Questions tagged [cryptanalysis]
Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).
1,538
questions
1
vote
0
answers
22
views
Dealing with MITM attack in e-voting systems
I've read many e-voting papers that use El-Gamal scheme which I recall is vulnerable to man-in-the-middle attack, yet I find no discussion or even mentioning of it in those papers.
-Does anyone knows ...
- 152
1
vote
0
answers
64
views
Which cipher is used in this UDP stream?
I'm trying to analyze a stream of communication I captured from a game. I know the keys but I don't know how to apply them.
I've tried:
Various AES-256 modes, splitting the message at different ...
- 111
1
vote
1
answer
439
views
Calculate the key of a Hill-cipher using known plain- and ciphertext
I know I should calculate the multiple inverse of plaintext with ciphertext $\pmod {26}$. However, the problem I have is that the plaintext is a $3 \times 4$ matrix which is not square, so how would I ...
CommunityBot
- 1
3
votes
0
answers
59
views
Cryptanalytic attacks ASCON MAC
I am researching ASCON. I can find cryptanalytic attacks ASCON authenticated encryption and ASCON HASH, But I am not finding anything ASCON MAC. Anyone knows of any attacks, any research on this?
- 131
2
votes
0
answers
79
views
Source of encryption scheme used in blockchain based IoT
I've found the following encryption scheme
UserA: $$sk_A, pk_A = sk_A \cdot G$$
UserB: $$sk_B, pk_B = sk_B \cdot G$$
Enc: UserA
$$u \in \mathbb{Z}_q^* \\
Y = u \cdot pk_B \\
S = H(U) \oplus m \\
C = (...
- 91.9k
1
vote
0
answers
36
views
Cryptanalysis of S-box [closed]
Because of implementation constrains, I merge some 4-bit S-boxes to find a 8-bit S-box with good properties such as nonlinearity, resistance against differential and linear cryptanalysis.
Does the ...
- 11
2
votes
1
answer
109
views
Does combining a stream cipher and block cipher produce any vulnerabilities?
In particular, AES-CBC with Blake2b for HMAC combined with xChacha20-Poly1305.
The scheme is to encrypt with xChacha20-poly1305 first, using a key derived from a high entropy password using argon2id ...
- 47.6k
0
votes
1
answer
96
views
How to evaluate the minimum complexity of the key recovery when the success probability p is given？
Since the practical security of a symmetric-key primitive is determined by evaluating its resistance against an almost exhaustive list of known cryptanalytic techniques.
My problem is that could we ...
- 138k
0
votes
1
answer
112
views
Trouble detecting cyclic group order crossovers in SECP256K1
There's a problem in detecting whether the sum of public key addition has crossed the cyclic group order boundary
For this example, think of public keys $Pub$ as private keys $Priv$, (private scalars),...
2
votes
1
answer
305
views
Disclosure of Catastrophic Cryptanalytic Breakthroughs
An efficient algorithm for factoring would be a major mathematical achievement giving the person who discovered it anstant fame. About two years ago, C. P. Schnorr claimed such a breakthrough but it ...
- 15.2k
0
votes
1
answer
93
views
Does higher key sizes correspond to a higher security parameter?
If a system provide n bits of security, it is known that the best possible attack against the system would be 2^n (security parameter).
However, why are the key sizes of some cryptosystems much larger ...
- 9,001
1
vote
1
answer
77
views
Construction of Blake2 and Cha Cha
Recently, I was reading about Blake2B and its properties regarding randomness and security, and its connection to Daniel Bernstein's CHA CHA digest. As a budding cryptographer, I find it doable to ...
- 138k
5
votes
11
answers
9k
views
For Symmetric Cryptography, why is it considered more important to safeguard a key than the function/algorithm for encrypting/decrypting a message?
As stated for the question above here's an analogy:
You are a robber looking for a house to rob with two different scenarios that might occur.
1. You have a key that you know belongs to a house and ...
- 151
1
vote
1
answer
126
views
Double- and -add algorithm
I am currently doing the elliptic curves and I'm stuck for 8 hours without finding solutions. I under stand the process of double and add but don't know how to obtain 5 * 8P = 4OP =11 P. 11 P was in ...
- 47.6k
2
votes
1
answer
61
views
n-bit addition over $GF(2^n)$ vs. addition modulo $2^n$
I am currently studying the cryptanalysis of Speck, but I am feeling confused about the addition in Speck. I am not sure whether the addition in Speck is done through n-bit addition over $GF(2^n)$ or ...
- 145k
3
votes
1
answer
673
views
Cracking a key using a combination of partial keys
As part of a cryptanalytic attack I've carried out, I used a divide-and-conquer strategy to divide the secret key $k$ into several equal-sized partial keys $k = {k_1, k_2, ...}$.
The attack works ...
