minimum number of ciphertext characters one needs to have to do a reliable frequency analysis?
It would be nice to know the evolution of the ...
- 11
2
votes
2
answers
67
views
plain text size prediction
In your opinion, is the correlation between the length of the ciphertext and the decrypted text (even if it is approximate) a cipher vulnerability? Or is there a solution to this problem outside of it?...
- 23
0
votes
1
answer
51
views
How the differential cryptanalysis work? [duplicate]
I am new in the field of cryptanalysis and wonder how the differential cryptanalysis work
- 1
1
vote
1
answer
197
views
Pedersen Hash : when truncating the hash to keep only the X coordinate, is it possible to compute a collision when the Babyjubjub curve is used?
The Pedersen hash is a low constraints friendly hash for Zk-Snarks.
Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
- 153
1
vote
2
answers
139
views
State recovery algorithm for Xorshift128 given modular outputs
I am researching the Xorshift128 PRNG. I am particularly interested in recovering the state given a set of outputs that have the remainder taken with different values.
A common way to take a unsigned ...
- 11
0
votes
1
answer
194
views
What if LWE is not as secure as we think?
LWE schemes are currently being deployed. LWE has no quantum polynomial time algorithms as far as we know.
Despite this what is the consequence if LWE can be broken on a classical computer? Do we ...
- 908
0
votes
0
answers
28
views
Comparison of distinguishing attack against blockcipher and permutation
In a previous question, we explored various security definitions of encryption schemes, such as IND-CPA, IND-CCA{1,2,3,etc.}
These indistinguishability games can roughly translate to blockciphers, as ...
- 8,648
2
votes
0
answers
34
views
How many ciphertexts should attacker intercepts if he only knows the first 3 bytes of plaintext of each one?
Consider a system in which DES is used to encrypt messages in which the first three plaintext Bytes are known by the attacker. How many encrypted messages is it necessary to intercept in order to be ...
- 143
2
votes
2
answers
129
views
Best Known Attacks on Discrete Logarithm in Generic Groups
This is a followup to my recent question Discrete Logarithm Challenges and Records.
I am interested in confirming my understandings from the answer to that question, stated below:
For a discrete ...
- 21k
1
vote
0
answers
59
views
Bit based division property
Bit based division property is a great method of Integral attack on block ciphers, which was invented by Y. Todo.
According to the paper Bit-Based Division Property and Application to Simon Family (in ...
- 141
1
vote
1
answer
77
views
Is it fatal if a blockcipher uses a sbox with a fixed point at 0?
In a previous question, I asked how to implement arbitrary s-box in side-channel-free fashion. The code I posted in the question loops over all 256 values of a byte to avoid timing channel, and I want ...
- 8,648
-6
votes
1
answer
83
views
Are Schnorr's algorithm really subject to q-computer attacks?
I was wondering whether quantum-computers really break Schnorr's signature scheme. Schor's algorithm works via the quantum Fourier transform, which reveals the cycle time and thus phi. However, with a ...
0
votes
0
answers
42
views
New POST heaviest-chain finder without downloading any blocks or trusting a checkpoint?
In a POST consensus mechanism with no starting stake needed, I may have found a way to sync with the correct chain without a.) trusting checkpoinnts or b.) downloading the whole chain (or even part of ...
0
votes
0
answers
54
views
Why using linear increasing nonce in DSA in a bad idea?
Suppose we sign and verify messages with a DSA scheme. Before signing the first
message the necessary parameters $(p,q,h,g,x,y)$ are initialized, including the nonce $k$ as an integer between $(1,q-1)$...
- 1
1
vote
2
answers
79
views
decrypting full ciphertext of (AES CTR/GCM) based on partial knowledge of the cleartext
I have found myself in a position where I need to encrypt multiple objects (vCards) with AES Counter mode or Galois/Counter Mode using the same key. Now here is the problem the structure of the vCard ...
- 153
1
vote
1
answer
69
views
DH Finding A Public Key from Public key and shared secret
Is there a known feasible method for determining an unknown public key from a Diffie Helman shared secret and the other public/private key pair?
This would be rarely useful, but I am curious if the DH ...
- 33
1
vote
0
answers
45
views
Tensor and power bases for SIS?
What is there to say about using a power basis or a tensor basis or some combination of them for the RSIS problem in lattice cryptography?
Restricting to dimension 3 for illustration, usually the ...
- 357
1
vote
0
answers
30
views
Secure ciphersuite from security-wise sub-optimal unkeyed permutation?
Hypothetically,
IF we were to create a SSL/TLS or QUIC ciphersuite from a single (unkeyed) permutation operating in sponge mode to provide hashing and duplex mode to provide AEAD cipher,
AND IF the ...
- 8,648
2
votes
0
answers
36
views
Exploit 3DES-CBC with known checksum of plaintext and repeated IV
I came across the following enterprise encryption scheme. I laughed when I first saw it, but I'm not a specialist and I'd like to know how bad it really is.
3DES-CBC
k1=k2=k3 for 3DES
IV for CBC is ...
- 121
3
votes
0
answers
109
views
Are there "light" versions of cryptographic hash functions?
After tinkering with cryptographic hash functions, I started wondering if they do have counterpart functions that would imitate their cryptographic properties but with a lower level of strength in ...
- 153
2
votes
1
answer
181
views
Attack on the chosen plain-text RSA
Reading another user's question, a doubt came to me.
Suppose an RSA oracle exists, with which it is possible to interact to encrypt and decrypt some text. The oracle output is not the decrypted text ...
- 33
1
vote
0
answers
43
views
How can I perform a one-client MITM attack in a Diffie-Hellman key exchange? [closed]
Suppose we have intercepted a public key exchange (via Diffie-Hellman protocol). In addition to the keys A and B, the generator g and the module p are known.
Assuming that it is possible to exchange ...
- 11
2
votes
0
answers
21
views
Product Cipher with Two Autokey Cipher
I have a cypher text with I know encrypted two times with Autokey Cipher with same lengths of keys. I am following the statistical cryptanalysis in here when it is ciphered with one time with Autokey ...
- 21
3
votes
0
answers
118
views
Cryptanalysis of ARX Ciphers
Rotational Cryptanalysis of ARX show that rotational probability of an ARX primitive can be computed by $p^q$ where $p$ is rotational probability of modular addition and $q$ is number of modular ...
- 2,397
1
vote
0
answers
88
views
Which encryption method support 256 bytes block size?
I am looking at some secret encryption method that apparently uses CBC and a block size of 256 bytes. I can do a chosen-ciphertext-attack. When I modify a single byte in the ciphertext a complete ...
- 11
1
vote
2
answers
74
views
Rule 30 based block cipher
So I went ahead an wrote this little program. What it does is it takes a password for a seed and generates a (pseudo-random) bit-pattern using rule 30 from cellular automata. It then XORs our input ...
- 111