Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

Filter by
Sorted by
Tagged with
15 votes
1 answer
1k views

Impact of Ryan and Heninger's CRYPTO 2023 paper on post quantum cryptosystems

From Schneier's blog, which seems to have been written in response to a somewhat recent Quanta magazine article: The winner of the Best Paper Award at CRYPTO this year (2023) was a significant ...
kodlu's user avatar
  • 21.9k
3 votes
2 answers
1k views

Can I change the radio frequency according to my encryption algorithm?

I know that information can be changed by changing the frequency of electromagnetic vibrations.My question is, can I change the frequency according to my encryption algorithm? That way I can get a ...
Hacer's user avatar
  • 31
0 votes
1 answer
60 views

Can HKDF be safely used as a round function in a Feistel Cipher

Hello my question is it practical to use HKD as a round function in a Feistel Cipher I know you should not roll your own crypto, this is for learning purpose's only. Take a look at my code and let me ...
dasein's user avatar
  • 3
2 votes
1 answer
86 views

Not understanding elliptic curve scalar multiplication to produce Ethereum address

This is the equation Public key = Private key * G Here, ...
Asif Iqbal's user avatar
-1 votes
1 answer
67 views

Given and encrypted message, is it theoretically possible to decrypt a message without the key or guessing it? If so, what methods could be used?

Decrypting an AES-Encrypted Message Without the Key: A Cryptographic Challenge Summary: I am investigating the possibility of decrypting an AES-encrypted message when the encryption key is unknown ...
NeoX's user avatar
  • 1
1 vote
2 answers
307 views

Is it faster to decrypt than to encrypt in all cryptography systems? [closed]

I am using a cryptography system in which the Feistel structure and permutation cipher are combined. I am amazed by the result; decryption is so much faster than encryption. My system is working ...
Dharmendra Thapa's user avatar
0 votes
0 answers
45 views

How to estimate the bias of linear cryptanalysis given the input and output masks

Assume the input linear mask is $a$, and output mask is $b$,for a block cipher $F$ with $r$ round,How to accurately and quickly estimate the bias of linear cryptanalysis? which is \begin{equation*} ...
HelloSpace's user avatar
1 vote
1 answer
105 views

Hard decisional problem on bilinear groups

Problem: Given $g, g^a, g^b, g^c \in G$ and an efficient bilinear map $e:G \times G \longrightarrow G_T$, distinguish $g^{abc}$ from a random element of $G$. Is it a hard problem?
Anna's user avatar
  • 11
0 votes
0 answers
134 views

Speed comparison of encryption algorithms

I am trying to compare various encryption algorithms in terms of encryption duration, decryption duration, information entropy, NPCR, UACI, and correlation coefficients. I used a Lena 256x256 ...
ysnky's user avatar
  • 1
3 votes
1 answer
107 views

Judgment of Results from NIST Randomness Testing

I am using the NIST suite to test the randomness of binary numbers and I have a 64KB dataset. I am confused with the results in finalAnalysisReport.txt. I have the ...
yuting zhang's user avatar
0 votes
0 answers
51 views

AES SBOX Masking in Python

I am trying to create an AES Sbox masking based on this paper. In the paper, they tried to mask the sbox described in this other paper. The inversion is been done in GF(4). I know that it is mostly ...
John's user avatar
  • 1
0 votes
0 answers
62 views

Differential cryptanalysis of modes of operation

It is not quite difficult to understand the idea of differential cryptanalysis applied to a standalone block cipher. The method investigates, how differences of plaintext evolve while going through ...
Georgy Firsov's user avatar
1 vote
0 answers
34 views

Dealing with MITM attack in e-voting systems

I've read many e-voting papers that use El-Gamal scheme which I recall is vulnerable to man-in-the-middle attack, yet I find no discussion or even mentioning of it in those papers. -Does anyone knows ...
ShAr's user avatar
  • 152
1 vote
0 answers
75 views

Which cipher is used in this UDP stream? [closed]

