Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

Filter by
Sorted by
Tagged with
0 votes
1 answer
48 views

Is there a way to short circuit (speed up) hashing a large but sparse array?

Imagine a large array (Megabytes) that is virtually empty, i.e. contains 0 in almost all locations. But also imagine there's 1000 pseudo random locations that contain a pseudo random byte. There is ...
Paul Uszak's user avatar
  • 15.4k
2 votes
1 answer
217 views

Can I predict CryptGenRandom on my own device?

I have a Windows 10 laptop with an algorithm that creates a random number using the PRNG CryptGenRandom. According to Wikipedia: Because CryptGenRandom is the de facto standard CSPRNG in Win32 ...
Riemann's user avatar
  • 221
2 votes
1 answer
94 views

Is hash function cryptanalysis the same or more difficult for iterated hashing, as H(H(H(H(H))))?

The effectiveness of hash function attacks is typically measured in $x$ broken rounds of $N$ total designed rounds. And some constructs containing iterated hash functions include proof of work schemes,...
Paul Uszak's user avatar
  • 15.4k
1 vote
2 answers
83 views

Given $i$ keyed-$PRP$ labels $\ell_{i,x}$ from a $2^{256} \times 2^{256}$ Sudoku (Latin-square), how difficult is it for an adversary to solve?

There's a keyed-permutation I'm playing with, $\ell_{i,x} = \pi_i(x_i)$, which is a bijection $X \leftrightarrow X$, where $|X| = 2^{256}$, and whose evaluations on plaintext inputs $x_i$ perfectly ...
aiootp's user avatar
  • 773
0 votes
0 answers
47 views

Is combining Elgamal algorithm and RSA algorithm for key generation and AES+RSA algorithm for encryption and decryption a novel approach?

Key generation: Key Generation Firstly, the RSA algorithm will be used to generate a public and a private key. Generate two random prime numbers p, q. Select RSA public key, P k such that gcd(P k, Φ)=...
Srity Ahmed's user avatar
1 vote
0 answers
81 views

Literature on (concrete) hardness of Short Integer Solution (SIS)

I am interested in what the state of the art results on the hardness of the Short Integer Solution (SIS) instances are. The one I am the most familiar with (and the most discussed) is to use lattice ...
Gareth Ma's user avatar
  • 350
0 votes
2 answers
175 views

Trouble detecting cyclic group order crossovers in SECP256K1

There's a problem in detecting whether the sum of public key addition has crossed the cyclic group order boundary For this example, think of public keys $Pub$ as private keys $Priv$, (private scalars),...
Maltoon Yezi's user avatar
1 vote
4 answers
188 views

Good references to breakable limits: $2^{60}$

Recently, I read here on Crypto SE that $2^{60}$ doesn't provide enough resistance to current adversaries. Could someone please provide me with good references related to that threshold, or any ...
oCriptoPanquer's user avatar
1 vote
0 answers
59 views

Misuse Attacks on Lattice Crypto

I've been reading "Misuse Attacks on Post-Quantum Cryptosystems" (https://eprint.iacr.org/2019/525). In what scenarios are the attacks described in the paper applicable? Is it specifically ...
Lev Knoblock's user avatar
0 votes
0 answers
70 views

Can I skip ahead with a quadratic congruential generator?

I have a congruential generator where $$ r_{n+1} = r_n^2 - c\;(mod\;p) $$ known $r_0$, $c$ and $p$ can i get $r_n$ without having to compute all the previous values?
Flame's user avatar
  • 1
4 votes
2 answers
123 views

How certain is it that a shorter password can't match the salted hash of a long one?

We (collectively) salt passwords, then hash them; maybe even run them through something like PBKDF2 first (depending on how the password will be used). The end result is that we have a string $p$ and ...
András Korn's user avatar
0 votes
1 answer
102 views

How much of SHA3's internal state can be reached?

After reading that about "37% of the 256-bit outputs" of SHA-256 are unreachable when fed only 256-bit inputs [1] I'm curious & confused. The formula from the proof here considers a ...
aiootp's user avatar
  • 773
1 vote
0 answers
68 views

Is it possible to get the negative point with −x in that version of the Pedersen hash over the BaybyJubJub curve?

The Pedersen hash is a low constraints friendly hash for Zk-Snarks. Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
user2284570's user avatar
2 votes
1 answer
231 views

Is Python secrets module using a unsafe RNG on Windows?

The Python secrets module claims to produce cryptographically secure random numbers. I did some research on which random number generator is used when you call the secrets module on Windows. I found ...
Riemann's user avatar
  • 221
2 votes
0 answers
63 views

How many characters to do frequency analysis?

Is there any study that has looked into what is the minimum number of ciphertext characters one needs to have to do a reliable frequency analysis? It would be nice to know the evolution of the ...
lele's user avatar
  • 21
2 votes
2 answers
72 views

plain text size prediction

In your opinion, is the correlation between the length of the ciphertext and the decrypted text (even if it is approximate) a cipher vulnerability? Or is there a solution to this problem outside of it?...
nano toster's user avatar
0 votes
1 answer
90 views

How the differential cryptanalysis work? [duplicate]

I am new in the field of cryptanalysis and wonder how the differential cryptanalysis work
Mohamed's user avatar
1 vote
1 answer
312 views

Pedersen Hash : when truncating the hash to keep only the X coordinate, is it possible to compute a collision when the Babyjubjub curve is used?

