Questions tagged [cryptanalysis]
Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).
1,495
questions
2
votes
1
answer
196
views
How to solve this Baby Bleichenbacher Attack?
I am trying to solve this problem from https://toc.cryptobook.us/book.pdf.
I am having trouble with this question :
(Baby Bleichenbacher attack). Consider an RSA public key (n, e), where n is an RSA
...
- 21
0
votes
1
answer
90
views
How do I know the most efficient image encryption algorithm?
I am familiar with any algorithm that is based on the number of bits in a key (n-bit) and how to restore a key, such as the Discrete Logarithm Problem or Factorization.
When I use any algorithm for ...
- 431
2
votes
1
answer
544
views
A probable attack for RSA (factorization): how to improve it?
A probable attack for RSA (factorization): how to improve it?
$N=8*G+3$ can be factored if there is a non-trivial negative $k$ such that
$\frac{(N*(9+24*k)-3)}{8}=-6*m^2 $
[to exclude the two trivial ...
2
votes
1
answer
194
views
Is it safe to initialize a random number generator with MD5?
The MD5 algorithm is no longer considered secure for most applications of a hash algorithm. However, is it safe to initialize a PRNG via a password?
If it is not, how could it be exploited?
0
votes
0
answers
57
views
What kind of special numbers are not suitable as RSA keys?
I have read that some integers are not appropriate to be chosen as the modulus in an RSA cryptosystem. Some of these numbers are those that, given a modulus $n=pq$, then $p-1$ or $q-1$ do not have ...
0
votes
0
answers
38
views
How to compute $x_0$ in Chaotic Logistic map in special method?
I know that the Chaotic Logistic map is $x_{n+1}=Rx_n(1−x_n)$. I read some articles about the Chaotic Logistic Map, but some things are not clear. Someone wrote in his article the following: The ...
- 431
0
votes
0
answers
88
views
Is Index Calculus Attack on hyperelliptic curves feasible with a common laptop?
I am studying this paper about an index calculus attack in hyperelliptic curves for genus $3, 4, 5, \dots, 9$.
Nicolas Thériault, Index calculus attack for hyperelliptic curves of small genus, 2003.
...
- 187
1
vote
0
answers
53
views
Using multiple asymmetric keys as backups for one another
I've been thinking about ways to take advantage of multiple asymmetric encryption schemes so that each key could be a backup to the others in case of cryptanalysis of one given scheme.
Those public ...
- 11
2
votes
0
answers
53
views
Is there a way of mitigating weak states in the Spritz stream cipher algorithm?
The Spritz stream cipher algorithm has been shown to have a special class of states that can be used to do a full state recovery attack better than brute force.
While the authors of the paper clearly ...
- 195
2
votes
0
answers
81
views
Textbook RSA with $e=3$ and short random message
This is a simplified version of a question I made long ago, that never got an accepted answer.
It's given $N$ of $n=2048$ bit, assumed hard to factor, which two prime factors each are $\equiv2\pmod3$, ...
- 134k
2
votes
1
answer
250
views
Breaking RSA with P,Q LSB bits
Let's say we have a certain amount of LSB bits of P and Q and we want to fully reconstruct them given N=P*Q. I know this problem was studied in literature by Coppersmith and that Lattice methods are ...
- 31
0
votes
0
answers
73
views
Provably secure and Practical ciphers
Are there any ciphers that are
provably secure (reducable to a hard problem (including like factorization, not necessarily to NP-Complete or harder) )
are practical (not necessarily for too much ...
- 41
0
votes
2
answers
72
views
Recovering original bit vectors that constituted XORed binary vectors
I am trying to unscramble received data packets. Each packet is divided into 3 parts ($A$, $B$ and $D$) with equal lengths. In every packet, each of these parts are scrambled/encrypted with an unknown ...
- 109
1
vote
2
answers
186
views
LWE with a binary matrix A
In LWE, we know that given reasonable public parameter $A\in \mathbb{Z}_q^{n\times \lambda}$, secret $s\in \mathbb{Z}_q^{\lambda}$ and noise $e\in \mathcal{X}^{n}$, random $r\in \mathbb{Z}_q^{n}$, $(A,...
- 23
1
vote
1
answer
81
views
Do snapshots of Encrypted Disk Images weaken security?
I have read/write disk images encrypted with 128 AES using Mac's disk utility. If I snapshot the encrypted disk images daily (sometimes with changes other times without), and an attacker has access to ...
1
vote
2
answers
162
views
Problem with implementation of Enigma Machine
I'm having trouble making an implementation of Enigma Machine in VBA. My question is about implementing the rotors and their move.
To be more precise, I will show below the way that I code my Enigma ...