CommunityBot
- 1
2
votes
3
answers
262
views
LWE with a binary matrix A
In LWE, we know that given reasonable public parameter $A\in \mathbb{Z}_q^{n\times \lambda}$, secret $s\in \mathbb{Z}_q^{\lambda}$ and noise $e\in \mathcal{X}^{n}$, random $r\in \mathbb{Z}_q^{n}$, $(A,...
0
votes
0
answers
29
views
Writing a specific position of AES state in a specific round in terms of Key bytes
Suppose we manipulate the zeroth byte of AES state after the 9th round ShiftRow operation and we want to see its effect on the ciphertext. The propagation of the error effect is demonstrated in the ...
2
votes
3
answers
4k
views
DES Encryption Algorithm all 64 bits for key instead of 56 bits
Would a DES algorithm that uses all 64 bits for the key instead of just the 56 bits be more secure? I have been thinking about it but those 8 bits used for parity are very useful and but including ...
- 47.6k
1
vote
4
answers
467
views
Any famous approach for analyzing the randomness of data?
I'm writing a function that will allow me to analyze the randomness of some input data and return some stats about the probability of this data to be random.
Obviously it should be based on two things:...
- 138k
0
votes
0
answers
48
views
Cryptanalyzing a hash compression function
I'm designing a hash function which uses a double-tree construction and a compression function $c(s,A,B,C,a)$ ($s$ and $a$ may be omitted when there's only one of them) where
$s$ is a set of three ...
- 221
2
votes
1
answer
428
views
What is the current security level of an algorithm?
I was reading a paper of some years ago about a cryptography and a phrase got my attention.
We want to ensure a security level of at least $2^{80}$
I know that $2^{80}$ was used as rule of thumb ...
CommunityBot
- 1
1
vote
1
answer
99
views
Is it fatal if a blockcipher uses a sbox with a fixed point at 0?
In a previous question, I asked how to implement arbitrary s-box in side-channel-free fashion. The code I posted in the question loops over all 256 values of a byte to avoid timing channel, and I want ...
CommunityBot
- 1
1
vote
0
answers
141
views
If G is a PRG, is G' necessarily a PRG?
Given:
A function $$G: \{0,1\}^{3n} \to \{0,1\}^{6n}$$ which is known to be a secure Pseudorandom Generator (PRG).
A derived function $$G'(x_1 \| x_2) = G_b(x_1\|0^n\|x_2), \text{ where } x_1, x_2 \...
- 1
42
votes
3
answers
20k
views
Why does nobody use (or break) the Camellia Cipher?
If Camellia is of equivalent security and speed to AES, concerns arise.
First of all, assuming the above, why is Camellia so rarely used in practice?
Why aren't there any breaks in Camellia? Does ...
10
votes
4
answers
3k
views
Why was the Navajo code not broken by the Japanese in WWII?
In reading about this topic recently, to my understanding, the encryption schemes used on top of the Navajo language were very simple and definitely could have been broken (my research shows they ...
- 153
0
votes
1
answer
61
views
Finding out corrupted S Box value in DES implementation?
I am using DES encryption when writing a file in an embedded device. When I decrypt the file. I get a partially corrupted file. Kind of randomly some 8-byte blocks are corrupted. Some are not. When I ...
CommunityBot
- 1
0
votes
0
answers
33
views
Security Analysis: Adversary's Ability to Recover Concatenated and Hashed Secret with Partial String Knowledge
Suppose I have the following secret, calculated by concatenating and hashing the results of two random strings:
secret = H( H( random_string1 ) || H( random_string2 ) )
Let's assume that the adversary ...
19
votes
2
answers
3k
views
Can neural cryptanalysis be applied to AES?
In this Wikipedia article about Neural cryptography (section applications) it states:
In 1995, Sebastien Dourlens applied neural networks to cryptanalyze DES by allowing the networks to learn how ...
- 171
0
votes
0
answers
34
views
How by changing ciphertext can the attacker know the length of the padding in POODLE attack
I try to understand the POODLE attack. I read that the attacker try to change one byte of the last block of the ciphertext. Becasue the last block is only have padding and the last byte is the padding ...
- 31
1
vote
1
answer
59
views
DDT for boolean functions must contain only powers of two
I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
- 21.2k
6
votes
1
answer
235
views
A modern rotor machine, could it be any safe?
I wonder if a rotor machine similar to enigma can be considered secure by today's standards under four conditions:
A rotor machine which consists of 50 rotors picked out of a set of 100.
A rotor ...
- 1
35
votes
3
answers
5k
views
What are recommended, general strategies to start block-cipher design and/or analysis?
I (and many others for that matter) have always been fascinated by the inner workings of the modern building block of cryptography: block ciphers.
Now, the resources on the "black art" of ...
- 21.2k
2
votes
1
answer
93
views
Is hash function cryptanalysis the same or more difficult for iterated hashing, as H(H(H(H(H))))?
The effectiveness of hash function attacks is typically measured in $x$ broken rounds of $N$ total designed rounds. And some constructs containing iterated hash functions include proof of work schemes,...
