Questions tagged [cryptanalysis]
Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).
1,495
questions
3
votes
2
answers
2k
views
Can you help with that definition for a CCA?
The following is a definition taken from Introduction to Modern Cryptography by Katz and Lindell.
I'm having a hard time understanding some basic concepts! Can you please help me?
$\newcommand{\Gen}{\...
- 495
6
votes
1
answer
648
views
What are the consequences of a MAC tag collision?
I've seen some proofs of MAC security that are based on the extremely-unlikely event that two MAC tags collide (ie, they are equal for distinct messages). Suppose that this extremely unlikely event ...
- 4,058
29
votes
2
answers
31k
views
How does a chosen ciphertext attack work, with a simple example?
Can someone please explain - using a simple example - how a chosen ciphertext attack works?
- 495
7
votes
2
answers
1k
views
For public-key encryption, why does COA resistance imply CPA resistance?
My professor told me:
If a public-key crypto-system is secure against ciphertext-only attacks,
then it is also secure against a chosen-plaintext attack.
Why is this true? Is there a proof that ...
- 1,933
10
votes
1
answer
4k
views
Linear Cryptanalysis
What is the principle of linear cryptanalysis, as applied to a block cipher ? For instance, this page gives the rough outline of differential cryptanalysis.
- 1,883
5
votes
2
answers
7k
views
Decrypting DES with decrypted and encrypted data [duplicate]
I got two 8-byte strings.
One which is decrypted is:
FF FF FF FF FF FF FF FF
and one which is encrypted is:
...
user1020540
8
votes
1
answer
2k
views
If the PSK is known, is it possible to decrypt traffic from other clients in a WPA2 wlan network?
If in a public WLAN WPA2-PSK is used, but the PSK is more or less publicly available, does this mean that an attacker with that PSK can easily decrypt wlan traffic from/to other clients of that WLAN?
...
- 183
7
votes
1
answer
2k
views
How to deduce enigma settings given a partial plaintext?
Assuming some large block of text is encrypted with an enigma machine and I only know a small subset of letters before and after encryption, how do I go about figuring out the enigma settings from ...
- 171
3
votes
2
answers
520
views
Getting the encryption method and key from the encrypted data and the raw data
I have some pairs of plaintext and ciphertext data, from which I need to be able to decrypt the other passwords stored in the database.
The password field typically contains something like
...
- 133
4
votes
2
answers
1k
views
How can one break a monoalphbetic substitution chipher at pseudorandom text?
Does anybody know how to break monoalphbetic substitution cipher, if it is applied to some pseudorandom text (for example to some surrogate key filed in a database)?
Let us assume that we have only ...
ipbd
8
votes
1
answer
16k
views
Can Pre-Paid Cards be cracked?
Is it possible to deduce the original function that used to generate those prepaid cards number that are used for charging your mobile phone credits?
For example: If I've collected about 1000 of ...
- 191
3
votes
3
answers
682
views
If Bob steals Alice's private key, how exactly would he read her encrypted documents?
So Bob grabs Alice's secret key when she isn't looking and her encrypted files, doesn't he need to know her passphrase to read her files?
What I am reading is that no he does not need it but as far ...
- 293
6
votes
1
answer
392
views
How exactly would someone attempt to analyse ciphertext produced by popular encryption products such as Truecrypt/PGP?
I am interested in understanding what the process would be if an attacker wished to attempt to decrypt data secured by common tools such as OpenPGP, Truecrypt or the like. Are there any documented ...
- 293
5
votes
1
answer
280
views
Is the last step of an iterated cryptographic hash still as resistant to preimage attacks as the original hash?
Considering a cryptographic hash, such as MD5 or SHA2, denoted by the function $H(m)$ where $m$ is an arbitrary binary string, there is a lot of material available that deals with potential weakness ...
- 151
7
votes
3
answers
6k
views
How to attack a classical cipher using known partial plaintext?
I have a ciphertext generated by a classical cipher. I do not know what was cipher used to generate it. I do however have the beginning of the plaintext.
What are the cryptanalysis approaches for ...
- 71
8
votes
4
answers
400
views
Changing algorithms during encryption
Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption.
For example,...
- 181
5
votes
1
answer
2k
views
What methods allow us to determine the language used in a monoalphabetic substitution cipher?
Working on a cipher (which I assume to be a mono-alphabetic substitution cipher due to the letter frequency) I struggle with the fact that I don't know which language the plain text is written in. ...
- 51
6
votes
4
answers
1k
views
How to forge Schnorr signatures if you can guess the challenge
Underlying the Schnorr signature is an identification protocol: let $G$ be a cyclic group where discrete log is "hard" and choose $g$ as a generator of $G$. Now have Alice pick a random (secret) ...
- 4,058
6
votes
3
answers
4k
views
Understanding CRC [closed]
There are zillions of articles describing CRC. What can I read to (more deeply) understand what's really going on? Both from an algebraic perspective and a bit-manipulation perspective, I'd like to ...
- 329
9
votes
2
answers
6k
views
Brute forcing CRC-32
I'm working on a cryptosystem which uses IDEA. The designer made the mistake of including a CRC-32B hash of the password unencrypted in the header, so that the system can quickly reject bad passwords....
- 329
6
votes
2
answers
403
views
Analysis of Repeatedly Enciphered Plaintext using Same Algorithm / Key?
Please forgive the impracticality of this question, but I'm curious about the behaviors of encryption algorithms applied to their own output.
Suppose I have an encryption algorithm E and (using the ...
- 203
7
votes
1
answer
814
views
Would RSA-encrypting a private key for itself constitute a vulnerability?
I'm planning to encrypt some individual files for storage, using the GnuPG implementation of RSA. If I happened to encrypt the private key corresponding to the public key used for encrypting -- either ...
user408
45
votes
7
answers
11k
views
How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world.
