Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

241 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
14 votes
0 answers
225 views

Space complexity of quantum collision search?

Is there a known way to reduce the space complexity of quantum collision search (PDF) beyond what is offered by the built-in time-space tradeoff, while keeping the time complexity significantly below ...
user avatar
10 votes
0 answers
213 views

Do CCM and EAX provide key commitment?

In an interesting paper called "Partitioning Oracle Attacks" by Julia Len, Paul Grubbs & Thomas Ristenpart an attack is presented on 1.5 pass AEAD schemes that utilize GMAC (GCM, AES-GCM,...
Maarten Bodewes's user avatar
10 votes
0 answers
314 views

Do trinomials weaken the Alternating Step Generator?

The Alternating Step Generator was proposed by Christoph G. Günther: Alternating step generators controlled by de Bruijn sequences, in proceedings of Eurocrypt 1987. It's perhaps the conceptually ...
fgrieu's user avatar
  • 142k
9 votes
0 answers
2k views

Comparison of SNARK-friendly hash algorithms MiMC7, Poseidon, Pederson?

There are some cryptographically secure hash algorithms designed to be efficient for SNARKs, STARKs and FHE. Some of them already implemented in Zcash, Zokrates and circom. The ones that I know of are:...
Habib's user avatar
  • 951
7 votes
0 answers
515 views

Which is the smallest safe elliptic curve (bit-length)?

At https://safecurves.cr.yp.to/ some elliptic curves are listed which passed certain security tests. The smallest bit-length of a safe curve listed there is 221 bits. At wiki page discrete logarithm ...
J. Doe's user avatar
  • 453
7 votes
0 answers
148 views

FPE current state of art for "small" domains

Is there any survey with the state of art treatment of format-preserving encryption for small domains (i.e. 2^20 for example)? I believe that Stalling's and Rogaway's surveys are out of date due to ...
Kirill Tsar.'s user avatar
7 votes
0 answers
156 views

List of security protocols that have been proved to have bugs using formal methods

I'm looking for articles about finding bugs in security protocols using formal methods so I can test them using tools like ProVerif. I've searched a lot of references, but most of them seem to be ...
Yashar's user avatar
  • 171
6 votes
0 answers
135 views

About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?

Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$ with $$p=(p_1, p_2)$$ $$q=(q_1,q_2)$$ $$p_1,q_1 \in [0,s)$$ $$p_2,q_2 \in [0,s^2)$$ We want to find a path in between ...
J. Doe's user avatar
  • 453
6 votes
0 answers
294 views

Index calculus over elliptic curve over function field

According to my understanding there are some pretty solid seeming roadblocks to carrying out an index calculus on an elliptic curve over a finite field. The general strategy is to take points over $E(\...
rondo9's user avatar
  • 111
6 votes
0 answers
830 views

Is this PRG secure?

$G$ is a secure PRG in range $\{0,1\}^n\rightarrow\{0,1\}^{n+1}$. Let us define $G'(S)=G(S\oplus G(S)_{1,...,n})$, s.t. $G(S)_{1,...,n}$ is the first n bits of $G(S)$. Is $G'(S)$ a secure PRG? ...
Jjang's user avatar
  • 365
6 votes
0 answers
344 views

Statistical saturation attack on block ciphers

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack against the Block Cipher ...
Slavi's user avatar
  • 81
5 votes
0 answers
609 views

How the mimc bug from circomlib was safely exploited to fake the merkle root in the witness in practice?

