Questions tagged [cryptanalysis]
Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).
228
questions with no upvoted or accepted answers
14
votes
0
answers
220
views
Space complexity of quantum collision search?
Is there a known way to reduce the space complexity of quantum collision search (PDF) beyond what is offered by the built-in time-space tradeoff, while keeping the time complexity significantly below ...
user991
10
votes
0
answers
198
views
Do CCM and EAX provide key commitment?
In an interesting paper called "Partitioning Oracle Attacks" by Julia Len, Paul Grubbs & Thomas Ristenpart an attack is presented on 1.5 pass AEAD schemes that utilize GMAC (GCM, AES-GCM,...
- 91.7k
10
votes
0
answers
305
views
Do trinomials weaken the Alternating Step Generator?
The Alternating Step Generator was proposed by Christoph G. Günther: Alternating step generators controlled by de Bruijn sequences, in proceedings of Eurocrypt 1987. It's perhaps the conceptually ...
- 138k
9
votes
0
answers
2k
views
Comparison of SNARK-friendly hash algorithms MiMC7, Poseidon, Pederson?
There are some cryptographically secure hash algorithms designed to be efficient for SNARKs, STARKs and FHE. Some of them already implemented in Zcash, Zokrates and circom. The ones that I know of are:...
- 951
7
votes
0
answers
140
views
FPE current state of art for "small" domains
Is there any survey with the state of art treatment of format-preserving encryption for small domains (i.e. 2^20 for example)? I believe that Stalling's and Rogaway's surveys are out of date due to ...
- 589
7
votes
0
answers
148
views
List of security protocols that have been proved to have bugs using formal methods
I'm looking for articles about finding bugs in security protocols using formal methods so I can test them using tools like ProVerif.
I've searched a lot of references, but most of them seem to be ...
- 171
7
votes
1
answer
447
views
Which is the smallest safe elliptic curve (bit-length)?
At https://safecurves.cr.yp.to/ some elliptic curves are listed which passed certain security tests. The smallest bit-length of a safe curve listed there is 221 bits.
At wiki page discrete logarithm ...
- 573
6
votes
0
answers
125
views
About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?
Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$
with
$$p=(p_1, p_2)$$
$$q=(q_1,q_2)$$
$$p_1,q_1 \in [0,s)$$
$$p_2,q_2 \in [0,s^2)$$
We want to find a path in between ...
- 573
6
votes
0
answers
294
views
Index calculus over elliptic curve over function field
According to my understanding there are some pretty solid seeming roadblocks to carrying out an index calculus on an elliptic curve over a finite field. The general strategy is to take points over $E(\...
- 111
6
votes
0
answers
810
views
Is this PRG secure?
$G$ is a secure PRG in range $\{0,1\}^n\rightarrow\{0,1\}^{n+1}$.
Let us define $G'(S)=G(S\oplus G(S)_{1,...,n})$, s.t. $G(S)_{1,...,n}$ is the first n bits of $G(S)$.
Is $G'(S)$ a secure PRG?
...
- 365
6
votes
0
answers
343
views
Statistical saturation attack on block ciphers
I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack
against the Block Cipher ...
- 81
5
votes
0
answers
581
views
How the mimc bug from circomlib was safely exploited to fake the merkle root in the witness in practice?
Several years ago, there was an unenforced constraint on verification in the cirmcomlib library : a tool for building projects using ZsNarks. The error allowed to forge cryptographic nullifiers/proofs ...
- 153
5
votes
0
answers
146
views
Resistance to integral attacks by North Korean block cipher Jipsam1
The cipher is a modification to AES and is described on this website:
The only difference between Jipsam1 and AES-256 is the S-box. Whereas in AES the S-box is public and constant, namely
$$
\begin{...
- 15.1k
5
votes
0
answers
196
views
Privacy of Multiplication of Shamir Shared Secrets with an Active Adversary Where Final Result is Revealed to a Third Party Over a Secure Channel
I have the following question related to the privacy of multiplication of Shamir Shared Secrets:
Suppose we have two secrets, a and b, shared by a Shamir Secret Sharing Scheme in a (k,n) ...
5
votes
0
answers
123
views
search of patterns in key schedules
I am developing a new key schedule, and there is this article (Enhanced Key Expansion for AES-256 by Using Even-Odd Method) where the authors also propose a new algorithm and one of the objectives is ...
- 281
4
votes
0
answers
54
views
Where did the number of initial plaintexts required for impossible cryptanalysis on Mini-AES came from?
I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference.
But I don't ...
- 191
4
votes
0
answers
228
views
Breaking RC5 without rotations
I'm trying to follow Schneier's self-study course in cryptanalysis and am ashamed to say I am stuck on the very first problem of breaking 8-round RC5 without any rotations (i.e. just XOR and modular ...