How can we reason about the symmetric ciphers cryptanalysis ...
- 703
4
votes
2
answers
2k
views
What is the smallest plaintext/ciphertext size for an algorithm like?
When I read about a choosen plaintext attack, for example on AES the block size is always 128 bits, does it mean the attacker will only supply 128 bits data words as "plain text" ?
- 703
5
votes
1
answer
323
views
If a cryptanalytic breakthrough is made, what process should be followed?
If a researcher manages to make a cryptanalytic breakthrough on a cryptographic algorithm or protocol that is in use, what should they do?
Has this ever happened before? What are the implications for ...
- 383
7
votes
2
answers
273
views
How are constructs with data-dependent swaps and rotations cryptanalyzed?
Linear and differential cryptanalysis seem well suited for constructs with a (relatively) simple fixed structure of boolean expressions. But some ciphers incorporate swaps of array elements where the ...
- 1,866
42
votes
3
answers
20k
views
Why does nobody use (or break) the Camellia Cipher?
If Camellia is of equivalent security and speed to AES, concerns arise.
First of all, assuming the above, why is Camellia so rarely used in practice?
Why aren't there any breaks in Camellia? Does ...
- 1,192
19
votes
2
answers
3k
views
How long would the 100 Year Cryptography Project have secured its data had it been started 100 years ago?
The goal of the Tahoe-LAFS 100 Year Cryptography project is to "enhance Tahoe-LAFS's cryptographic system so that Tahoe shipped today/next year might remain safe from cryptographic attacks for a 100 ...
- 1,866
6
votes
2
answers
356
views
Proof that Alternating Step Generator and modifed ASG' have equivalent security?
The Alternating Step Generator (ASG) is a PRNG combining 3 LFSRs. Output of the ASG is the XOR of the output of two clock-gated LFSRs. At each step, a single one of these LFSRs is clocked, according ...
- 134k
9
votes
3
answers
1k
views
Is there an algorithm to find the number of intersections of two sets?
Suppose both I and my friend have a set of integer numbers. We want to know the number of common elements in our two sets but without knowing elements of the sets of each other. So I don't want my ...
- 93
11
votes
3
answers
757
views
Are these emerging threats against AES affecting your designs?
Recentally, an attack on AES was discovered which reduces its computationally complexity, by a very slight amount.
The first key recovery attack on the full AES-128 with computational
complexity $2^{...
- 1,486
54
votes
10
answers
14k
views
Now that quantum computers have been out for a while, has RSA been cracked?
D-wave systems has released a commercially viable quantum computer. This means in theory, that all asymmetric encryption algorithms — such as RSA — are now useless due to the speed at which quantum ...
- 961
4
votes
3
answers
436
views
Where can I find useful data for cryptography/coding theory?
When implementing cryptographic/coding theory algorithms one need to use data like big prime numbers, numbers in $Z_n$ and their inverses, irreducible polynomials in $Z_n[x]$ and so on...
While ...
- 441
1
vote
1
answer
6k
views
The use of cribs [closed]
I'm looking to incorporate more crib usage in breaking ciphers in unknown enciphering schemes, or at least to gleam what information I may. This seems to be a big hurdle to me, and I'm looking for ...
- 2,309
12
votes
1
answer
16k
views
How does the index of coincidence work in the Kasiki test?
I'm starting to learn about cryptanalysis and I am having a bit of difficulty understanding the Kasiski test's index of coincidence. I have a book (Cryptography Theory And Practice by Douglas Stinson) ...
- 121
20
votes
3
answers
11k
views
Cryptanalysis to reverse engineer a hash?
I understand this may not be the best place to ask a question like this, but I believe that this community may be the best/only place I can ask such a question.
I have inputs and outputs from an in-...
- 211
15
votes
1
answer
2k
views
Security of N bit HMAC
Lets say that I am using 128 bit HMAC. How many operations are needed to find a "non secure" message. Is a birthday attack possible?
- 451
14
votes
4
answers
603
views
Tactics available to help prove security of a new system?
I believe that the accepted tactic to "prove" a system as secure is to allow the crypto-community to review it and if no vulnerabilities are found over a long period of time (5 or 6 years), then a new ...
- 831
7
votes
2
answers
341
views
Are there any tools for expressing the cipher operations as a system of equations?
The first step In Algebraic-attack is expressing the cipher operations as a system of equations. Is there an automated tool to do this?
- 3,972
30
votes
9
answers
35k
views
RSA with small exponents?
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
- 1,641
118
votes
7
answers
115k
views
Taking advantage of one-time pad key reuse?
Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel. Alice and Bob have a shared key $k$; however, both messages are the same length as the ...
- 1,641
22
votes
2
answers
13k
views
What are the main weaknesses of a Playfair cipher, if any?
What are the main weaknesses of a Playfair cipher, if any?
I know that they depend on none of the letters missing, but that is an easy fix if a letter gets dropped. Besides that, are there any other ...
- 383
31
votes
2
answers
5k
views
How do I apply differential cryptanalysis to a block cipher?
I have read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are – for example – vulnerable to differential cryptanalysis....
user46
20
votes
2
answers
2k
views
What is the general justification for the hardness of finding preimages for cryptographic hash functions?
Since most cryptographic hash functions are simple, compact constructions does this simplicity impose a limit on the complexity and the size of a function that can generate preimages? That is, given a ...
- 2,256
17
votes
4
answers
3k
views
Is Wiener's attack on RSA extendable to larger keys with low hamming weight?
Using small private exponents with RSA improves performance.
However, it has been shown (Wiener, 1990) that if $\log d \leq \frac14 \log N$, the private exponent $d$ can be reconstructed from the ...
SecureFish