Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

Filter by
Sorted by
Tagged with
105
votes
7answers
173k views

Are there two known strings which have the same MD5 hash value?

Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?
102
votes
7answers
99k views

Taking advantage of one-time pad key reuse?

Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel. Alice and Bob have a shared key $k$; however, both messages are the same length as the ...
99
votes
2answers
18k views

What is the new attack on SHA-1 “SHAttered” and how does it work?

There's a new recent Attack on SHA-1 named "SHAttered" by Google and some researchers. I understand that it uses some fancy new techniques, but not the details. My question is: How? How does the ...
85
votes
5answers
38k views

Is AES-256 weaker than 192 and 128 bit versions?

From a paper via Schneier on Security's Another AES Attack (emphasis mine): In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. However, ...
70
votes
3answers
75k views

How does one attack a two-time pad (i.e. one time pad with key reuse)?

My question might appear the same as the question Taking advantage of one-time pad key reuse?, but actually I did read all the answers and none of them helped me with the details I need. I am new to ...
64
votes
4answers
13k views

Why does the FBI ask Apple for help to decrypt an iPhone?

The current debate of the FBI trying to get Apple to assist in decrypting an iPhone made me wonder: Normally, upon turning on an iPhone, everything is decrypted using a 4-digit pin (or actually, a ...
51
votes
3answers
41k views

Definition of textbook RSA

What is the definition of textbook or "raw" RSA? What are some of the properties of textbook RSA? How does it differ from other schemes based on RSA?
49
votes
10answers
13k views

Now that quantum computers have been out for a while, has RSA been cracked?

D-wave systems has released a commercially viable quantum computer. This means in theory, that all asymmetric encryption algorithms — such as RSA — are now useless due to the speed at which quantum ...
49
votes
6answers
10k views

Kerckhoffs’ principles – Why should I make my cipher public?

As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that A cryptosystem should be secure ...
45
votes
7answers
10k views

How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?

I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world. How can we reason about the symmetric ciphers cryptanalysis ...
45
votes
1answer
6k views

What is a “freestart collision”?

In their work on SHA-1 collisions (cf. the EUROCRYPT-2016 paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ...
44
votes
4answers
27k views

Security strength of RSA in relation with the modulus size

NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits: ...
42
votes
3answers
19k views

Why does nobody use (or break) the Camellia Cipher?

If Camellia is of equivalent security and speed to AES, concerns arise. First of all, assuming the above, why is Camellia so rarely used in practice? Why aren't there any breaks in Camellia? Does ...
33
votes
5answers
14k views

Any practical uses of machine learning for cryptography?

I am about to go study for my masters in machine learning, data mining and high performance computing, but have recently become very interested in cryptography after taking Dan Boneh's Cryptography ...
33
votes
3answers
96k views

Possible ways to crack simple hand ciphers?

We had a quiz in class today where we had to break the ciphertext with the key given, but not the algorithm. Suffice to say that I wasn't able to decrypt it within the allotted time of 12 mins and ...
32
votes
3answers
12k views

Is 80 bits of key size considered safe against brute force attacks?

I came across the KATAN family of ciphers for small domain input blocks. They cipher arbitrary block lengths: 32, 48 and 64, but their key size is 80 bits only. Is 80 bits of key size considered ...
32
votes
3answers
7k views

How practical are side-channel attacks and how much of a concern are they?

I see a lot of research in very sophisticated side-channel attacks on crypto systems. Most (but definitely not all) seem to follow a trend, namely, the crypto system does something very dumb like ...
31
votes
2answers
4k views

What are recommended, general strategies to start block-cipher design and/or analysis?

I (and many others for that matter) have always been fascinated by the inner workings of the modern building block of cryptography: block ciphers. Now, the ressources on the "black art" of design and ...
31
votes
3answers
5k views

Applicability of IBM's projected 50-qubit quantum computer Q to cryptanalysis?

IBM announced Q, a project for a 50-qubit universal quantum computer, according to the press realease. Here is more PR spin, and the research sub-page. What would be the applicability of that to ...
30
votes
1answer
4k views

Proof for the SHA3 claim that 256 bit security is “post-quantum sufficient”?

On page 14 of "Keccak and the SHA-3 Standardization" (February 6, 2013) it says: Instantiation of a sponge function the permutation KECCAK-f 7 permutations: b → {25,50,100,200,400,800,...
29
votes
11answers
8k views

Why can't I reverse a hash to a possible input?

I'm going to provide “proof” why a hash function can be reversed, and I hope you can tell my why I'm wrong So, a hash function can be implemented as a series of logic gates. All logic gates can be ...
29
votes
2answers
6k views

What are the implications of the new alleged key recovery attack preprint on SIMON?

Just recently, a new attack was published against SIMON-32/64 which claims to also be applicable to other versions of the cipher. The paper is titled A Note on SIMON-32/64 Security (archived 2019-05-...
29
votes
4answers
56k views

What is the difference between known-plaintext attack and chosen-plaintext attack?

I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not. Can anyone explain to me how ...
29
votes
4answers
52k views

What is the effect of the different AES key lengths?

How does a changing key length affects the ciphertext, not only in case of AES, but in general? I know that the key spaces become much larger and the number of rounds in case of AES changes, but is ...
28
votes
4answers
26k views

Recommended skills for a job in cryptology [closed]

First let me apologize if this is an ill posed question. Let me also note that I do not in any way seek a comprehensive answer, simply your thoughts on what makes for a valuable asset to a company ...
28
votes
3answers
22k views

How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?

