Questions tagged [cryptanalysis]
Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).
1,493
questions
0
votes
0
answers
21
views
How many packets should attacker intercepts if he only knows the correspondence plain-cipher of the first 3 bytes of each packet?
Consider a system in which DES is used to encrypt simple, short HTTP requests in which the first three Bytes always correspond to the GET character sequence. How many encrypted messages is it ...
- 20k
2
votes
2
answers
81
views
Best Known Attacks on Discrete Logarithm in Generic Groups
This is a followup to my recent question Discrete Logarithm Challenges and Records.
I am interested in confirming my understandings from the answer to that question, stated below:
For a discrete ...
- 920
1
vote
0
answers
44
views
Bit based division property
Bit based division property is a great method of Integral attack on block ciphers, which was invented by Y. Todo.
According to the paper Bit-Based Division Property and Application to Simon Family (in ...
- 134k
1
vote
2
answers
158
views
Problem with implementation of Enigma Machine
I'm having trouble making an implementation of Enigma Machine in VBA. My question is about implementing the rotors and their move.
To be more precise, I will show below the way that I code my Enigma ...
- 105
5
votes
0
answers
135
views
Resistance to integral attacks by North Korean block cipher Jipsam1
The cipher is a modification to AES and is described on this website:
The only difference between Jipsam1 and AES-256 is the S-box. Whereas in AES the S-box is public and constant, namely
$$
\begin{...
- 14.9k
3
votes
1
answer
73
views
Why the permutation of the right hand rotor given in Rejewski's paper is $PNP^{-1}$?
I would like to know why the permutation of the right hand rotor given in Rejewski's paper is $PNP^{-1}$. First of all I can't get how he added an $P$(alphabetic permutation) at the front of $N$(...
- 105
1
vote
1
answer
100
views
Some misunderstanding on the Security Proof with Oracle
I have a question about the security proof.
Suppose that I proved the following relations.
That is, I proved that $Adv_A \le Adv_A^{O} \le Adv_B$, where A,B are some cryptographic schemes and O is an ...
CommunityBot
- 1
1
vote
1
answer
53
views
Is it fatal if a blockcipher uses a sbox with a fixed point at 0?
In a previous question, I asked how to implement arbitrary s-box in side-channel-free fashion. The code I posted in the question loops over all 256 values of a byte to avoid timing channel, and I want ...
- 8,291
1
vote
1
answer
139
views
Why does differential cryptanalysis always start from the last round?
Suppose we are working with a cipher with the same general structure as AES.
I want to attack the cipher in the following way: suppose that the differential holds only for the first round (much higher ...
CommunityBot
- 1
2
votes
1
answer
107
views
Attack on the chosen plain-text RSA
Reading another user's question, a doubt came to me.
Suppose an RSA oracle exists, with which it is possible to interact to encrypt and decrypt some text. The oracle output is not the decrypted text ...
CommunityBot
- 1
7
votes
1
answer
381
views
Which is the smallest safe elliptic curve (bit-length)?
At https://safecurves.cr.yp.to/ some elliptic curves are listed which passed certain security tests. The smallest bit-length of a safe curve listed there is 221 bits.
At wiki page discrete logarithm ...
-6
votes
1
answer
70
views
Are Schnorr's algorithm really subject to q-computer attacks?
I was wondering whether quantum-computers really break Schnorr's signature scheme. Schor's algorithm works via the quantum Fourier transform, which reveals the cycle time and thus phi. However, with a ...
- 90.2k
15
votes
2
answers
7k
views
Cycle attack on RSA
I originally posted this question in the mathematics section, you can see it here.
Let $p$ and $q$ be large primes, $n=pq$ and $e : 0<e<\phi(n), \space gcd(e, \phi(n))=1$ the public encyption ...
0
votes
0
answers
42
views
New POST heaviest-chain finder without downloading any blocks or trusting a checkpoint?
In a POST consensus mechanism with no starting stake needed, I may have found a way to sync with the correct chain without a.) trusting checkpoinnts or b.) downloading the whole chain (or even part of ...
- 20k
0
votes
0
answers
48
views
Why using linear increasing nonce in DSA in a bad idea?
Suppose we sign and verify messages with a DSA scheme. Before signing the first
message the necessary parameters $(p,q,h,g,x,y)$ are initialized, including the nonce $k$ as an integer between $(1,q-1)$...
- 1
3
votes
0
answers
88
views
Cryptanalysis of ARX Ciphers
Rotational Cryptanalysis of ARX show that rotational probability of an ARX primitive can be computed by $p^q$ where $p$ is rotational probability of modular addition and $q$ is number of modular ...
- 134k
1
vote
2
answers
64
views
decrypting full ciphertext of (AES CTR/GCM) based on partial knowledge of the cleartext
I have found myself in a position where I need to encrypt multiple objects (vCards) with AES Counter mode or Galois/Counter Mode using the same key. Now here is the problem the structure of the vCard ...