The Pedersen hash is a low constraints friendly hash for Zk-Snarks. Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
user2284570's user avatar
1 vote
2 answers
256 views

State recovery algorithm for Xorshift128 given modular outputs

I am researching the Xorshift128 PRNG. I am particularly interested in recovering the state given a set of outputs that have the remainder taken with different values. A common way to take a unsigned ...
joemelsha's user avatar
0 votes
1 answer
242 views

What if LWE is not as secure as we think?

LWE schemes are currently being deployed. LWE has no quantum polynomial time algorithms as far as we know. Despite this what is the consequence if LWE can be broken on a classical computer? Do we ...
Turbo's user avatar
  • 908
0 votes
0 answers
37 views

Comparison of distinguishing attack against blockcipher and permutation

In a previous question, we explored various security definitions of encryption schemes, such as IND-CPA, IND-CCA{1,2,3,etc.} These indistinguishability games can roughly translate to blockciphers, as ...
DannyNiu's user avatar
  • 9,207
2 votes
0 answers
38 views

How many ciphertexts should attacker intercepts if he only knows the first 3 bytes of plaintext of each one?

Consider a system in which DES is used to encrypt messages in which the first three plaintext Bytes are known by the attacker. How many encrypted messages is it necessary to intercept in order to be ...
Allexj's user avatar
  • 143
2 votes
2 answers
298 views

Best Known Attacks on Discrete Logarithm in Generic Groups

This is a followup to my recent question Discrete Logarithm Challenges and Records. I am interested in confirming my understandings from the answer to that question, stated below: For a discrete ...
kodlu's user avatar
  • 22.5k
1 vote
0 answers
75 views

Bit based division property

Bit based division property is a great method of Integral attack on block ciphers, which was invented by Y. Todo. According to the paper Bit-Based Division Property and Application to Simon Family (in ...
R_Jalaei's user avatar
  • 141
1 vote
1 answer
111 views

Is it fatal if a blockcipher uses a sbox with a fixed point at 0?

In a previous question, I asked how to implement arbitrary s-box in side-channel-free fashion. The code I posted in the question loops over all 256 values of a byte to avoid timing channel, and I want ...
DannyNiu's user avatar
  • 9,207
-6 votes
1 answer
108 views

Are Schnorr's algorithm really subject to q-computer attacks?

I was wondering whether quantum-computers really break Schnorr's signature scheme. Schor's algorithm works via the quantum Fourier transform, which reveals the cycle time and thus phi. However, with a ...
Luke Bright's user avatar
0 votes
0 answers
77 views

Why using linear increasing nonce in DSA in a bad idea?

Suppose we sign and verify messages with a DSA scheme. Before signing the first message the necessary parameters $(p,q,h,g,x,y)$ are initialized, including the nonce $k$ as an integer between $(1,q-1)$...
rL0sr's user avatar
  • 1
1 vote
2 answers
185 views

decrypting full ciphertext of (AES CTR/GCM) based on partial knowledge of the cleartext

I have found myself in a position where I need to encrypt multiple objects (vCards) with AES Counter mode or Galois/Counter Mode using the same key. Now here is the problem the structure of the vCard ...
Tito's user avatar
  • 153
1 vote
1 answer
106 views

DH Finding A Public Key from Public key and shared secret

Is there a known feasible method for determining an unknown public key from a Diffie Helman shared secret and the other public/private key pair? This would be rarely useful, but I am curious if the DH ...
Wesley Jones's user avatar
1 vote
0 answers
47 views

Tensor and power bases for SIS?

What is there to say about using a power basis or a tensor basis or some combination of them for the RSIS problem in lattice cryptography? Restricting to dimension 3 for illustration, usually the ...
Joseph Johnston's user avatar
1 vote
0 answers
33 views

Secure ciphersuite from security-wise sub-optimal unkeyed permutation?

Hypothetically, IF we were to create a SSL/TLS or QUIC ciphersuite from a single (unkeyed) permutation operating in sponge mode to provide hashing and duplex mode to provide AEAD cipher, AND IF the ...
DannyNiu's user avatar
  • 9,207
2 votes
0 answers
77 views

Exploit 3DES-CBC with known checksum of plaintext and repeated IV

I came across the following enterprise encryption scheme. I laughed when I first saw it, but I'm not a specialist and I'd like to know how bad it really is. 3DES-CBC k1=k2=k3 for 3DES IV for CBC is ...
j123b567's user avatar
  • 121
3 votes
0 answers
111 views

Are there "light" versions of cryptographic hash functions?