- 91
4
votes
0
answers
78
views
Help with cryptanalysis of branching in schemes based on Multivariate Public Key Cryptography
I'm familiarized with the structure of branching found in Multivariate Cryptography, as it allows us to partition a $n$-tuple over $F_{q}$ into a $k$-tuple where the $i$-th element is in $F_{q^{\...
- 898
4
votes
0
answers
234
views
Solving not so much overdetermined system of multivariate polynomial equations
I'm studying algorithms solving multivariate equations. I'm stuck in solving overdetermined set of quadratic equations. Concretely, with the number $n$ of variables, the number of equations is $m=\...
- 173
4
votes
0
answers
131
views
What is the probability equation of rotational cryptanalysis on modulo multiplication?
The answer in this question defined how to calculate the probability of rotational cryptanalysis on modulo multiplication $\odot$. This paper defined an algebraic equation of how to calculate the ...
- 2,074
4
votes
0
answers
351
views
Encrypt using ECDH with two different EC public keys, minimizing payload size
Let's say Alice has the private EC keys $a$ and $b$, with a base point of prime order $G$. Alice computes the corresponding public keys $A = aG$ and $B = bG$, and sends them to Bob.
Bob now wants to ...
- 141
4
votes
0
answers
163
views
AES-256 9 round related key attack - getting possible state differences
I'm trying to implement related key attack on 9 round AES256, described here:
Biryukov, Dunkelman, Keller, Khovratovich, Shamir, but I am stuck at the very beginning with Observation A, used to ...
- 41
4
votes
0
answers
204
views
Differential Path Search of a Block Cipher
Camellia Design and Analysis document refers to a paper:
[24] M. Matsui, "Differential Path Search of the Block
Cipher E2," (in Japanese), Technical report of IE-
ICE, ISEC99-19, pp.57-64, The ...
- 2,397
4
votes
0
answers
300
views
How to modify the Socialist Millionaire Protocol to be symmetric.
In the Socialist Millionaire Protocol, the roles of Alice and Bob are almost symmetric. By this I mean they do almost the same thing, until the very last step.
In the final step, both parties check a ...
- 151
4
votes
0
answers
146
views
How to overcome issues with big ciphers? E.g. with small vs. big Vigenére Ciphers
I understand that bigger ciphers show more recurring patterns and therefore should be easier (or at least faster) to decrypt as you'll have a better statistical analysis, being
However, if we use an ...
- 93
4
votes
0
answers
172
views
Using machine-learning techniques for data-dependent operations in ciphers
From 'Methods of Symmetric Cryptanalysis' by Dmitry Khovratovich,
The data-dependent operations are one of the most controversial design concepts. We say that an operation is data-dependent, if it ...
- 469
4
votes
0
answers
603
views
Using the same private key for two ECC key pairs
Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private ...
- 41
4
votes
0
answers
222
views
Security of stream cipher based on Matrix multiplication GF(256) with randomized padding
The actual question is stated at the end of the text. Suppose you have a (grossly inefficient) confidentiality stream cipher with the following components:
The keyed function $F_k:\{0,1\}^{8n}\mapsto\...
- 10.4k
3
votes
0
answers
109
views
Are there "light" versions of cryptographic hash functions?
After tinkering with cryptographic hash functions, I started wondering if they do have counterpart functions that would imitate their cryptographic properties but with a lower level of strength in ...
- 153
3
votes
0
answers
131
views
Cryptanalysis of ARX Ciphers
Rotational Cryptanalysis of ARX show that rotational probability of an ARX primitive can be computed by $p^q$ where $p$ is rotational probability of modular addition and $q$ is number of modular ...
- 2,397
3
votes
0
answers
94
views
Why is WalnutDSA specified for COSE?
WalnutDSA was a 1st-round entrant in the NIST Post-Quantum Cryptography project. It had a significant cryptanalytic break close to almost breaking the security of the cryptosystem, only survived due ...
- 9,001
3
votes
0
answers
610
views
Identifying correct cipher
I am trying to decrypt a text(~900 characters) and I started with the assumption that its a Vigenère cipher as the one of the identifier tool identified it as Vigenère cipher and also the Index of ...
- 33
3
votes
0
answers
259
views
Understanding Linear Cryptanalysis
I'm reading about the linear cryptanalysis of an SPN and I have some questions about the practicality of this. The example I'm looking at is from 3.3.3 of Stinson's Book and I believe the same example ...
- 141
3
votes
0
answers
180
views
Solving LPN using algorithm for syndrome decoding
Given an algorithm $A_D$ which solves an instance of the decoding problem $e \in \mathbb{F}_2^n$ in time $T_D$ given a parity check matrix $H \in \mathbb{F}_2^{(n-k)\times n}$ and a syndrome $s \in \...