1
vote
1
answer
45
views
DH Finding A Public Key from Public key and shared secret
Is there a known feasible method for determining an unknown public key from a Diffie Helman shared secret and the other public/private key pair?
This would be rarely useful, but I am curious if the DH ...
- 140k
1
vote
0
answers
42
views
Tensor and power bases for SIS?
What is there to say about using a power basis or a tensor basis or some combination of them for the RSIS problem in lattice cryptography?
Restricting to dimension 3 for illustration, usually the ...
- 357
1
vote
0
answers
25
views
Secure ciphersuite from security-wise sub-optimal unkeyed permutation?
Hypothetically,
IF we were to create a SSL/TLS or QUIC ciphersuite from a single (unkeyed) permutation operating in sponge mode to provide hashing and duplex mode to provide AEAD cipher,
AND IF the ...
- 8,291
2
votes
0
answers
25
views
Exploit 3DES-CBC with known checksum of plaintext and repeated IV
I came across the following enterprise encryption scheme. I laughed when I first saw it, but I'm not a specialist and I'd like to know how bad it really is.
3DES-CBC
k1=k2=k3 for 3DES
IV for CBC is ...
- 121
3
votes
0
answers
104
views
Are there "light" versions of cryptographic hash functions?
After tinkering with cryptographic hash functions, I started wondering if they do have counterpart functions that would imitate their cryptographic properties but with a lower level of strength in ...
- 153
1
vote
1
answer
122
views
Calculate the key of a Hill-cipher using known plain- and ciphertext
I know I should calculate the multiple inverse of plaintext with ciphertext $\pmod {26}$. However, the problem I have is that the plaintext is a $3 \times 4$ matrix which is not square, so how would I ...
CommunityBot
- 1
1
vote
0
answers
24
views
How can I perform a one-client MITM attack in a Diffie-Hellman key exchange? [closed]
Suppose we have intercepted a public key exchange (via Diffie-Hellman protocol). In addition to the keys A and B, the generator g and the module p are known.
Assuming that it is possible to exchange ...
- 413
2
votes
0
answers
17
views
Product Cipher with Two Autokey Cipher
I have a cypher text with I know encrypted two times with Autokey Cipher with same lengths of keys. I am following the statistical cryptanalysis in here when it is ciphered with one time with Autokey ...
- 21
1
vote
0
answers
72
views
Which encryption method support 256 bytes block size?
I am looking at some secret encryption method that apparently uses CBC and a block size of 256 bytes. I can do a chosen-ciphertext-attack. When I modify a single byte in the ciphertext a complete ...
- 11
6
votes
0
answers
458
views
How the mimc bug from circomlib was safely exploited in practice?
Several years ago, there was an unenforced constraint on verification in the cirmcomlib library : a tool for building projects using ZsNarks. The error allowed to forge cryptographic nullifiers/proofs ...
- 185
1
vote
2
answers
73
views
Rule 30 based block cipher
So I went ahead an wrote this little program. What it does is it takes a password for a seed and generates a (pseudo-random) bit-pattern using rule 30 from cellular automata. It then XORs our input ...
- 134k
10
votes
4
answers
4k
views
Predicting PRNG given some of its previous output
I a have a question about PRNGs and this is my very first experience with them. I have the following generator that takes a 56-bit seed $p$ during initialization and then chooses both $X$ and $Y$ ...
- 1
0
votes
0
answers
231
views
RSA : Is there a way to compute phi(n) or N itself if we only know e, d and a ciphertext?
I am trying to solve a problem where private key exponent d, ciphertext c, and public key exponent e (65537) are known.
How can I calculate φ(n) or n itself?
An extended version of the problem would ...
CommunityBot
- 1
1
vote
1
answer
876
views
cracking a one time pad using key reuse
There is a one time pad which works as follows:
given message "hello" and key "asdfg", it produces "hwoqu". It only works with the 26 english letters. The output is (h(7) ...
CommunityBot
- 1
1
vote
2
answers
461
views
Stuck on a cryptanalytical research project [closed]
This is not a technical question, but rather it seeks advice on what to do if cryptanalytical research goes wrong.
I've discovered a new attack that works great in theory, but in practice, it fails.
I ...
- 11
2
votes
1
answer
119
views
How bad exactly are repetitions in the plaintext?
When the last n bytes of the plaintext are themselves suitably random, but predictably repeat m times in the same message - how bad is that? I'm convinced it is detrimental, but I am uncertain how ...
- 90.2k
2
votes
1
answer
107
views
Confusion+Diffusion comparison table? (e.g. with Avalanche Criterion / SAC)
I'm looking for a general comparison of encryption algorithms in regard to Confusion and Diffusion (as defined by Claude Shannon),
and if possible, specifically for their SAC and BIC quality.