Several years ago, there was an unenforced constraint on verification in the cirmcomlib library : a tool for building projects using ZsNarks. The error allowed to forge cryptographic nullifiers/proofs ...
user2284570's user avatar
5 votes
0 answers
151 views

Resistance to integral attacks by North Korean block cipher Jipsam1

The cipher is a modification to AES and is described on this website: The only difference between Jipsam1 and AES-256 is the S-box. Whereas in AES the S-box is public and constant, namely $$ \begin{...
forest's user avatar
  • 15.3k
5 votes
0 answers
198 views

Privacy of Multiplication of Shamir Shared Secrets with an Active Adversary Where Final Result is Revealed to a Third Party Over a Secure Channel

I have the following question related to the privacy of multiplication of Shamir Shared Secrets: Suppose we have two secrets, a and b, shared by a Shamir Secret Sharing Scheme in a (k,n) ...
Gerrit van Wingerden's user avatar
5 votes
0 answers
123 views

search of patterns in key schedules

I am developing a new key schedule, and there is this article (Enhanced Key Expansion for AES-256 by Using Even-Odd Method) where the authors also propose a new algorithm and one of the objectives is ...
Yuri Waki's user avatar
  • 281
4 votes
0 answers
82 views

Cryptanalytic attacks ASCON MAC

I am researching ASCON. I can find cryptanalytic attacks ASCON authenticated encryption and ASCON HASH, But I am not finding anything ASCON MAC. Anyone knows of any attacks, any research on this?
Nicole Foster's user avatar
4 votes
0 answers
247 views

Breaking RC5 without rotations

I'm trying to follow Schneier's self-study course in cryptanalysis and am ashamed to say I am stuck on the very first problem of breaking 8-round RC5 without any rotations (i.e. just XOR and modular ...
Seawaves32's user avatar
4 votes
0 answers
79 views

Help with cryptanalysis of branching in schemes based on Multivariate Public Key Cryptography

I'm familiarized with the structure of branching found in Multivariate Cryptography, as it allows us to partition a $n$-tuple over $F_{q}$ into a $k$-tuple where the $i$-th element is in $F_{q^{\...
kub0x's user avatar
  • 898
4 votes
0 answers
247 views

Solving not so much overdetermined system of multivariate polynomial equations

I'm studying algorithms solving multivariate equations. I'm stuck in solving overdetermined set of quadratic equations. Concretely, with the number $n$ of variables, the number of equations is $m=\...
wooa0923's user avatar
  • 173
4 votes
0 answers
132 views

What is the probability equation of rotational cryptanalysis on modulo multiplication?

The answer in this question defined how to calculate the probability of rotational cryptanalysis on modulo multiplication $\odot$. This paper defined an algebraic equation of how to calculate the ...
hardyrama's user avatar
  • 2,126
4 votes
0 answers
353 views

Encrypt using ECDH with two different EC public keys, minimizing payload size

Let's say Alice has the private EC keys $a$ and $b$, with a base point of prime order $G$. Alice computes the corresponding public keys $A = aG$ and $B = bG$, and sends them to Bob. Bob now wants to ...
esneider's user avatar
  • 141
4 votes
0 answers
164 views

AES-256 9 round related key attack - getting possible state differences

I'm trying to implement related key attack on 9 round AES256, described here: Biryukov, Dunkelman, Keller, Khovratovich, Shamir, but I am stuck at the very beginning with Observation A, used to ...
Tlsfd's user avatar
  • 41
4 votes
0 answers
205 views

Differential Path Search of a Block Cipher

Camellia Design and Analysis document refers to a paper: [24] M. Matsui, "Differential Path Search of the Block Cipher E2," (in Japanese), Technical report of IE- ICE, ISEC99-19, pp.57-64, The ...
crypt's user avatar
  • 2,449
4 votes
0 answers
305 views

How to modify the Socialist Millionaire Protocol to be symmetric.

