Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

Filter by
Sorted by
Tagged with
1 vote
0 answers
62 views

Doing a chosen ciphertext attack against an unknown cipher

I am trying to attack an unknown cipher. I can do a chosen ciphertext attack on a file that is encrypted with this cipher. I changed 8 bytes of the encrypted input file at the offset 0x000308c0, the ...
  • 11
1 vote
2 answers
60 views

Rule 30 based block cipher

So I went ahead an wrote this little program. What it does is it takes a password for a seed and generates a (pseudo-random) bit-pattern using rule 30 from cellular automata. It then XORs our input ...
1 vote
2 answers
451 views

Stuck on a cryptanalytical research project [closed]

This is not a technical question, but rather it seeks advice on what to do if cryptanalytical research goes wrong. I've discovered a new attack that works great in theory, but in practice, it fails. I ...
  • 11
0 votes
0 answers
201 views

RSA : Is there a way to compute phi(n) or N itself if we only know e, d and a ciphertext?

I am trying to solve a problem where private key exponent d, ciphertext c, and public key exponent e (65537) are known. How can I calculate φ(n) or n itself? An extended version of the problem would ...
  • 13
2 votes
1 answer
89 views

Confusion+Diffusion comparison table? (e.g. with Avalanche Criterion / SAC)

I'm looking for a general comparison of encryption algorithms in regard to Confusion and Diffusion (as defined by Claude Shannon), and if possible, specifically for their SAC and BIC quality. For ...
  • 143
4 votes
0 answers
51 views

Where did the number of initial plaintexts required for impossible cryptanalysis on Mini-AES came from?

I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference. But I don't ...
  • 191
0 votes
1 answer
47 views

Differential trails in differential cryptanalysis

From section 4.4 of this book https://www.ic.unicamp.br/~rdahab/cursos/mo421-mc889/Welcome_files/Stinson-Paterson_CryptographyTheoryAndPractice-CRC%20Press%20%282019%29.pdf I'm confused on how the ...
2 votes
0 answers
24 views

how to build the plaintext structure for impossible differential cryptanaysis on IDEA?

I'm trying to implement impossible differential cryptanalysis on 3.5 round IDEA using Miss in the Middle Attack on IDEA and Khufu paper as a reference and I'm stuck on the first two steps of the ...
  • 191
0 votes
1 answer
44 views

Calculate the key of a Hill-cipher using known plain- and ciphertext

I know I should calculate the multiple inverse of plaintext with ciphertext $\pmod {26}$. However, the problem I have is that the plaintext is a $3 \times 4$ matrix which is not square, so how would I ...
1 vote
1 answer
65 views

Size of nonlinear filter sequence to recover LFSR feedback polynomial

Let's suppose that there is a filter generator which based on $n$-size LFSR. Denote a feedback polynomial as $g(x_1, x_2, \dots, x_n)$ and nonlinear filter function as $f(x_1, x_2, \dots, x_n)$. Let $...
0 votes
1 answer
92 views

How does AES-CBC encryption achieve non-repeating blocks of ciphertext?

I am very interested in encryption algorithms, especially AES encryption algorithm in symmetric encryption. To this end, I have studied a lot of theoretical knowledge about AES encryption algorithm ...
2 votes
1 answer
59 views

Conceal time-based GUIDs with an affine-cipher?

I'd like to create a custom type of sortable GUID by concatenating an 8-byte nanosecond timestamp, 6 random bytes, a 1-byte node number, and a 1-byte counter. But, such a precise timestamp can be used ...
  • 53
1 vote
1 answer
178 views

Chosen-plaintext attact on AES with MixColumns omitted

Jean-Philippe Aumasson' "Serious Cryptography" says: "Without MixColumns, changes in a byte would not affect any other bytes of the state. A chosen-plaintext attacker could then decrypt ...
  • 11
5 votes
2 answers
188 views

In a PGP like Application , would compress and encrypt leak information

would compress and encrypt on data comromise security for PGP like application, would it be secure for use in Encrypted Messaging? I have heard its safe for data at rest encryption , i have heard ...
4 votes
1 answer
140 views

A modern rotor machine, could it be any safe?

I wonder if a rotor machine similar to enigma can be considered secure by today's standards under four conditions: A rotor machine which consists of 50 rotors picked out of a set of 100. A rotor ...
1 vote
1 answer
72 views

Significance of theoretical weaknesses?

What is the significance of theoretical weaknesses? Any real life incident where a theoretical weakness was ignored and later it compromised the system? Whats the dividing line between theoretical and ...
  • 2,313
1 vote
1 answer
105 views

What are the best known cryptanalytic attacks against AES-128 with 9 rounds?