- 11
0
votes
1
answer
309
views
Is Mersenne Twister hard to break if it has a reduced output?
I was reading this challenge, which proposes to clone (or recover) the internal state of the MT19937 just by applying the inverse process to each output (624 consecutively words).
Mersenne Twister's ...
- 1
5
votes
0
answers
120
views
About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?
Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$
with
$$p=(p_1, p_2)$$
$$q=(q_1,q_2)$$
$$p_1,q_1 \in [0,s)$$
$$p_2,q_2 \in [0,s^2)$$
We want to find a path in between ...
- 557
3
votes
1
answer
77
views
Why would the same cipher structure have a different optimal attack for different bit widths?
I'm going to use the Simon Cipher as an example, but I want to frame the question to be more general. Why would the same cipher structure have a different optimal attack for different bit widths? I ...
- 4,524
0
votes
1
answer
123
views
Why is ShiftRow important in AES?
I came across a comment about AES 128 without ShiftRow. I want to use this weakness to perform an attack. So far, I get that It possible to divide in 4 independent blocks of 32 bits. So we can launch ...
- 1
1
vote
1
answer
303
views
Linear cryptanalysis resistance of AES Sbox
If you look at the AES Linear Approximation Table (computed for example with Sage) you will see there are many entries with what looks like a high bias of -16 ("absolute bias" scale).
I ...
- 47
0
votes
0
answers
140
views
What is digram analysis?
so I wanted to ask something since I just learned about cryptography. Here where I have the task to write an essay on cryptography and the title I have to do is introduction digram analysis. However, ...
- 1
2
votes
0
answers
67
views
Scyther related questions for handling/splitting values and verifying hashes
While implementing a protocol in Scyther, I need help with the following questions -
How do we split a particular message/variable into two parts in Scyther?
(For eg. if I have value R in my protocol ...
- 53
1
vote
1
answer
110
views
Differential cryptanalysis - how to extend the attack to rounds before the last?
Suppose that we have a block cipher such that the last round of the cipher depends on half of the key and the penultimate round uses the other half.
Suppose also that I attacked the last round using ...
- 47
0
votes
0
answers
200
views
Attack against stream cipher (LFSR with ASCII)
I'm reading Understanding Cryptography by Christof Paar and Jan Pelzl. In chapter 2 (Stream Ciphers) there's a question that goes like this:
Assume we have a stream cipher whose period is quite short....
- 123
2
votes
1
answer
110
views
For any numbers $a, b$, what are the operators $X, Y$ such that revealing $a\ X\ b$ and $a\ Y\ b$ doesn't reveal info about $a,b$?
Previously I thought about a pair of 8-bit uniformly distributed random numbers $(a,b) \in \{0,1\}^8$, and $X$ to be bitwise XOR, $Y$ to be 8-bit addition. But it turned out that revealing $a \text{ ...
- 553
2
votes
3
answers
228
views
What does $(a+b) \bmod{256}$ and $a$ XOR $b$ reveal about $a, b$?
Say $a$ and $b$ are some uniform random $8$ bits so that the entropy of $a$ and $b$ is 8 bits each.
If I show you $(a+b) \bmod{256}$ and $a$ XOR $b$, then what can you tell about $a$ and $b$? Or how ...
- 553
-1
votes
2
answers
110
views
predict random keys using python [closed]
How can I write a program in python to predict the random key (urandom) that is used for encryption? I tried to search and I couldn’t find anything related to guessing and predicting urandom in python
- 17
0
votes
0
answers
109
views
Hashing and Password Cracking
I was playing a game on cryptography where I encountered this problem:
Hashed Value of password: 24 109 76 35 22 94 83 25 106 104 73 87 56 38 56 50 10
92 58 84 44 88 24 112 125 121 125 43 122 55 106 ...
- 111
5
votes
1
answer
288
views
Which is the smallest, cyclic in 3 directions, consistent structure of random values which can be hidden at the adversaries machine? (some comparison)
Or more general each member can be part of up to three 2D locally euclidean planes of 2 different dimensions each.
(each of those planes is cyclic in two orthogonal directions, like a torus)
Given ...
- 557
1
vote
0
answers
57
views
Can I decrypt AES-CBC ciphertext if I have the key without IV? [duplicate]
Can I decrypt ciphertext from AES-CBC encryption, if I have the key and ciphertext only?
- 17
4
votes
1
answer
195
views
What is the effect of low rank dual sublattices on the dual lattice attack on LWE?
In the dual lattice attack of Espitau, Joux and Kharchenko (On a dual/hybrid approach to small secret LWE), the authors propose distinguishing (and subsequently recovering secret values) of LWE ...