In the Socialist Millionaire Protocol, the roles of Alice and Bob are almost symmetric. By this I mean they do almost the same thing, until the very last step. In the final step, both parties check a ...
cowlicks's user avatar
  • 151
4 votes
0 answers
147 views

How to overcome issues with big ciphers? E.g. with small vs. big Vigenére Ciphers

I understand that bigger ciphers show more recurring patterns and therefore should be easier (or at least faster) to decrypt as you'll have a better statistical analysis, being However, if we use an ...
UsuallyNot's user avatar
4 votes
0 answers
172 views

Using machine-learning techniques for data-dependent operations in ciphers

From 'Methods of Symmetric Cryptanalysis' by Dmitry Khovratovich, The data-dependent operations are one of the most controversial design concepts. We say that an operation is data-dependent, if it ...
meta_warrior's user avatar
4 votes
0 answers
613 views

Using the same private key for two ECC key pairs

Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private ...
user12778's user avatar
4 votes
0 answers
225 views

Security of stream cipher based on Matrix multiplication GF(256) with randomized padding

The actual question is stated at the end of the text. Suppose you have a (grossly inefficient) confidentiality stream cipher with the following components: The keyed function $F_k:\{0,1\}^{8n}\mapsto\...
Henrick Hellström's user avatar
3 votes
0 answers
61 views

improved impossible differential crpytanalysis of 6-round rijndael

I'm studying the paper: "Improved Impossible Differential Cryptanalysis of Rijndael and Crypton". I've got two questions: Please explain the calculation performed for step 5? Step 4 ...
can balıkçı's user avatar
3 votes
0 answers
111 views

Are there "light" versions of cryptographic hash functions?

After tinkering with cryptographic hash functions, I started wondering if they do have counterpart functions that would imitate their cryptographic properties but with a lower level of strength in ...
Ryan B.'s user avatar
  • 153
3 votes
0 answers
152 views

Cryptanalysis of ARX Ciphers

Rotational Cryptanalysis of ARX show that rotational probability of an ARX primitive can be computed by $p^q$ where $p$ is rotational probability of modular addition and $q$ is number of modular ...
crypt's user avatar
  • 2,449
3 votes
0 answers
111 views

Why is WalnutDSA specified for COSE?

WalnutDSA was a 1st-round entrant in the NIST Post-Quantum Cryptography project. It had a significant cryptanalytic break close to almost breaking the security of the cryptosystem, only survived due ...
DannyNiu's user avatar
  • 9,409
3 votes
0 answers
627 views

Identifying correct cipher

I am trying to decrypt a text(~900 characters) and I started with the assumption that its a Vigenère cipher as the one of the identifier tool identified it as Vigenère cipher and also the Index of ...
solveapuzzle's user avatar
3 votes
0 answers
288 views

Understanding Linear Cryptanalysis

I'm reading about the linear cryptanalysis of an SPN and I have some questions about the practicality of this. The example I'm looking at is from 3.3.3 of Stinson's Book and I believe the same example ...
Rdrr's user avatar
  • 141
3 votes
0 answers
186 views

Solving LPN using algorithm for syndrome decoding

Given an algorithm $A_D$ which solves an instance of the decoding problem $e \in \mathbb{F}_2^n$ in time $T_D$ given a parity check matrix $H \in \mathbb{F}_2^{(n-k)\times n}$ and a syndrome $s \in \...
Pg1234's user avatar
  • 31
3 votes
0 answers
59 views

Finding maximal $n$-affine subset

We obtained $l$ vectors $B_i$ of $c$ bits $b_{i,j}$. These are an altered form of vectors $A_i$ where the last $n$ bits of each $A_i$ are an affine function of the other bits of that $A_i$. We want ...
fgrieu's user avatar
  • 142k
3 votes
0 answers
153 views

Old French Cipher w/ Text Hidden In Drawing

I'm trying to find a cipher challenge I saw a few years back, it was an old drawing (I think 1800's or earlier) with clouds and stars on it and French text was hidden in the image. Does anyone happen ...
Sam Kennedy's user avatar
3 votes
0 answers
87 views

OAEP Cryptanalysis with broken hash

Keeping OAEP Cryptanalysis in mind, about the inability to get to $M_1$ or $M_2$ given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$. Would it be possible to get to $M_1$ or $M_2$, given ...
Ruan Sunkel's user avatar
3 votes
1 answer
695 views

