Questions tagged [cryptanalysis]
Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).
1,496
questions
1
vote
0
answers
43
views
How does one produce this in the linear cryptanalysis of DES
I understand how this linear approximation board below is produced,
but I can't understand how this second board is produced using the first one
and finally how the pilling-up lemma values are ...
- 11
0
votes
1
answer
183
views
Finding collisions of polynomial rolling hashes
A polynomial hash defines a hash as $H = c_1a^{k-1} + c_2a^{k-2} ... + c_ka^0$, all modulo $2^n$ (that is, in $GF(2^n)$).
For brevity, let $c$ be a $k$ dimensional vector (encapsulating all the ...
- 135
1
vote
1
answer
337
views
Why do stream ciphers repeat and how is that a threat?
If you have to generate a sufficiently long keystream, why would the keystream eventually repeat?
If the keystream repeats does it pose the threat of being decrypted by a hacker? How could one use it ...
4
votes
1
answer
267
views
Matsui's linear attack on 5-round DES
I'm trying to understand Mitsuru Matsui's "Linear Cryptanalysis Method for DES Cipher", specifically the attack he describes at the end of section 5, on 5-round DES. I followed the attack on ...
- 171
1
vote
1
answer
69
views
Public-Key Encryption with Privilege Access: is it possible?
Let be Alice, Bob, and David three people. They all have public-key cryptographic system: private key and public key.
Is there any way, in some known cryptographic system (RSA, Elliptic Curve, etc.), ...
- 113
3
votes
1
answer
198
views
Probability of choosing a base successfully in Pollard p-1 factorization method
In a problem about pollard p-1 factorization method, where $n=pq$.
We choose some random base $a$ , and an exponent $B$, where hopefully $p-1$ has small prime factors, and if so we hope to estimate $p ...
- 33
2
votes
1
answer
61
views
How would having multiple independently encrypted versions of the same plaintext impact confidentiality?
Suppose I have some unknown plaintext P which I encrypt N times, each time with a completely new and random key and IV. Would knowing that all the encrypted output came from the same identical ...
- 23
2
votes
1
answer
200
views
Katz/Lindell 2.4 - Generalizing from 2 messages to any message space?
I'm trying to solve problem 2.4 in "Introduction to Modern Cryptography" (2nd edition) for self-study.
The problem asks to prove that perfect secrecy
$$
Pr[M = m | C = c] = Pr[M = m]
$$
...
- 247
2
votes
1
answer
326
views
Calculating statistical distance for simple addition cipher?
I'm looking at the solutions to this problem set for self study.
One of the questions is to calculate the statistical distance for the following scheme:
The message space is equal to the key space, ...
- 247
3
votes
0
answers
75
views
Why is WalnutDSA specified for COSE?
WalnutDSA was a 1st-round entrant in the NIST Post-Quantum Cryptography project. It had a significant cryptanalytic break close to almost breaking the security of the cryptosystem, only survived due ...
- 8,291
1
vote
0
answers
37
views
How to Prove matrix $m \times m$ is invertible is equivalent to be $LI$ over $\mathbb{Z_{2}}$?
I came up with one problem that says that a $m \times m$ matrix is invertible is the same as to say that its rows are LI (linearly independent) over $\mathbb{Z_{2}}$.
First of all, I'd like to know ...
- 211
0
votes
1
answer
60
views
Security in a pipeline
I am new to cryptography, I am trying to design a secure pipeline environment for the fast transfer of messages. To reduce the Key size I am planning to encrypt the messages with AES session keys (for ...
1
vote
1
answer
100
views
Some misunderstanding on the Security Proof with Oracle
I have a question about the security proof.
Suppose that I proved the following relations.
That is, I proved that $Adv_A \le Adv_A^{O} \le Adv_B$, where A,B are some cryptographic schemes and O is an ...
- 149
2
votes
1
answer
140
views
Trapdoor recovery from lattice-based preimage sampling
[GPV] and [MP] (references below) give constructions of the trapdoor function defined by
$$
f_{\mathbf A} (\mathbf x) = \mathbf A \mathbf x,
$$
where $\mathbf A \in \mathbb Z_q^{n \times m}$ is ...
- 835
0
votes
1
answer
625
views
Is it possible to crack a Linear Congruential Generator if I only know the modulus of the output?
Edit suggested by fgrieu:
I have one hundred integers in $\{0,1,2,3,4,5\}$ which I suspect are consecutive values of $\lfloor x_n/2^{16}\rfloor\bmod6$ computed as $x_{n+1}:=a\cdot x_n+b\bmod m$, with $...