What are the best known cryptanalytic attacks against AES-128 with 9 rounds? I found many such attacks on AES-192 and AES-256 with 9 rounds, but not for AES-128 with 9 rounds. Are there any ...
1 vote
0 answers
47 views

By using a block cipher multiple times in a row is a 128-bit BC as secure as a 256-bit BC which uses his 128-key only as part of the message?

For given 128-bit numbers $S$ and $E$ we want to find a series of keys $k_i$ with $$ E = BC(BC(BC(.....BC(S, k_1),k_2) ..k_n)$$ We can either use a 128-Bit blocksize block cipher similar to AES (ECB ...
  • 547
1 vote
1 answer
67 views

How does the security of AES change if we allow multiple uses in a row? How does it change if we limit the key space? And introduce a filter function?

$$f_0 = A$$ $$f_{n+1}=AES(f_n,k_n)$$ $$f_i = B$$ For given 128-bit values $A, B$ we want to find a chain of suitable 128-bit keys $k_1$ to $k_i$. The total length $i$ is undetermined. Every valid key ...
  • 547
3 votes
1 answer
116 views

Why is the best way to solve LWE (and Cryptographic related Systems) with SVP (approx)?

Community, I'm new into lattice based cryptography, and I'm interested about the security of cryptography schemata like Kyber and why the focus of solving this problem lead into solving approx. SVP. ...
1 vote
1 answer
220 views

Best attack estimates on AES

The wikipedia article on the Advanced Encryption Standard claims an attack against AES-128 with complexity $2^{126.1}$. The NIST call for proposals for post-quantum cryptography (table on page 18) ...
  • 825
0 votes
0 answers
52 views

Security proof of the Schnorr Signature

How Schnorr signature security can be proved for signature forgery, replacement, and Replay attacks?
  • 1
1 vote
0 answers
58 views

Non-uniform plaintext distribution -- AES attack

Are their any attacks on AES (any mode) in which before the attack is mounted, the adversary is aware that the input distribution is non-uniform? Most of the work assume that the plaintext is ...
2 votes
0 answers
88 views

Automated Security Protocol tool that models algebraic operations

Are there any automated security protocol verification tools that model algebraic operations; specifically addition. I am familiar with AVISPA and Verifpal, and they are both great and user-friendly ...
  • 157
1 vote
2 answers
52 views

How fast does revealing parity bits leak information?

I've got a scheme where I XOR a secret key value with a public (but random) value, XOR together all the bits of the result, and publish that bit (0 or 1), which is the parity of the result of the XOR. ...
  • 111
6 votes
0 answers
341 views

How the mimc bug from circomlib was safely exploited in practice?

Several years ago, there was an unenforced constraint on verification in the cirmcomlib library : a tool for building projects using ZsNarks. The error allowed to forge cryptographic nullifiers/proofs ...
2 votes
1 answer
116 views

How bad exactly are repetitions in the plaintext?

When the last n bytes of the plaintext are themselves suitably random, but predictably repeat m times in the same message - how bad is that? I'm convinced it is detrimental, but I am uncertain how ...
  • 143
1 vote
0 answers
51 views

RSA decryption problem knowing public key and ciphertext [closed]

new member here. I am taking a course in computer security, and we just got introduced in Cryptography and especially in RSA Algorithm. Although i got the 'basic idea' behind the RSA algorithm and the ...
2 votes
1 answer
159 views

Info AES cryptanalysis

I have some doubts regarding AES weakness and AES cryptanalysis. While it is relatively simple to find Cryptanalysis info on previous ciphers, I get confused about understanding various types of ...
  • 71
1 vote
1 answer
20 views

Statistical closeness of distributions and time-unbounded distinguisher

If two ensembles are statistically indistinguishable, we all know that they are also computationally indistinguishable, i.e., for any PPT algorithm, the probability to distinguish them is negligible. ...
-1 votes
2 answers
74 views

What is the standard checklist for designing a Key Derivation Function?

What kinds of properties does a KDF need to have in order to be considered secure? What steps should be taken during analysis to test for flaws? In particular, I mean a KDF that is going to be used as ...
2 votes
1 answer
115 views

How to solve this Baby Bleichenbacher Attack?

I am trying to solve this problem from https://toc.cryptobook.us/book.pdf. I am having trouble with this question : (Baby Bleichenbacher attack). Consider an RSA public key (n, e), where n is an RSA ...
0 votes
1 answer
76 views

How do I know the most efficient image encryption algorithm?

I am familiar with any algorithm that is based on the number of bits in a key (n-bit) and how to restore a key, such as the Discrete Logarithm Problem or Factorization.  When I use any algorithm for ...
  • 431
2 votes
1 answer
543 views

A probable attack for RSA (factorization): how to improve it?