If cryptanalysts today were to crack the original Enigma machine, “how fast” or “how easily” could they do it? What methods would they use? The original cracking was significantly helped by operator ...
28
votes
2answers
5k views

How do I apply differential cryptanalysis to a block cipher?

I have read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are – for example – vulnerable to differential cryptanalysis....
28
votes
3answers
3k views

Is this password migration strategy secure?

I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
27
votes
2answers
44k views

How much computing resource is required to brute-force RSA?

It's been over 30 years since Rivest, Shamir and Adleman first publicly described their algorithm for public-key cryptography; and the intelligence community is thought to have known about it for ...
27
votes
3answers
9k views

repeating-key xor and hamming distance

I read that to break repeating-key xor you can do the following: try a keysize $n$ and compute the hamming distance between the first $n$ bits of the encrypted string and the bits $n+1$ to $2n$ of the ...
27
votes
1answer
2k views

Is it possible to actually verify a “sponge function” security claim?

When using a “sponge function” to create a cryptographic hash, we can look at the flat sponge claim, which flattens the claimed success probabilities of all attacks using a single parameter: the ...
26
votes
9answers
26k views

RSA with small exponents?

Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
26
votes
3answers
5k views

How Far Ahead of Academia Are Government Agencies? [closed]

This is a soft question regarding comparisons between government security services (eg, NSA or GCHQ) and open-source research (e.g., academia). Hopefully it's on-topic for this site! In essence, my ...
26
votes
2answers
27k views

How does a chosen ciphertext attack work, with a simple example?

Can someone please explain - using a simple example - how a chosen ciphertext attack works?
24
votes
1answer
2k views

What is hardened SHA-1, how does it work and how much protection does it offer?

From the shattered website: You can use the online tool above to submit files and have them checked for a cryptanalytic collision attack on SHA-1. The code behind this was developed by Marc Stevens ...
23
votes
4answers
4k views

Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?

Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
23
votes
5answers
11k views

Developing algorithm for detecting plain text via frequency analysis

I'm currently attempting the Matasano Crypto Challenges as a basic intro to cryptography. For solving some of the earlier challenges I utilised n-grams to determine which is going to be the most ...
23
votes
2answers
31k views

How does a chosen plaintext attack on RSA work?

How can one run a chosen plaintext attack on RSA? If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
22
votes
2answers
14k views

Which attacks are possible against raw/textbook RSA?

The PKCS#1 standard defines multiple padding schemes for signature generation/verification (EMSA-PSS and EMSA-PKCS1-v1_5), and encryption/decryption (EME-OAEP and the less safe EME-PKCS1-v1_5). ...
22
votes
3answers
10k views

Why do block ciphers need a non-linear component (like an S-box)?

Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)? How does it make the cipher more secure? The only intuition I have ...
21
votes
2answers
6k views

How does the MOV attack work?

What exactly is the MOV attack, how does it actually work, and what is it used for? It's explained briefly here and I'd like to know what it is more / what is it fully used for.
21
votes
4answers
5k views

How Brittle Are LCG-Cracking Techniques?

There are published techniques for cracking LCGs, but to my eye those techniques seem very brittle — very minor changes can add nonlinearity that renders techniques like the LLL algorithm unusable. ...
21
votes
2answers
21k views

How does a padding oracle attack work?

I am unsure of how a padding oracle attack works. What I am not getting is how changing one bit at one time allows one to exploit(get keys) ASP.NET machines. Can anyone explain this?
21
votes
3answers
6k views

Memory-hard proof-of-work: are they ASIC-resistant?

Is a memory-hard proof-of-work scheme necessarily resistant to speedups from custom ASICS? Background: Bitcoin uses a proof-of-work scheme based on SHA256 hashing. The scheme is compute-bound. ...
20
votes
2answers
12k views

What are the main weaknesses of a Playfair cipher, if any?

What are the main weaknesses of a Playfair cipher, if any? I know that they depend on none of the letters missing, but that is an easy fix if a letter gets dropped. Besides that, are there any other ...
20
votes
1answer
3k views

Does Curve25519 only provide 112 bit security?

In a recent mail on the IETF CFRG mailing list it was claimed that: The (currently missing) security considerations (or somewhere) should describe why Curve25519 is ok when used in contexts where ...
20
votes
3answers
6k views

Specification of the Megamos crypto algorithm

It has recently emerged that a paper that was scheduled to appear at Usenix Security 2013, titled "Dismantling Megamos Crypto: Wirelessly Lockpicking a Vehicle Immobiliser", has been censored ...
19
votes
3answers
10k views

Cryptanalysis to reverse engineer a hash?

I understand this may not be the best place to ask a question like this, but I believe that this community may be the best/only place I can ask such a question. I have inputs and outputs from an in-...
19
votes
4answers
4k views

Is compressing data prior to encryption necessary to reduce plaintext redundancy?

As explained in William Stallings' Book, in PGP encryption is done after compression, since it reduces redundancy. I couldn't relate encryption strength with redundancy. Could anyone explain more on ...
19
votes
2answers
4k views

Why is Pearson hash not used as a cryptographic hash?

The original algorithm produces 1 byte long hash and is (of course) not suitable for cryptography use. But according to wikipedia, it is possible and easy to produce Pearson hash of any length, simply ...

1
2 3 4 5
28