For ...
- 134k
4
votes
0
answers
53
views
Where did the number of initial plaintexts required for impossible cryptanalysis on Mini-AES came from?
I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference.
But I don't ...
- 191
8
votes
2
answers
3k
views
ECC algorithm pollard's $\rho$ complexity
One of the methods to break a ECDLP is Pollard's rho algorithm. When ECDLP is defined over a finite field $F_p$, and given a relation $S=w.T$, where S and T are a member of $F_p$. Then ECDLP is to ...
- 417
0
votes
1
answer
57
views
Differential trails in differential cryptanalysis
From section 4.4 of this book https://www.ic.unicamp.br/~rdahab/cursos/mo421-mc889/Welcome_files/Stinson-Paterson_CryptographyTheoryAndPractice-CRC%20Press%20%282019%29.pdf
I'm confused on how the ...
- 20k
2
votes
0
answers
25
views
how to build the plaintext structure for impossible differential cryptanaysis on IDEA?
I'm trying to implement impossible differential cryptanalysis on 3.5 round IDEA using Miss in the Middle Attack on IDEA and Khufu paper as a reference and I'm stuck on the first two steps of the ...
- 191
3
votes
1
answer
649
views
Cracking a key using a combination of partial keys
As part of a cryptanalytic attack I've carried out, I used a divide-and-conquer strategy to divide the secret key $k$ into several equal-sized partial keys $k = {k_1, k_2, ...}$.
The attack works ...
CommunityBot
- 1
1
vote
1
answer
76
views
Size of nonlinear filter sequence to recover LFSR feedback polynomial
Let's suppose that there is a filter generator which based on $n$-size LFSR.
Denote a feedback polynomial as $g(x_1, x_2, \dots, x_n)$ and nonlinear filter function as $f(x_1, x_2, \dots, x_n)$.
Let $...
- 11
18
votes
3
answers
4k
views
Why can't the commitment schemes have both information theoretic hiding and binding properties?
The commitment schemes like Pedersen's or Hash based, either have information theoretic hiding and computational binding or computational hiding and information theoretic binding. So can we ever get ...
- 1,003
0
votes
1
answer
105
views
How does AES-CBC encryption achieve non-repeating blocks of ciphertext?
I am very interested in encryption algorithms, especially AES encryption algorithm in symmetric encryption. To this end, I have studied a lot of theoretical knowledge about AES encryption algorithm ...
- 413
2
votes
1
answer
63
views
Conceal time-based GUIDs with an affine-cipher?
I'd like to create a custom type of sortable GUID by concatenating an 8-byte nanosecond timestamp, 6 random bytes, a 1-byte node number, and a 1-byte counter. But, such a precise timestamp can be used ...
- 136
3
votes
1
answer
165
views
A query regarding SHA256 output hash structure vs input entropy?
Given an Input string of N bytes where some bytes positions in the string are fixed/immutable (F Bytes) and rest of the bytes positions can contain any value as we want or are configurable/variable (V ...
CommunityBot
- 1
2
votes
2
answers
380
views
What is the current security level of an algorithm?
I was reading a paper of some years ago about a cryptography and a phrase got my attention.
We want to ensure a security level of at least $2^{80}$
I know that $2^{80}$ was used as rule of thumb ...
CommunityBot
- 1
1
vote
1
answer
69
views
How does the security of AES change if we allow multiple uses in a row? How does it change if we limit the key space? And introduce a filter function?
$$f_0 = A$$
$$f_{n+1}=AES(f_n,k_n)$$
$$f_i = B$$
For given 128-bit values $A, B$ we want to find a chain of suitable 128-bit keys $k_1$ to $k_i$.
The total length $i$ is undetermined. Every valid key ...
CommunityBot
- 1
5
votes
2
answers
191
views
In a PGP like Application , would compress and encrypt leak information
would compress and encrypt on data comromise security for PGP like application, would it be secure for use in Encrypted Messaging?
I have heard its safe for data at rest encryption , i have heard ...
- 134k
1
vote
1
answer
198
views
Chosen-plaintext attact on AES with MixColumns omitted
Jean-Philippe Aumasson' "Serious Cryptography" says: "Without MixColumns, changes in a byte would not affect any other
bytes of the state. A chosen-plaintext attacker could then decrypt ...
- 432
30
votes
4
answers
23k
views
How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?
If cryptanalysts today were to crack the original Enigma machine, “how fast” or “how easily” could they do it? What methods would they use?
The original cracking was significantly helped by operator ...
- 1,098
4
votes
1
answer
154
views
A modern rotor machine, could it be any safe?
I wonder if a rotor machine similar to enigma can be considered secure by today's standards under four conditions:
A rotor machine which consists of 50 rotors picked out of a set of 100.
A rotor ...
