Questions tagged [cryptanalysis]
Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).
313
questions
76
votes
3
answers
85k
views
How does one attack a two-time pad (i.e. one time pad with key reuse)?
My question might appear the same as the question Taking advantage of one-time pad key reuse?, but actually I did read all the answers and none of them helped me with the details I need.
I am new to ...
- 963
118
votes
7
answers
115k
views
Taking advantage of one-time pad key reuse?
Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel. Alice and Bob have a shared key $k$; however, both messages are the same length as the ...
- 1,641
54
votes
6
answers
11k
views
Kerckhoffs’ principles – Why should I make my cipher public?
As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that
A cryptosystem should be secure ...
- 2,548
28
votes
2
answers
21k
views
Which attacks are possible against raw/textbook RSA?
The PKCS#1 standard defines multiple padding schemes for signature generation/verification (EMSA-PSS and EMSA-PKCS1-v1_5), and encryption/decryption (EME-OAEP and the less safe EME-PKCS1-v1_5).
Which ...
60
votes
3
answers
54k
views
Definition of textbook RSA
What is the definition of textbook or "raw" RSA?
What are some of the properties of textbook RSA?
How does it differ from other schemes based on RSA?
- 1,933
47
votes
4
answers
32k
views
Security strength of RSA in relation with the modulus size
NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits:
...
33
votes
3
answers
14k
views
Is 80 bits of key size considered safe against brute force attacks?
I came across the KATAN family of ciphers for small domain input blocks. They cipher arbitrary block lengths: 32, 48 and 64, but their key size is 80 bits only.
Is 80 bits of key size considered ...
- 6,094
25
votes
4
answers
5k
views
Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?
Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
- 134k
18
votes
1
answer
6k
views
How does the "biased-$k$ attack" on (EC)DSA work?
I recently stumbled across Thomas Pornin's old answer about deterministic (EC)DSA again. There he states the following:
Note that $k$ must be generated uniformly in the $[1, q-1]$ range
(where $q$...
- 45.5k
16
votes
1
answer
4k
views
Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?
I am considering attacks on Two-Key Triple-DES Encryption assuming $2^{32}$ known plaintext/ciphertext pairs (that's a mere 32GiB of ciphertext) by the method devised by Paul C. van Oorschot and ...
- 134k
34
votes
3
answers
98k
views
Possible ways to crack simple hand ciphers?
We had a quiz in class today where we had to break the ciphertext with the key given, but not the algorithm. Suffice to say that I wasn't able to decrypt it within the allotted time of 12 mins and ...
- 647
4
votes
2
answers
2k
views
Mathematical formula for switching the key for OTP?
Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? The new key must be as random and ...
- 89
125
votes
7
answers
218k
views
Are there two known strings which have the same MD5 hash value?
Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?
Adban
33
votes
3
answers
8k
views
How practical are side-channel attacks and how much of a concern are they?
I see a lot of research in very sophisticated side-channel attacks on crypto systems. Most (but definitely not all) seem to follow a trend, namely, the crypto system does something very dumb like ...
- 38.3k
33
votes
5
answers
16k
views
Any practical uses of machine learning for cryptography?
I am about to go study for my masters in machine learning, data mining and high performance computing, but have recently become very interested in cryptography after taking Dan Boneh's Cryptography ...
- 870
13
votes
3
answers
26k
views
Deciphering the RSA encrypted message from three different public keys
I have three different 1024-bit public keys with common exponent $e$ but different moduli. A message $m$ is encrypted (without padding) using the three keys, which results in three different encrypted ...
- 133
9
votes
1
answer
422
views
Is it possible to generate backdoored DH parameters?
I know it has been already asked and answered whether it's possible to generate weak DH parameters.
But "recentely" we experienced the Logjam attack, which makes use of the pre-computation ...
- 45.5k
54
votes
10
answers
14k
views
Now that quantum computers have been out for a while, has RSA been cracked?