A probable attack for RSA (factorization): how to improve it? $N=8*G+3$ can be factored if there is a non-trivial negative $k$ such that $\frac{(N*(9+24*k)-3)}{8}=-6*m^2 $ [to exclude the two trivial ...
2 votes
1 answer
157 views

Is it safe to initialize a random number generator with MD5?

The MD5 algorithm is no longer considered secure for most applications of a hash algorithm. However, is it safe to initialize a PRNG via a password? If it is not, how could it be exploited?
0 votes
0 answers
56 views

What kind of special numbers are not suitable as RSA keys?

I have read that some integers are not appropriate to be chosen as the modulus in an RSA cryptosystem. Some of these numbers are those that, given a modulus $n=pq$, then $p-1$ or $q-1$ do not have ...
0 votes
0 answers
38 views

How to compute $x_0$ in Chaotic Logistic map in special method?

I know that the Chaotic Logistic map is $x_{n+1}=Rx_n(1−x_n)$. I read some articles about the Chaotic Logistic Map, but some things are not clear. Someone wrote in his article the following: The ...
  • 431
0 votes
0 answers
86 views

Is Index Calculus Attack on hyperelliptic curves feasible with a common laptop?

I am studying this paper about an index calculus attack in hyperelliptic curves for genus $3, 4, 5, \dots, 9$. Nicolas Thériault, Index calculus attack for hyperelliptic curves of small genus, 2003. ...
1 vote
0 answers
53 views

Using multiple asymmetric keys as backups for one another

I've been thinking about ways to take advantage of multiple asymmetric encryption schemes so that each key could be a backup to the others in case of cryptanalysis of one given scheme. Those public ...
2 votes
0 answers
51 views

Is there a way of mitigating weak states in the Spritz stream cipher algorithm?

The Spritz stream cipher algorithm has been shown to have a special class of states that can be used to do a full state recovery attack better than brute force. While the authors of the paper clearly ...
2 votes
0 answers
79 views

Textbook RSA with $e=3$ and short random message

This is a simplified version of a question I made long ago, that never got an accepted answer. It's given $N$ of $n=2048$ bit, assumed hard to factor, which two prime factors each are $\equiv2\pmod3$, ...
  • 132k
2 votes
1 answer
211 views

Breaking RSA with P,Q LSB bits

Let's say we have a certain amount of LSB bits of P and Q and we want to fully reconstruct them given N=P*Q. I know this problem was studied in literature by Coppersmith and that Lattice methods are ...
  • 31
0 votes
0 answers
72 views

Provably secure and Practical ciphers

Are there any ciphers that are provably secure (reducable to a hard problem (including like factorization, not necessarily to NP-Complete or harder) ) are practical (not necessarily for too much ...
  • 41
0 votes
2 answers
72 views

Recovering original bit vectors that constituted XORed binary vectors

I am trying to unscramble received data packets. Each packet is divided into 3 parts ($A$, $B$ and $D$) with equal lengths. In every packet, each of these parts are scrambled/encrypted with an unknown ...
  • 109
1 vote
2 answers
166 views

LWE with a binary matrix A

In LWE, we know that given reasonable public parameter $A\in \mathbb{Z}_q^{n\times \lambda}$, secret $s\in \mathbb{Z}_q^{\lambda}$ and noise $e\in \mathcal{X}^{n}$, random $r\in \mathbb{Z}_q^{n}$, $(A,...
1 vote
1 answer
76 views

Do snapshots of Encrypted Disk Images weaken security?

I have read/write disk images encrypted with 128 AES using Mac's disk utility. If I snapshot the encrypted disk images daily (sometimes with changes other times without), and an attacker has access to ...
0 votes
0 answers
64 views

Problem with implementation of Enigma Machine

I'm having trouble making an implementation of Enigma Machine in VBA. My question is about implementing the rotors and their move. To be more precise, I will show below the way that I code my Enigma ...
0 votes
1 answer
242 views

Is Mersenne Twister hard to break if it has a reduced output?

I was reading this challenge, which proposes to clone (or recover) the internal state of the MT19937 just by applying the inverse process to each output (624 consecutively words). Mersenne Twister's ...
  • 1
4 votes
0 answers
119 views

About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?

Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$ with $$p=(p_1, p_2)$$ $$q=(q_1,q_2)$$ $$p_1,q_1 \in [0,s)$$ $$p_2,q_2 \in [0,s^2)$$ We want to find a path in between ...
  • 547
3 votes
1 answer
77 views

Why would the same cipher structure have a different optimal attack for different bit widths?

I'm going to use the Simon Cipher as an example, but I want to frame the question to be more general. Why would the same cipher structure have a different optimal attack for different bit widths? I ...
  • 4,504

1
2 3 4 5
30