I'm trying to analyze a stream of communication I captured from a game. I know the keys but I don't know how to apply them. I've tried: Various AES-256 modes, splitting the message at different ...
Krab's user avatar
  • 111
3 votes
0 answers
73 views

Cryptanalytic attacks ASCON MAC

I am researching ASCON. I can find cryptanalytic attacks ASCON authenticated encryption and ASCON HASH, But I am not finding anything ASCON MAC. Anyone knows of any attacks, any research on this?
Nicole Foster's user avatar
2 votes
0 answers
91 views

Source of encryption scheme used in blockchain based IoT

I've found the following encryption scheme UserA: $$sk_A, pk_A = sk_A \cdot G$$ UserB: $$sk_B, pk_B = sk_B \cdot G$$ Enc: UserA $$u \in \mathbb{Z}_q^* \\ Y = u \cdot pk_B \\ S = H(U) \oplus m \\ C = (...
coolgirl Leon's user avatar
1 vote
0 answers
41 views

Cryptanalysis of S-box [closed]

Because of implementation constrains, I merge some 4-bit S-boxes to find a 8-bit S-box with good properties such as nonlinearity, resistance against differential and linear cryptanalysis. Does the ...
Vahid's user avatar
  • 11
2 votes
1 answer
118 views

Does combining a stream cipher and block cipher produce any vulnerabilities?

In particular, AES-CBC with Blake2b for HMAC combined with xChacha20-Poly1305. The scheme is to encrypt with xChacha20-poly1305 first, using a key derived from a high entropy password using argon2id ...
bismofunyuns's user avatar
0 votes
1 answer
99 views

How to evaluate the minimum complexity of the key recovery when the success probability p is given?

Since the practical security of a symmetric-key primitive is determined by evaluating its resistance against an almost exhaustive list of known cryptanalytic techniques. My problem is that could we ...
HelloSpace's user avatar
2 votes
1 answer
365 views

Disclosure of Catastrophic Cryptanalytic Breakthroughs

An efficient algorithm for factoring would be a major mathematical achievement giving the person who discovered it anstant fame. About two years ago, C. P. Schnorr claimed such a breakthrough but it ...
kodlu's user avatar
  • 21.9k
0 votes
1 answer
99 views

Does higher key sizes correspond to a higher security parameter?

If a system provide n bits of security, it is known that the best possible attack against the system would be 2^n (security parameter). However, why are the key sizes of some cryptosystems much larger ...
rin ichinose's user avatar
1 vote
1 answer
100 views

Construction of Blake2 and Cha Cha

Recently, I was reading about Blake2B and its properties regarding randomness and security, and its connection to Daniel Bernstein's CHA CHA digest. As a budding cryptographer, I find it doable to ...
Neev Penkar's user avatar
1 vote
1 answer
142 views

Double- and -add algorithm

I am currently doing the elliptic curves and I'm stuck for 8 hours without finding solutions. I under stand the process of double and add but don't know how to obtain 5 * 8P = 4OP =11 P. 11 P was in ...
Stefan's user avatar
  • 11
2 votes
1 answer
68 views

n-bit addition over $GF(2^n)$ vs. addition modulo $2^n$

I am currently studying the cryptanalysis of Speck, but I am feeling confused about the addition in Speck. I am not sure whether the addition in Speck is done through n-bit addition over $GF(2^n)$ or ...
35 honglang's user avatar
0 votes
0 answers
29 views

Writing a specific position of AES state in a specific round in terms of Key bytes

Suppose we manipulate the zeroth byte of AES state after the 9th round ShiftRow operation and we want to see its effect on the ciphertext. The propagation of the error effect is demonstrated in the ...
Mohammadsadeq Borjiyan's user avatar
5 votes
11 answers
9k views

For Symmetric Cryptography, why is it considered more important to safeguard a key than the function/algorithm for encrypting/decrypting a message?