- 53
1
vote
1
answer
315
views
how high is the possibility of getting a hash collision in text files?
Just for an example, let's say I downloaded "the adventures of tom sawyer" from gutenberg in .txt file format and saved it to my usb thumb drive.
And as you can see, usb drive is not an ...
- 13
0
votes
1
answer
234
views
How to find iteration exponent in a cycling attack?
In Simmons and Norris paper they demonstrate the cycling attack with the following example:
p = 383 q = 563 s = 49 and t = 56957 ( a prime)
The attacker knows the publicly available r = pq = 215,629 ,...
0
votes
0
answers
39
views
recover plain text from cipher text in AES-128 ECB mode [duplicate]
I have a scenario where I do not have the key but I have plaintext 1, ciphertext 1, and ciphertext 2. Ciphertext 2 is built using the same key that was used to build ciphertext 1. Is there somehow a ...
- 1
2
votes
2
answers
150
views
How do we find differentials in differential cryptanalysis when we don't the details about the S-boxes
I m new to cryptanalysis and trying to understand differential cryptanalysis. I have read the paper by Howard M. Heys. I understood the concept of differentials but I m not able to understand how to ...
1
vote
1
answer
880
views
cracking a one time pad using key reuse
There is a one time pad which works as follows:
given message "hello" and key "asdfg", it produces "hwoqu". It only works with the 26 english letters. The output is (h(7) ...
- 111
3
votes
1
answer
323
views
How to decide if an element is a public key in NTRU encryption scheme?
First, I'm using the settings of https://en.wikipedia.org/wiki/NTRUEncrypt, with $L_f$ set of polynomials with $d_f+1$ coefficients equal to 1, $d_f$ equal to $-1$ and the remaining $N-2d_f-1$ equal ...
- 325
0
votes
1
answer
87
views
Structure of composition of permutations
If $P_1, P_2$ are finite permutations, what can we say about $P_3 = P_1 \cdot P_2$? That is, what properties of the composition of permutations can be inferred from the properties of the permutations ...
- 135
2
votes
1
answer
249
views
Poly1305 reuse of r
Poly1305 uses $r, r^2, r^3$ and $r^4$. I understand this if $r$ is a generator of the finite field. But since $r$ can be any random non-zero number, won't its exponents be non-uniform distributed? ...
- 135
0
votes
1
answer
103
views
Understanding non-linearity in Salsa20 over various rings
In his design of Salsa20, Bernstein writes to ensure non-linearity he chose
32-bit addition (breaking linearity over $Z/2$),
32-bit xor (breaking linearity over $Z/2^32), and constant-distance 32-bit ...
- 135
2
votes
0
answers
28
views
What are some statisitcal characteristics of a hill cipher?
Given a ciphertext, after performing a frequency analysis on it, how would you identify it as a hill cipher? What should i expect to see in the statistics?
- 21
6
votes
1
answer
299
views
Introduce a reference for cryptanalysis of WhatsApp software
I am studying on cryptanalysis of WhatsApp software. I know this is secure software but I want to present a documentary on this topic as a seminar at the university for applied mathematics students.
...
- 63
1
vote
0
answers
42
views
Algebraic differential cryptanalysis
I have been studying on algebraic methods on cryptanalysis of block ciphers.
This is where I am reading from currently
I need some help to understand Attack C.
Excluding equations from the first r ...
- 35
0
votes
1
answer
156
views
What is the easiest encryption/cipher to brute force?
This is just a casual exploration of what could be effectively the worst possible block cipher, but I think it has some educational value on how ciphers work.
I've been reading about unicity distance ...
- 103
1
vote
2
answers
157
views
Differential analysis of SPN
Reference : Tutorial by HM Heys
If we find a differential trail that holds with some non negligible probability for n-1 rounds for a n rounds SPN structure, then we can recover some of the bits of the ...
- 21
1
vote
1
answer
176
views
Crypt-analysis for finding information hidden in images?
I was wondering if anyone is familiar with any historical aspects (as to whether someone was able to) for discovering code using images on the web as a transport method ? As in hiding byte values in ...
- 13
3
votes
1
answer
165
views
A query regarding SHA256 output hash structure vs input entropy?
Given an Input string of N bytes where some bytes positions in the string are fixed/immutable (F Bytes) and rest of the bytes positions can contain any value as we want or are configurable/variable (V ...
- 151
0
votes
1
answer
34
views
(Non)security of algebraically derived EC keys
I recently had a situation where I needed to derive a secondary Curve25519 private key from an existing one programmatically. The obvious solution was to use a KDF, but I wondered at the time about ...
