Questions tagged [cryptanalysis]
Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).
1,496
questions
125
votes
7
answers
218k
views
Are there two known strings which have the same MD5 hash value?
Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?
Adban
118
votes
7
answers
115k
views
Taking advantage of one-time pad key reuse?
Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel. Alice and Bob have a shared key $k$; however, both messages are the same length as the ...
- 1,641
103
votes
2
answers
20k
views
What is the new attack on SHA-1 "SHAttered" and how does it work?
There's a new recent Attack on SHA-1 named "SHAttered" by Google and some researchers. I understand that it uses some fancy new techniques, but not the details.
My question is: How?
How does the ...
- 45.5k
90
votes
5
answers
40k
views
Is AES-256 weaker than 192 and 128 bit versions?
From a paper via Schneier on Security's Another AES Attack (emphasis mine):
In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. However, ...
- 1,011
76
votes
3
answers
85k
views
How does one attack a two-time pad (i.e. one time pad with key reuse)?
My question might appear the same as the question Taking advantage of one-time pad key reuse?, but actually I did read all the answers and none of them helped me with the details I need.
I am new to ...
- 963
68
votes
4
answers
13k
views
Why does the FBI ask Apple for help to decrypt an iPhone?
The current debate of the FBI trying to get Apple to assist in decrypting an iPhone made me wonder:
Normally, upon turning on an iPhone, everything is decrypted using a 4-digit pin (or actually, a ...
- 1,397
60
votes
3
answers
54k
views
Definition of textbook RSA
What is the definition of textbook or "raw" RSA?
What are some of the properties of textbook RSA?
How does it differ from other schemes based on RSA?
- 1,933
54
votes
10
answers
14k
views
Now that quantum computers have been out for a while, has RSA been cracked?
D-wave systems has released a commercially viable quantum computer. This means in theory, that all asymmetric encryption algorithms — such as RSA — are now useless due to the speed at which quantum ...
- 961
54
votes
6
answers
11k
views
Kerckhoffs’ principles – Why should I make my cipher public?
As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that
A cryptosystem should be secure ...
- 2,548
47
votes
4
answers
32k
views
Security strength of RSA in relation with the modulus size
NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits:
...
46
votes
1
answer
7k
views
What is a "freestart collision"?
In their work on SHA-1 collisions (cf. the EUROCRYPT-2016 paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ...
- 31.9k
45
votes
7
answers
11k
views
How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world.
How can we reason about the symmetric ciphers cryptanalysis ...
- 703
42
votes
3
answers
20k
views
Why does nobody use (or break) the Camellia Cipher?
If Camellia is of equivalent security and speed to AES, concerns arise.
First of all, assuming the above, why is Camellia so rarely used in practice?
Why aren't there any breaks in Camellia? Does ...
- 1,192
34
votes
2
answers
5k
views
What are recommended, general strategies to start block-cipher design and/or analysis?
I (and many others for that matter) have always been fascinated by the inner workings of the modern building block of cryptography: block ciphers.
Now, the ressources on the "black art" of design and ...
- 45.5k
34
votes
3
answers
98k
views
Possible ways to crack simple hand ciphers?
We had a quiz in class today where we had to break the ciphertext with the key given, but not the algorithm. Suffice to say that I wasn't able to decrypt it within the allotted time of 12 mins and ...
- 647
33
votes
3
answers
14k
views
Is 80 bits of key size considered safe against brute force attacks?
I came across the KATAN family of ciphers for small domain input blocks. They cipher arbitrary block lengths: 32, 48 and 64, but their key size is 80 bits only.
Is 80 bits of key size considered ...
- 6,094
33
votes
5
answers
16k
views
Any practical uses of machine learning for cryptography?
I am about to go study for my masters in machine learning, data mining and high performance computing, but have recently become very interested in cryptography after taking Dan Boneh's Cryptography ...
- 870
33
votes
3
answers
8k
views
How practical are side-channel attacks and how much of a concern are they?