As stated for the question above here's an analogy: You are a robber looking for a house to rob with two different scenarios that might occur. 1. You have a key that you know belongs to a house and ...
omar7439's user avatar
0 votes
0 answers
50 views

Cryptanalyzing a hash compression function

I'm designing a hash function which uses a double-tree construction and a compression function $c(s,A,B,C,a)$ ($s$ and $a$ may be omitted when there's only one of them) where $s$ is a set of three ...
Pierre Abbat's user avatar
1 vote
0 answers
155 views

If G is a PRG, is G' necessarily a PRG?

Given: A function $$G: \{0,1\}^{3n} \to \{0,1\}^{6n}$$ which is known to be a secure Pseudorandom Generator (PRG). A derived function $$G'(x_1 \| x_2) = G_b(x_1\|0^n\|x_2), \text{ where } x_1, x_2 \...
Steven's user avatar
  • 11
0 votes
0 answers
33 views

Security Analysis: Adversary's Ability to Recover Concatenated and Hashed Secret with Partial String Knowledge

Suppose I have the following secret, calculated by concatenating and hashing the results of two random strings: secret = H( H( random_string1 ) || H( random_string2 ) ) Let's assume that the adversary ...
Kadir Korkmaz's user avatar
0 votes
0 answers
35 views

How by changing ciphertext can the attacker know the length of the padding in POODLE attack

I try to understand the POODLE attack. I read that the attacker try to change one byte of the last block of the ciphertext. Becasue the last block is only have padding and the last byte is the padding ...
eitan's user avatar
  • 31
1 vote
1 answer
72 views

DDT for boolean functions must contain only powers of two

I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
Alessio Proietti's user avatar
5 votes
1 answer
132 views

Cryptanalysis of the GOC

The GOC (Générateur d'Octets Chiffrants, Ciphering Byte Generator) is a PseudoRandom Generator that was used during the late 20th century for content encryption in pre-internet Videotex terminals, ...
fgrieu's user avatar
  • 140k
2 votes
1 answer
58 views

How to convert a Modular addition to conjunctive normal form (CNF)? [closed]

If I have three integers $x,y,z\in \mathbb{F}_{2^n}$, How do I convert the modulo addition operation into conjunctive normal form (CNF)? $$ (x+y)\pmod{2^n-1}=z $$
mini minions's user avatar
0 votes
2 answers
81 views

May specifying the position of swapfile help defeat LUKS encryption?

I need to enable hybernation to the LUKS-encrypted drive. My /boot partition is unencrypted hence it stores all kernel images as well as kernel parameters in unencrypted form. For hybernation to work ...
CurtisB's user avatar
3 votes
3 answers
300 views

How big of a threat are *diffusion model* based AIs to cryptographic systems?

The diffusion model, which is used by products like Midjourney and Dall-E, trains AI systems to de-noise (remove added randomness) from data to infer what the original de-noised data is. That would ...
aiootp's user avatar
  • 785
0 votes
1 answer
80 views

Finding out corrupted S Box value in DES implementation?

I am using DES encryption when writing a file in an embedded device. When I decrypt the file. I get a partially corrupted file. Kind of randomly some 8-byte blocks are corrupted. Some are not. When I ...
Monem Ahmed's user avatar
0 votes
1 answer
72 views

Safe implicit value validation: $H_k(k \oplus m) \sim H_k(m)$?

$H_k$ is a cryptographic hash function that's keyed using a section of key material $k$ (for whatever definition of "keyed" that's appropriate for the given hash function $H$). Are the ...
aiootp's user avatar
  • 785
0 votes
0 answers
19 views

Finding key using Mutual Index of coincidence / Mg from vigenere ciphertext [duplicate]

I'm new to cryptography and I was trying to find key to an intercepted vigenere ciphertext using ciphertext-only attack, I'm following book "cryptography and network security" by Forouzan. ...
Eternity's user avatar
0 votes
1 answer
48 views

Is there a way to short circuit (speed up) hashing a large but sparse array?