1
vote
0
answers
106
views
Vigenère cipher with switching keys
I am looking for possible ways of attacking a modified Vigenère cipher. Let's say we have two keys e.g. 'stackoverflow' and 'Vigenère'. The V cipher starts with one of those keys but switches as ...
- 111
1
vote
1
answer
47
views
Is it allowable to put a restriction on the length of the plaintext used in the known-plaintext attack?
The definition of the known-plaintext attack: I have a plaintext and I can encrypt it to have its ciphertext, then I use this pair to break the cipher.
The question:
The only thing I further assume is ...
- 407
1
vote
1
answer
318
views
Decryption of an unknown cipher
How can I identify the cipher that encrypted the data shown below?
I'm very new to this field, so I am not sure.
For example:
How does one know which cipher is used in the following line? How can one ...
- 11
0
votes
0
answers
75
views
Which contemporary programming language is apt for implementation of algorithms in cryptography?
I am a researcher in cryptography. Most of the time I generally do theoretical/Mathematical work only and not doing the implementation part.
I am not able to get the feel about the time complexity of ...
- 431
1
vote
0
answers
49
views
ε-close to t-wise inependence of SPN (AES)
According to theorem 3.13, the 6 rounds of AES is 0.472-close to pairwise independence. It is also mentioned t-wise independence used to analyze higher order derivates attacks. it is also mentioned 3-...
- 1,990
4
votes
1
answer
337
views
What vulnerabilities does the LFSR filter generator have?
As the title suggests, I wonder what kinds of attacks there are in the LFSR filter generator. The most representative attack is the fast correlation attack and inversion attack. I wonder what other ...
- 41
2
votes
2
answers
313
views
Does SHA-256 have (128-time + 128-space = 256-overall)-bit collision resistance?
First, we consider those hash functions that can actually provide 256-bit pre-image security, and not something like SHAKE128<l=256bits> where the sponge ...
- 8,291
-1
votes
1
answer
297
views
Does this paper find cryptographic weakness of SHA-256?
I found only the abstract and tables of this paper
https://dl.acm.org/doi/abs/10.1145/3409501.3409513
From the abstract
In this paper, the researchers proved that the modified SHA256 is viable to ...
- 126
1
vote
1
answer
117
views
CrypTool RSA Features [duplicate]
I am attempting to manually encrypt a plaintext message (message = MI) using RSA.
I receive an answer of: 33,264 and 21,164.
When I enter the same plaintext into CrypTool to confirm that my ...
- 19
1
vote
1
answer
486
views
Why is this DES key considered weak?
I understand the premise of weak keys in DES and cryptography. From searching online, I understand that keys that are comprised of all zeroes / all ones / alternating ones and zeroes / alternating ...
- 19
2
votes
1
answer
86
views
Differential cryptanalysis to ciphertext-only attacks on xxTEA
In my IoT project, I use the xxTEA encryption algorithm to encrypt my data. I use the same encryption key for all my packets because I don't have the possibility to do a key exchange between Alice and ...
- 21
2
votes
0
answers
108
views
Need some help with decryption code for monoalphabetic substitution
I am working on decrypting ciphertext in monoalphabetic substitution algorithm. I tried to decrypt using frequency histogram of English alphabets individually. The percentage of these frequencies can ...
- 21
2
votes
0
answers
122
views
Howgrave-Graham lattice attack on NTRU
I am lookin for a good example to illustrate this attack on NTRU using low parameters but I failed to do that, The attack consist to use LLL reduction on A basis of NTRU Lattice, let us use the column ...
- 396
2
votes
1
answer
139
views
Complexity of Boomerang Attack on COCONUT98
I am trying to understand the paper The Boomerang Attack from David Wagner. On page 162 about complexity of boomerang attack the paper says that:
The attack requires $8 \cdot 2 \cdot 32 \cdot 2^{32} ...
- 45
0
votes
0
answers
28
views
How does a forward search attack work? [duplicate]
I just came across this term “forward search attack” while reading about Interchange key and Session key. The book mentioned that using session key helps to prevent attacks such as forward search ...
2
votes
1
answer
74
views
Is a Test Vector feature a Security Hole?
I have a system where a block cipher key (likely AES) is entered via a 'command line' over a serial console, probably as hex. The system has no 'print key' feature, so the key is hopefully 'ingest ...
- 21
3
votes
1
answer
71
views
Nonlinearity of a Boolean function with odd number of input bits
Highly nonlinear functions are used in combination generators and other stream ciphers.
We know that maximum nonlinearity (hamming distance to all affine functions) of $f$ is achieved when $f$ is bent ...
- 20.1k
3
votes
1
answer
707
views