Cracking a key using a combination of partial keys

As part of a cryptanalytic attack I've carried out, I used a divide-and-conquer strategy to divide the secret key $k$ into several equal-sized partial keys $k = {k_1, k_2, ...}$. The attack works ...
Ricardo M.'s user avatar
3 votes
0 answers
295 views

Breaking an addition-based cipher with two ciphertexts but no known plaintext

I'm attempting to break a system which uses decryption code functionally equivalent to the following: ...
Polynomial's user avatar
  • 3,527
3 votes
0 answers
259 views

In NTRU, if $N$ is not prime, prove that one can recover the private key by solving a lattice problem in dimension lower than $2N$

In the NTRU cryptosystem, it is suggested to take $N$ prime. I want to understand why. In Jeffrey Hoffstein, Jill Pipher and H. Silverman An Introduction to Mathematical Cryptography, they suggest (...
Leafar's user avatar
  • 325
3 votes
0 answers
253 views

Are analog quantum computers a threat to RSA and DLP?

We already know that D-WAVE's "quantum computers" can't really run the Shor's algorithm, because the way they're built doesn't qualify them as universal quantum computers. Now researchers actually ...
SEJPM's user avatar
  • 46.1k
3 votes
0 answers
86 views

On a proposition in NTRU original paper: $\gamma_1 |f|_2 |g|_2 \leq |f \circledast g|_\infty \leq \gamma_2 |f|_2 |g|_2$

In the original paper of NTRU cryptosystem, we have the following proposition (that is said to be suggested by Don Coppersmith): For any $\epsilon > 0$, there are constants $\gamma_1,\gamma_2 &...
Leafar's user avatar
  • 325
3 votes
0 answers
692 views

Is there any analysis of freebsd's "geli" encrypted geometry provider?

I've done a few obvious searches on google and google scholar and not turned up any security analysis of FreeBSD's geli. Is there some out there, or has it gone unanalyzed since its introduction ...
Jeff Epler's user avatar
2 votes
0 answers
27 views

Can a differential attack on FEAL4 yield multiple valid keys?

For my version of this attack I used the FEAL4 version depicted here http://theamazingking.com/crypto-feal.php and in the book "Applied Cryptanalysis Breaking Ciphers in the Real World -- Mark ...
curious_cryptocopter's user avatar
2 votes
0 answers
91 views

Source of encryption scheme used in blockchain based IoT

I've found the following encryption scheme UserA: $$sk_A, pk_A = sk_A \cdot G$$ UserB: $$sk_B, pk_B = sk_B \cdot G$$ Enc: UserA $$u \in \mathbb{Z}_q^* \\ Y = u \cdot pk_B \\ S = H(U) \oplus m \\ C = (...
coolgirl Leon's user avatar
2 votes
0 answers
69 views

How many characters to do frequency analysis?

Is there any study that has looked into what is the minimum number of ciphertext characters one needs to have to do a reliable frequency analysis? It would be nice to know the evolution of the ...
lele's user avatar
  • 21
2 votes
0 answers
38 views

How many ciphertexts should attacker intercepts if he only knows the first 3 bytes of plaintext of each one?

Consider a system in which DES is used to encrypt messages in which the first three plaintext Bytes are known by the attacker. How many encrypted messages is it necessary to intercept in order to be ...
Allexj's user avatar
  • 143
2 votes
0 answers
88 views

Exploit 3DES-CBC with known checksum of plaintext and repeated IV

I came across the following enterprise encryption scheme. I laughed when I first saw it, but I'm not a specialist and I'd like to know how bad it really is. 3DES-CBC k1=k2=k3 for 3DES IV for CBC is ...
j123b567's user avatar
  • 121
2 votes
0 answers
32 views

Product Cipher with Two Autokey Cipher

I have a cypher text with I know encrypted two times with Autokey Cipher with same lengths of keys. I am following the statistical cryptanalysis in here when it is ciphered with one time with Autokey ...
stigmata2's user avatar

1
2 3 4 5