Imagine a large array (Megabytes) that is virtually empty, i.e. contains 0 in almost all locations. But also imagine there's 1000 pseudo random locations that contain a pseudo random byte. There is ...
Paul Uszak's user avatar
  • 15.3k
2 votes
1 answer
184 views

Can I predict CryptGenRandom on my own device?

I have a Windows 10 laptop with an algorithm that creates a random number using the PRNG CryptGenRandom. According to Wikipedia: Because CryptGenRandom is the de facto standard CSPRNG in Win32 ...
Riemann's user avatar
  • 221
2 votes
1 answer
94 views

Is hash function cryptanalysis the same or more difficult for iterated hashing, as H(H(H(H(H))))?

The effectiveness of hash function attacks is typically measured in $x$ broken rounds of $N$ total designed rounds. And some constructs containing iterated hash functions include proof of work schemes,...
Paul Uszak's user avatar
  • 15.3k
1 vote
2 answers
83 views

Given $i$ keyed-$PRP$ labels $\ell_{i,x}$ from a $2^{256} \times 2^{256}$ Sudoku (Latin-square), how difficult is it for an adversary to solve?

There's a keyed-permutation I'm playing with, $\ell_{i,x} = \pi_i(x_i)$, which is a bijection $X \leftrightarrow X$, where $|X| = 2^{256}$, and whose evaluations on plaintext inputs $x_i$ perfectly ...
aiootp's user avatar
  • 785
0 votes
0 answers
45 views

Is combining Elgamal algorithm and RSA algorithm for key generation and AES+RSA algorithm for encryption and decryption a novel approach?

Key generation: Key Generation Firstly, the RSA algorithm will be used to generate a public and a private key. Generate two random prime numbers p, q. Select RSA public key, P k such that gcd(P k, Φ)=...
Srity Ahmed's user avatar
1 vote
0 answers
76 views

Literature on (concrete) hardness of Short Integer Solution (SIS)

I am interested in what the state of the art results on the hardness of the Short Integer Solution (SIS) instances are. The one I am the most familiar with (and the most discussed) is to use lattice ...
Gareth Ma's user avatar
  • 350
0 votes
1 answer
147 views

Trouble detecting cyclic group order crossovers in SECP256K1

There's a problem in detecting whether the sum of public key addition has crossed the cyclic group order boundary For this example, think of public keys $Pub$ as private keys $Priv$, (private scalars),...
Maltoon Yezi's user avatar
1 vote
4 answers
183 views

Good references to breakable limits: $2^{60}$

Recently, I read here on Crypto SE that $2^{60}$ doesn't provide enough resistance to current adversaries. Could someone please provide me with good references related to that threshold, or any ...
oCriptoPanquer's user avatar
1 vote
0 answers
58 views

Misuse Attacks on Lattice Crypto

I've been reading "Misuse Attacks on Post-Quantum Cryptosystems" (https://eprint.iacr.org/2019/525). In what scenarios are the attacks described in the paper applicable? Is it specifically ...
Lev Knoblock's user avatar
0 votes
0 answers
49 views

Can I skip ahead with a quadratic congruential generator?

I have a congruential generator where $$ r_{n+1} = r_n^2 - c\;(mod\;p) $$ known $r_0$, $c$ and $p$ can i get $r_n$ without having to compute all the previous values?
Flame's user avatar
  • 1
4 votes
2 answers
122 views

How certain is it that a shorter password can't match the salted hash of a long one?

We (collectively) salt passwords, then hash them; maybe even run them through something like PBKDF2 first (depending on how the password will be used). The end result is that we have a string $p$ and ...
András Korn's user avatar
0 votes
1 answer
97 views

How much of SHA3's internal state can be reached?

After reading that about "37% of the 256-bit outputs" of SHA-256 are unreachable when fed only 256-bit inputs [1] I'm curious & confused. The formula from the proof here considers a ...
aiootp's user avatar
  • 785

1
2 3 4 5
31