D-wave systems has released a commercially viable quantum computer. This means in theory, that all asymmetric encryption algorithms — such as RSA — are now useless due to the speed at which quantum ...
- 961
34
votes
2
answers
5k
views
What are recommended, general strategies to start block-cipher design and/or analysis?
I (and many others for that matter) have always been fascinated by the inner workings of the modern building block of cryptography: block ciphers.
Now, the ressources on the "black art" of design and ...
- 45.5k
30
votes
9
answers
35k
views
RSA with small exponents?
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
- 1,641
20
votes
3
answers
6k
views
Can I use a one time pad key twice with random plaintext?
I understand the basics of OTP: $|\text{key space}| = |\text{plaintext space}|$ implies perfect security, key reuse destroys this.
Cryptanalysis on the $N$-Time Pad for $N > 1$ involves finding ...
- 353
15
votes
1
answer
5k
views
Why is double encryption that's equivalent to single encryption no better than single encryption?
In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about DES algorithm the authors say that:
"if a cryptosystem is such that double encryption is ...
- 451
10
votes
2
answers
3k
views
Calculation of the avalanche effect coefficient
Given a strict avalanche criterion matrix/dependence matrix for a hash function,how do I calculate the avalanche coefficient for it. I want to calculate a single parameter(value) which represents the ...
- 221
7
votes
3
answers
3k
views
A simple block cipher based on the SHA-256 hash function [duplicate]
I've come up with this little routine for doing encryption using the SHA-2 (in this case SHA-256) hash function. As such it is a block cipher with a 256 bit (32 byte) block size and an arbitrary key ...
user1449
103
votes
2
answers
20k
views
What is the new attack on SHA-1 "SHAttered" and how does it work?
There's a new recent Attack on SHA-1 named "SHAttered" by Google and some researchers. I understand that it uses some fancy new techniques, but not the details.
My question is: How?
How does the ...
- 45.5k
31
votes
2
answers
50k
views
How much computing resource is required to brute-force RSA?
It's been over 30 years since Rivest, Shamir and Adleman first publicly described their algorithm for public-key cryptography; and the intelligence community is thought to have known about it for ...
- 497
20
votes
4
answers
5k
views
Is compressing data prior to encryption necessary to reduce plaintext redundancy?
As explained in William Stallings' Book, in PGP encryption is done after compression, since it reduces redundancy.
I couldn't relate encryption strength with redundancy. Could anyone explain more on ...
- 1,883
18
votes
1
answer
2k
views
What does a "real" quantum computer need for cryptanalysis and/or cryptographic attack purposes?
The cryptographic world has been buzzing the word "quantum" for a while now (even the NSA is currently preparing itself for a post-quantum crypto world) and quantum-related hardware engineering is ...
- 17.7k
15
votes
2
answers
15k
views
Predicting values from a Linear Congruential Generator
I have learnt that Linear Congruential Random Number Generators are not cryptographically secure - my understanding is that given an LCG of the form:
...
- 253
10
votes
5
answers
3k
views
How to prove the security of the PRNG?
Are there any realties tests or criterias that prove the security of the PRNG?
What kind of tests or criteria?
- 551
7
votes
1
answer
2k
views
Solving Vigenère Encryption
I'm trying to crack a cypher that I believe is Vigenère encrypted and I'm currently stuck.
I calculated the key length by finding repeated sequences in the cypher and calculating the the common ...
5
votes
1
answer
3k
views
Decrypting Ciphertext with partial Key Fragment using LFSR and Berlekamp-Massey
Edit
Does the state register (the LFSR) always have to remain with 16 bits (I'm assuming yes).
If so, are we shifting the register right by one (lfsr>>1) ...
- 53
8
votes
2
answers
5k
views
DES — Can I recover the key when I have both ciphertext and the plaintext?
Given a message and DES encrypted form of said message, is it possible to efficiently compute the key used to encrypt the data?