- 31
3
votes
0
answers
59
views
Finding maximal $n$-affine subset
We obtained $l$ vectors $B_i$ of $c$ bits $b_{i,j}$. These are an altered form of vectors $A_i$ where the last $n$ bits of each $A_i$ are an affine function of the other bits of that $A_i$.
We want ...
- 138k
3
votes
0
answers
151
views
Old French Cipher w/ Text Hidden In Drawing
I'm trying to find a cipher challenge I saw a few years back, it was an old drawing (I think 1800's or earlier) with clouds and stars on it and French text was hidden in the image.
Does anyone happen ...
- 31
3
votes
0
answers
85
views
OAEP Cryptanalysis with broken hash
Keeping OAEP Cryptanalysis in mind, about the inability to get to $M_1$ or $M_2$ given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$.
Would it be possible to get to $M_1$ or $M_2$, given ...
- 199
3
votes
1
answer
672
views
Cracking a key using a combination of partial keys
As part of a cryptanalytic attack I've carried out, I used a divide-and-conquer strategy to divide the secret key $k$ into several equal-sized partial keys $k = {k_1, k_2, ...}$.
The attack works ...
- 39
3
votes
0
answers
293
views
Breaking an addition-based cipher with two ciphertexts but no known plaintext
I'm attempting to break a system which uses decryption code functionally equivalent to the following:
...
- 3,527
3
votes
0
answers
243
views
In NTRU, if $N$ is not prime, prove that one can recover the private key by solving a lattice problem in dimension lower than $2N$
In the NTRU cryptosystem, it is suggested to take $N$ prime.
I want to understand why.
In Jeffrey Hoffstein, Jill Pipher and H. Silverman An Introduction to Mathematical Cryptography, they suggest (...
- 325
3
votes
0
answers
249
views
Are analog quantum computers a threat to RSA and DLP?
We already know that D-WAVE's "quantum computers" can't really run the Shor's algorithm, because the way they're built doesn't qualify them as universal quantum computers.
Now researchers actually ...
- 45.7k
3
votes
0
answers
86
views
On a proposition in NTRU original paper: $\gamma_1 |f|_2 |g|_2 \leq |f \circledast g|_\infty \leq \gamma_2 |f|_2 |g|_2$
In the original paper of NTRU cryptosystem, we have the following proposition (that is said to be suggested by Don Coppersmith):
For any $\epsilon > 0$, there are constants $\gamma_1,\gamma_2 &...
- 325
3
votes
0
answers
686
views
Is there any analysis of freebsd's "geli" encrypted geometry provider?
I've done a few obvious searches on google and google scholar and not turned up any security analysis of FreeBSD's geli. Is there some out there, or has it gone unanalyzed since its introduction ...
- 131
2
votes
0
answers
31
views
Cryptanalytic attacks ASCON MAC
I am researching ASCON. I can find cryptanalytic attacks ASCON authenticated encryption and ASCON HASH, But I am not finding anything ASCON MAC. Anyone knows of any attacks, any research on this?
- 121
2
votes
0
answers
79
views
Source of encryption scheme used in blockchain based IoT
I've found the following encryption scheme
UserA: $$sk_A, pk_A = sk_A \cdot G$$
UserB: $$sk_B, pk_B = sk_B \cdot G$$
Enc: UserA
$$u \in \mathbb{Z}_q^* \\
Y = u \cdot pk_B \\
S = H(U) \oplus m \\
C = (...
2
votes
1
answer
304
views
Disclosure of Catastrophic Cryptanalytic Breakthroughs
An efficient algorithm for factoring would be a major mathematical achievement giving the person who discovered it anstant fame. About two years ago, C. P. Schnorr claimed such a breakthrough but it ...
- 21.2k
2
votes
0
answers
36
views
How many ciphertexts should attacker intercepts if he only knows the first 3 bytes of plaintext of each one?
Consider a system in which DES is used to encrypt messages in which the first three plaintext Bytes are known by the attacker. How many encrypted messages is it necessary to intercept in order to be ...
- 139
2
votes
0
answers
46
views
Exploit 3DES-CBC with known checksum of plaintext and repeated IV
I came across the following enterprise encryption scheme. I laughed when I first saw it, but I'm not a specialist and I'd like to know how bad it really is.
3DES-CBC
k1=k2=k3 for 3DES
IV for CBC is ...
- 121
2
votes
1
answer
268
views
Attack on the chosen plain-text RSA
Reading another user's question, a doubt came to me.
Suppose an RSA oracle exists, with which it is possible to interact to encrypt and decrypt some text. The oracle output is not the decrypted text ...
- 33
2
votes
0
answers
23
views
Product Cipher with Two Autokey Cipher
I have a cypher text with I know encrypted two times with Autokey Cipher with same lengths of keys. I am following the statistical cryptanalysis in here when it is ciphered with one time with Autokey ...
- 21