- 20.1k
0
votes
1
answer
82
views
Computational indistinguishability of two LWE type samples
Consider the problem of distinguishing between polynomially many samples of either
\begin{equation}
(x, b, As + e) ~~\text{or}~~\left(x, b, ~Ax + b\cdot(As + e) + e'\right).
\end{equation}
Here, $A$ ...
- 103
1
vote
0
answers
61
views
On the effectiveness of Sidelnikov-Shestakov attack under a bad guess
I have been studying Wieschebrink paper "Cryptanalysis of the Niederreiter Public Key Scheme Based on GRS Codes". In the paper a cryptosystem using GRS codes is exhibited with an attack ...
- 11
1
vote
1
answer
139
views
Why does differential cryptanalysis always start from the last round?
Suppose we are working with a cipher with the same general structure as AES.
I want to attack the cipher in the following way: suppose that the differential holds only for the first round (much higher ...
- 47
0
votes
0
answers
65
views
Enumerating values from a linear congruential generator java Random()
During my research on a java application, I discovered that the nextInt(64) function of the java.Random() class is used to ...
0
votes
0
answers
78
views
Indistinguishability proof of an encryption scheme
Is there any indistinguishability proof (e.g., IND-CPA, IND-CCA, IND-CCA1, IND-CCA2, IND-CKA) based on games that involve breaking the AES security? Usually the proof involve breaking hard problems ...
2
votes
1
answer
181
views
Shift cypher, perfectly secure?
I know that if only one character is encrypted using a shift cipher, then the shift cipher is perfectly secure. But what if the space of keys is greater than the space of messages? Would it still be ...
- 23
0
votes
1
answer
75
views
limiting number of queries to Enc. or Dec
Why do we limit the number of queries to Encryption or Decryption oracles in the security analysis of various encryption schemes to be polynomial in the security parameter n?
- 15
0
votes
1
answer
72
views
Does the searchable encryption scheme satisfy trapdoor indistinguishability?
In a searchable encryption scheme based on the certificateless cryptosystem, the trapdoor generation algorithm only has a hash function that outputs an integer value. Does the scheme satisfy trapdoor ...
0
votes
1
answer
106
views
RSA rsa residue class ring
I've been working on the RSA method for several weeks and I don't understand what this residual class ring is all about.
I understand that if
$
x^e \bmod n$ there must be $x<n$ because of ...
- 11
2
votes
1
answer
247
views
Is DSA still secure without the factor "r"?
If I understand correctly, the way DSA in a group $G$ with a hash function $H$ works is: Peggy (signer) has a private/public key pair $x$, $g^x$. For signing, she produces a random session key $k$, $g^...
- 23
5
votes
0
answers
135
views
Resistance to integral attacks by North Korean block cipher Jipsam1
The cipher is a modification to AES and is described on this website:
The only difference between Jipsam1 and AES-256 is the S-box. Whereas in AES the S-box is public and constant, namely
$$
\begin{...
- 14.9k
0
votes
0
answers
138
views
RSA: decrypting short message with a different public key
I am having a hard time understanding what I have come across using RSA-textbook.
So I have:
e = 3 as an exponent
a VERY long public key N of 1991 bits (clearly useless trying to factor)
a very short ...
7
votes
1
answer
510
views
Notion of elementary operation when complexities in the form of $2^{128}$
In lots of cryptoanalytic papers I read, attack complexities are stated in the form of a constant. For example, this related key attack on of AES states:
[...] For AES-256 we show the first key ...
- 347
2
votes
0
answers
67
views
Linear approximation of modular addition of a constant?
In Linear Approximations of Additions Modulo $2^n$, Wallén shows how to compute the correlation of the modular addition of two binary bit vectors. A simple recursive procedure was given by Schulte-...
- 171
0
votes
1
answer
125
views
What would be the benefits of a fast PRNG that produces an 8-bit output and could pass 1 Peta Byte of the PractRand test?
Assuming that all other elements like the internal state of the algorithm are considered secured and very hard to discover from a cryptanalytic standpoint.
How significant would be for the algorithm ...
0
votes
0
answers
121
views
Difference between WhatsApp and Signal implementation of the Open Whisper Protocol
WhatsApp has taken the step of using the Open Whisper Protocol for their message encryption, borrowed from the Signal application.
I was wondering if there was any obvious, high level, difference in ...
- 145
2
votes
2
answers
181
views
How to find the optimal trail in linear cryptanalysis
I'm reading and implementing this tutorial, the author explains everything pretty clearly, the only thing I'm missing is how he decides which trail to use (pg. 12). I understand that one should prefer ...
- 125
1
vote
0
answers
42
views
How does one produce this in the linear cryptanalysis of DES
I understand how this linear approximation board below is produced,
but I can't understand how this second board is produced using the first one
and finally how the pilling-up lemma values are ...
- 11