After tinkering with cryptographic hash functions, I started wondering if they do have counterpart functions that would imitate their cryptographic properties but with a lower level of strength in ...
Ryan B.'s user avatar
  • 153
2 votes
1 answer
436 views

Attack on the chosen plain-text RSA

Reading another user's question, a doubt came to me. Suppose an RSA oracle exists, with which it is possible to interact to encrypt and decrypt some text. The oracle output is not the decrypted text ...
Jake's user avatar
  • 33
1 vote
0 answers
65 views

How can I perform a one-client MITM attack in a Diffie-Hellman key exchange? [closed]

Suppose we have intercepted a public key exchange (via Diffie-Hellman protocol). In addition to the keys A and B, the generator g and the module p are known. Assuming that it is possible to exchange ...
Albert's user avatar
  • 11
2 votes
0 answers
29 views

Product Cipher with Two Autokey Cipher

I have a cypher text with I know encrypted two times with Autokey Cipher with same lengths of keys. I am following the statistical cryptanalysis in here when it is ciphered with one time with Autokey ...
stigmata2's user avatar
3 votes
0 answers
149 views

Cryptanalysis of ARX Ciphers

Rotational Cryptanalysis of ARX show that rotational probability of an ARX primitive can be computed by $p^q$ where $p$ is rotational probability of modular addition and $q$ is number of modular ...
crypt's user avatar
  • 2,427
1 vote
0 answers
123 views

Which encryption method support 256 bytes block size?

I am looking at some secret encryption method that apparently uses CBC and a block size of 256 bytes. I can do a chosen-ciphertext-attack. When I modify a single byte in the ciphertext a complete ...
Flole's user avatar
  • 11
1 vote
2 answers
82 views

Rule 30 based block cipher

So I went ahead an wrote this little program. What it does is it takes a password for a seed and generates a (pseudo-random) bit-pattern using rule 30 from cellular automata. It then XORs our input ...
JThree's user avatar
  • 111
1 vote
2 answers
485 views

Stuck on a cryptanalytical research project [closed]

This is not a technical question, but rather it seeks advice on what to do if cryptanalytical research goes wrong. I've discovered a new attack that works great in theory, but in practice, it fails. I ...
MayDen's user avatar
  • 11
0 votes
0 answers
337 views

RSA : Is there a way to compute phi(n) or N itself if we only know e, d and a ciphertext?

I am trying to solve a problem where private key exponent d, ciphertext c, and public key exponent e (65537) are known. How can I calculate φ(n) or n itself? An extended version of the problem would ...
bd55's user avatar
  • 33
2 votes
1 answer
241 views

Confusion+Diffusion comparison table? (e.g. with Avalanche Criterion / SAC)

I'm looking for a general comparison of encryption algorithms in regard to Confusion and Diffusion (as defined by Claude Shannon), and if possible, specifically for their SAC and BIC quality. For ...
foo's user avatar
  • 144
4 votes
1 answer
77 views

Where did the number of initial plaintexts required for impossible cryptanalysis on Mini-AES came from?

I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference. But I don't ...
siba36's user avatar
  • 301
0 votes
1 answer
141 views

Differential trails in differential cryptanalysis

From section 4.4 of this book https://www.ic.unicamp.br/~rdahab/cursos/mo421-mc889/Welcome_files/Stinson-Paterson_CryptographyTheoryAndPractice-CRC%20Press%20%282019%29.pdf I'm confused on how the ...
Simon Balfe's user avatar
2 votes
0 answers
30 views

how to build the plaintext structure for impossible differential cryptanaysis on IDEA?

I'm trying to implement impossible differential cryptanalysis on 3.5 round IDEA using Miss in the Middle Attack on IDEA and Khufu paper as a reference and I'm stuck on the first two steps of the ...
siba36's user avatar
  • 301
1 vote
1 answer
708 views

Calculate the key of a Hill-cipher using known plain- and ciphertext

I know I should calculate the multiple inverse of plaintext with ciphertext $\pmod {26}$. However, the problem I have is that the plaintext is a $3 \times 4$ matrix which is not square, so how would I ...
Amer Yassir's user avatar
1 vote
1 answer
102 views

Size of nonlinear filter sequence to recover LFSR feedback polynomial

Let's suppose that there is a filter generator which based on $n$-size LFSR. Denote a feedback polynomial as $g(x_1, x_2, \dots, x_n)$ and nonlinear filter function as $f(x_1, x_2, \dots, x_n)$. Let $...
Grigoriy's user avatar
0 votes
1 answer
176 views

How does AES-CBC encryption achieve non-repeating blocks of ciphertext?

I am very interested in encryption algorithms, especially AES encryption algorithm in symmetric encryption. To this end, I have studied a lot of theoretical knowledge about AES encryption algorithm ...
SN-Grotesque's user avatar
2 votes
1 answer
71 views

Conceal time-based GUIDs with an affine-cipher?

I'd like to create a custom type of sortable GUID by concatenating an 8-byte nanosecond timestamp, 6 random bytes, a 1-byte node number, and a 1-byte counter. But, such a precise timestamp can be used ...
aiootp's user avatar
  • 773
1 vote
1 answer
265 views

Chosen-plaintext attact on AES with MixColumns omitted

Jean-Philippe Aumasson' "Serious Cryptography" says: "Without MixColumns, changes in a byte would not affect any other bytes of the state. A chosen-plaintext attacker could then decrypt ...
Zyx's user avatar
  • 11

1
2
3 4 5
32