I see a lot of research in very sophisticated side-channel attacks on crypto systems. Most (but definitely not all) seem to follow a trend, namely, the crypto system does something very dumb like ...
- 38.3k
32
votes
3
answers
5k
views
Applicability of IBM's projected 50-qubit quantum computer Q to cryptanalysis?
IBM announced Q, a project for a 50-qubit universal quantum computer, according to the press realease. Here is more PR spin, and the research sub-page.
What would be the applicability of that to ...
- 134k
32
votes
1
answer
5k
views
Proof for the SHA3 claim that 256 bit security is "post-quantum sufficient"?
On page 14 of "Keccak and the SHA-3 Standardization" (February 6, 2013) it says:
Instantiation of a sponge function
the permutation KECCAK-f
7 permutations: b → {25,50,100,200,400,800,...
- 17.7k
31
votes
2
answers
6k
views
What are the implications of the new alleged key recovery attack preprint on SIMON?
Just recently, a new attack was published against SIMON-32/64 which claims to also be applicable to other versions of the cipher. The paper, now archived, is titled A Note on SIMON-32/64 Security and ...
- 14.9k
31
votes
2
answers
50k
views
How much computing resource is required to brute-force RSA?
It's been over 30 years since Rivest, Shamir and Adleman first publicly described their algorithm for public-key cryptography; and the intelligence community is thought to have known about it for ...
- 497
31
votes
2
answers
5k
views
How do I apply differential cryptanalysis to a block cipher?
I have read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are – for example – vulnerable to differential cryptanalysis....
user46
30
votes
11
answers
9k
views
Why can't I reverse a hash to a possible input?
I'm going to provide “proof” why a hash function can be reversed, and I hope you can tell my why I'm wrong
So, a hash function can be implemented as a series of logic gates. All logic gates can be ...
- 574
30
votes
9
answers
35k
views
RSA with small exponents?
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
- 1,641
30
votes
4
answers
23k
views
How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?
If cryptanalysts today were to crack the original Enigma machine, “how fast” or “how easily” could they do it? What methods would they use?
The original cracking was significantly helped by operator ...
- 513
30
votes
4
answers
64k
views
What is the difference between known-plaintext attack and chosen-plaintext attack?
I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not.
Can anyone explain to me how ...
Tom Fabregas
30
votes
3
answers
10k
views
repeating-key xor and hamming distance
I read that to break repeating-key xor you can do the following: try a keysize $n$ and compute the hamming distance between the first $n$ bits of the encrypted string and the bits $n+1$ to $2n$ of the ...
- 433
30
votes
4
answers
55k
views
What is the effect of the different AES key lengths?
How does a changing key length affects the ciphertext, not only in case of AES, but in general? I know that the key spaces become much larger and the number of rounds in case of AES changes, but is ...
- 387
30
votes
1
answer
2k
views
Is it possible to actually verify a “sponge function” security claim?
When using a “sponge function” to create a cryptographic hash, we can look at the flat sponge claim, which flattens the claimed success probabilities of all attacks using a single parameter: the ...
- 17.7k
29
votes
4
answers
27k
views
Recommended skills for a job in cryptology [closed]
First let me apologize if this is an ill posed question. Let me also note that I do not in any way seek a comprehensive answer, simply your thoughts on what makes for a valuable asset to a company ...
- 419
29
votes
2
answers
31k
views
How does a chosen ciphertext attack work, with a simple example?
Can someone please explain - using a simple example - how a chosen ciphertext attack works?
- 495
28
votes
2
answers
21k
views
Which attacks are possible against raw/textbook RSA?
The PKCS#1 standard defines multiple padding schemes for signature generation/verification (EMSA-PSS and EMSA-PKCS1-v1_5), and encryption/decryption (EME-OAEP and the less safe EME-PKCS1-v1_5).
Which ...
28
votes
2
answers
40k
views
How does a chosen plaintext attack on RSA work?
How can one run a chosen plaintext attack on RSA?