CommunityBot
- 1
1
vote
1
answer
116
views
Some misunderstanding on the Security Proof with Oracle
I have a question about the security proof.
Suppose that I proved the following relations.
That is, I proved that $Adv_A \le Adv_A^{O} \le Adv_B$, where A,B are some cryptographic schemes and O is an ...
CommunityBot
- 1
5
votes
1
answer
124
views
Cryptanalysis of the GOC
The GOC (Générateur d'Octets Chiffrants, Ciphering Byte Generator) is a PseudoRandom Generator that was used during the late 20th century for content encryption in pre-internet Videotex terminals, ...
- 138k
1
vote
1
answer
165
views
Why does differential cryptanalysis always start from the last round?
Suppose we are working with a cipher with the same general structure as AES.
I want to attack the cipher in the following way: suppose that the differential holds only for the first round (much higher ...
CommunityBot
- 1
2
votes
1
answer
268
views
Attack on the chosen plain-text RSA
Reading another user's question, a doubt came to me.
Suppose an RSA oracle exists, with which it is possible to interact to encrypt and decrypt some text. The oracle output is not the decrypted text ...
CommunityBot
- 1
2
votes
1
answer
50
views
How to convert a Modular addition to conjunctive normal form (CNF)? [closed]
If I have three integers $x,y,z\in \mathbb{F}_{2^n}$,
How do I convert the modulo addition operation into conjunctive normal form (CNF)?
$$
(x+y)\pmod{2^n-1}=z
$$
- 138k
0
votes
2
answers
75
views
May specifying the position of swapfile help defeat LUKS encryption?
I need to enable hybernation to the LUKS-encrypted drive. My /boot partition is unencrypted hence it stores all kernel images as well as kernel parameters in unencrypted form. For hybernation to work ...
- 15.1k
0
votes
1
answer
70
views
Safe implicit value validation: $H_k(k \oplus m) \sim H_k(m)$?
$H_k$ is a cryptographic hash function that's keyed using a section of key material $k$ (for whatever definition of "keyed" that's appropriate for the given hash function $H$).
Are the ...
- 785
1
vote
0
answers
63
views
Is it possible to get the negative point with −x in that version of the Pedersen hash over the BaybyJubJub curve?
The Pedersen hash is a low constraints friendly hash for Zk-Snarks.
Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
- 153
3
votes
3
answers
283
views
How big of a threat are *diffusion model* based AIs to cryptographic systems?
The diffusion model, which is used by products like Midjourney and Dall-E, trains AI systems to de-noise (remove added randomness) from data to infer what the original de-noised data is. That would ...
- 21.2k
13
votes
2
answers
10k
views
Why don't we use Blowfish if it hasn't been cracked?
Since Blowfish is old, well-audited, and has no published attacks, why are we using AES instead? I know that Bruce Schneier said that Blowfish is insecure and told people to transition to Twofish, but ...
- 1
1
vote
4
answers
175
views
Good references to breakable limits: $2^{60}$
Recently, I read here on Crypto SE that $2^{60}$ doesn't provide enough resistance to current adversaries. Could someone please provide me with good references related to that threshold, or any ...
- 11.6k
9
votes
1
answer
1k
views
Introduction to LLL algorithm applied to linear modular inequalities
What is the Lenstra–Lenstra–Lovász lattice basis reduction algorithm about?
How is it applied to solve for $x\pmod m$ a system of modular inequalities $(u_i\,x+v_i\bmod m)<w$ for $0\le i<n$?
I'm ...
0
votes
0
answers
19
views
Finding key using Mutual Index of coincidence / Mg from vigenere ciphertext [duplicate]
I'm new to cryptography and I was trying to find key to an intercepted vigenere ciphertext using ciphertext-only attack, I'm following book "cryptography and network security" by Forouzan.
...
- 1
0
votes
1
answer
212
views
What if LWE is not as secure as we think?
LWE schemes are currently being deployed. LWE has no quantum polynomial time algorithms as far as we know.
Despite this what is the consequence if LWE can be broken on a classical computer? Do we ...
- 11.6k
1
vote
2
answers
81
views
Given $i$ keyed-$PRP$ labels $\ell_{i,x}$ from a $2^{256} \times 2^{256}$ Sudoku (Latin-square), how difficult is it for an adversary to solve?
There's a keyed-permutation I'm playing with, $\ell_{i,x} = \pi_i(x_i)$, which is a bijection $X \leftrightarrow X$, where $|X| = 2^{256}$, and whose evaluations on plaintext inputs $x_i$ perfectly ...
- 785
0
votes
1
answer
47
views
Is there a way to short circuit (speed up) hashing a large but sparse array?
Imagine a large array (Megabytes) that is virtually empty, i.e. contains 0 in almost all locations. But also imagine there's 1000 pseudo random locations that contain a pseudo random byte. There is ...
- 145k