- 183
90
votes
5
answers
40k
views
Is AES-256 weaker than 192 and 128 bit versions?
From a paper via Schneier on Security's Another AES Attack (emphasis mine):
In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. However, ...
- 1,011
29
votes
4
answers
27k
views
Recommended skills for a job in cryptology [closed]
First let me apologize if this is an ill posed question. Let me also note that I do not in any way seek a comprehensive answer, simply your thoughts on what makes for a valuable asset to a company ...
- 419
28
votes
2
answers
40k
views
How does a chosen plaintext attack on RSA work?
How can one run a chosen plaintext attack on RSA?
If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
user1829
15
votes
2
answers
7k
views
Cycle attack on RSA
I originally posted this question in the mathematics section, you can see it here.
Let $p$ and $q$ be large primes, $n=pq$ and $e : 0<e<\phi(n), \space gcd(e, \phi(n))=1$ the public encyption ...
- 253
14
votes
2
answers
5k
views
Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?
We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as:
$s=\frac{H(m)+xr}{k}$
Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
- 2,256
11
votes
2
answers
3k
views
How many trials does it take to break HMAC-MD5?
I know that you can find collision in MD5 with $2^{64}$ trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I quantify this security? My question ...
- 213
8
votes
2
answers
3k
views
How does compression before encryption leak info about the input?
Apparently current best practices recommend that you do not compress before you encrypt.
For example in this blog entry (*):
http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/
It ...
- 445
7
votes
2
answers
7k
views
How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
Given a CBC ciphertext and IV, how can I find the encryption key?
We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = 2^{...
antisane
2
votes
1
answer
349
views
Any theory about period length for AES applied to itself?
For example AES-128 starting with a 128-bit message $m_0$ and static 128 key $k$
$AES128(m_0,k)\rightarrow c_0$
$c_0\rightarrow m_1$
$AES128(m_1,k)\rightarrow c_1$
$c_1\rightarrow m_2$
...
continue ...
- 557
46
votes
1
answer
7k
views
What is a "freestart collision"?
In their work on SHA-1 collisions (cf. the EUROCRYPT-2016 paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ...
- 31.9k
45
votes
7
answers
11k
views
How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world.
How can we reason about the symmetric ciphers cryptanalysis ...
- 703
26
votes
2
answers
9k
views
How does the MOV attack work?
What exactly is the MOV attack, how does it actually work, and what is it used for?
It's explained briefly here and I'd like to know what it is more / what is it fully used for.
- 699
17
votes
2
answers
29k
views
Can you explain “weak keys” for DES?
A weak key for DES is a key $K$ such that $DES_{k_1}(DES_{k_2}(x))=x$ for all $x$.
I don't get why are the 4 keys $k_1||k_2$: $1^{112}$, $0^{112}$, $0^{56}||1^{56}$, $1^{56}||0^{56}$ considered as ...
- 2,100
15
votes
3
answers
1k
views
Can we ensure the security of a crypto-algorithm and -implementaton against acoustic cryptanalysis?
Like people always say: “Attacks only get worse…” — which is why I'm asking early.
I have been reading the paper “RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis” published December 18, ...
- 17.7k
7
votes
3
answers
6k
views
How to attack a classical cipher using known partial plaintext?
I have a ciphertext generated by a classical cipher. I do not know what was cipher used to generate it. I do however have the beginning of the plaintext.
What are the cryptanalysis approaches for ...
- 71
6
votes
1
answer
11k
views
How to determine the next number from java's Random method [closed]
I understand a little how Java's Random class works.
I have two random numbers output from calls to nextInt() from a ...
- 163
4
votes
2
answers
14k
views
How to get the keyword from a keyword cipher?
I was given a ciphertext and now I am trying to break it via looking for the keyword.
This is a keyword cipher. So:
PlainEnglish: ABCDEFGHIJKLMNOPQRSTUVWXYZ
If ...
- 43