If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
user1829
28
votes
3
answers
3k
views
Is this password migration strategy secure?
I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
- 415
27
votes
1
answer
3k
views
What is hardened SHA-1, how does it work and how much protection does it offer?
From the shattered website:
You can use the online tool above to submit files and have them checked for a cryptanalytic collision attack on SHA-1. The code behind this was developed by Marc Stevens ...
- 90.2k
26
votes
2
answers
9k
views
How does the MOV attack work?
What exactly is the MOV attack, how does it actually work, and what is it used for?
It's explained briefly here and I'd like to know what it is more / what is it fully used for.
- 699
26
votes
3
answers
5k
views
How Far Ahead of Academia Are Government Agencies? [closed]
This is a soft question regarding comparisons between government security services (eg, NSA or GCHQ) and open-source research (e.g., academia). Hopefully it's on-topic for this site!
In essence, my ...
- 448
25
votes
3
answers
11k
views
Why do block ciphers need a non-linear component (like an S-box)?
Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)?
How does it make the cipher more secure?
The only intuition I have ...
- 433
25
votes
4
answers
5k
views
Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?
Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
- 134k
24
votes
4
answers
6k
views
How Brittle Are LCG-Cracking Techniques?
There are published techniques for cracking LCGs, but to my eye those techniques seem very brittle — very minor changes can add nonlinearity that renders techniques like the LLL algorithm unusable. ...
- 516
24
votes
5
answers
12k
views
Developing algorithm for detecting plain text via frequency analysis
I'm currently attempting the Matasano Crypto Challenges as a basic intro to cryptography. For solving some of the earlier challenges I utilised n-grams to determine which is going to be the most ...
- 243
22
votes
3
answers
13k
views
How effective is quantum computing against elliptic curve cryptography?
I've been reading the Wikipedia page on Elliptic-Curve Cryptography and I came across the following.
in August 2015, the NSA announced that it plans to replace Suite B with a new cipher suite due ...
22
votes
2
answers
22k
views
How does a padding oracle attack work?
I am unsure of how a padding oracle attack works.
What I am not getting is how changing one bit at one time allows one to exploit(get keys) ASP.NET machines.
Can anyone explain this?
Mark Dioes
22
votes
2
answers
13k
views
What are the main weaknesses of a Playfair cipher, if any?
What are the main weaknesses of a Playfair cipher, if any?
I know that they depend on none of the letters missing, but that is an easy fix if a letter gets dropped. Besides that, are there any other ...
- 383
21
votes
3
answers
7k
views
Memory-hard proof-of-work: are they ASIC-resistant?
Is a memory-hard proof-of-work scheme necessarily resistant to speedups from custom ASICS?
Background: Bitcoin uses a proof-of-work scheme based on SHA256 hashing. The scheme is compute-bound. ...
- 36k
20
votes
3
answers
11k
views
Cryptanalysis to reverse engineer a hash?
I understand this may not be the best place to ask a question like this, but I believe that this community may be the best/only place I can ask such a question.
I have inputs and outputs from an in-...
- 211
20
votes
4
answers
5k
views
Is compressing data prior to encryption necessary to reduce plaintext redundancy?
As explained in William Stallings' Book, in PGP encryption is done after compression, since it reduces redundancy.
I couldn't relate encryption strength with redundancy. Could anyone explain more on ...
- 1,883
20
votes
3
answers
6k
views
Can I use a one time pad key twice with random plaintext?
I understand the basics of OTP: $|\text{key space}| = |\text{plaintext space}|$ implies perfect security, key reuse destroys this.
Cryptanalysis on the $N$-Time Pad for $N > 1$ involves finding ...
- 353
20
votes
1
answer
3k
views
Does Curve25519 only provide 112 bit security?
In a recent mail on the IETF CFRG mailing list it was claimed that:
The (currently missing) security considerations (or somewhere) should describe why Curve25519 is ok when used in contexts where ...
- 45.5k