Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

1,496 questions
Filter by
Sorted by
Tagged with
1 vote
343 views

How to determine secp256r1 or secp256k1 is used on the web sites

I'm pretty new at Cryptography (and at Cryptanalysis), but I went to the website Elliptic to try to discover the elliptic curve they use, and I found they use ECDP 256. So, by SEC2 I discovered they ...
1 vote
84 views

I am using a 8 bit Sbox having 16 entries with a lookup table of 4x4 in cryptographic algorithm. Sbox is constructed on subgroup of galois field 2^8. I want to calculate number of quadratic equations ...
• 11
237 views

Does the diffie helman rachet in double ratchet do anything if one side never replies?

I am a little confused on how this functions so apologies in advance if the question is naive. The way i understand it, the function of the standard sending and receiving ratchets in Double Ratchet is ...
• 45
319 views

Cryptographic Principles: Bit-Flipping Attack

I'm working and reading about bit-flipping attack and how to set it up. I just got a question, which I am not sure, how I should answer. Question: 'Why is this easy with a stream cipher but not ...
1k views

Comparison of SNARK-friendly hash algorithms MiMC7, Poseidon, Pederson?

There are some cryptographically secure hash algorithms designed to be efficient for SNARKs, STARKs and FHE. Some of them already implemented in Zcash, Zokrates and circom. The ones that I know of are:...
• 941
1 vote
84 views

Paillier estimate attack costs on short keys

I was thinking about how to use the homeomorphic property of that cryptosystem to achieve not a "semantic security" but a less ambitous obfuscation of the source code (an ipotetical scenario ...
• 361
40 views

Difficult to guess the targeted receiver

The protocol is defined as : Bob want to send message to one of his friends say $k$ friends , he does not want his others friends (except one whom he want to send message ) to tell who is targeted ...
• 49
205 views

How to find Difference distribution table of DES S box?

I Have used Sage command ...
33 views

How do I model this system?

I was trying to work out the security of an system that used the polarized LCD panel over an OLED display (the point being that you can only block certain pixels) and the pixels are either on or off (...
377 views

Examples of Weak Cryptography being exploited in the wild by cybercriminals?

As a theorist, I often motivate the need for strong cryptography via simplistic methods, such as "If this did not exist, your online bank transactions would be vulnerable". This is of course ...
• 10.8k
122 views

Using $key^{th}$ multiple of $\pi$ as a one-time pad

With a key $k$ of sufficient length, say 128 bits, is it possible to use $k^{th}$ multiple of $\pi$ as a one-time pad? Please enlighten on the security as well as practical aspects (only if secure of ...
• 319
99 views

What are "unspecified" differentials in a differential characteristic?

I've been studying many papers on differential cryptanalysis and I see that in the published differential characteristics, such as in the appendices of [1], [2] and [3], some differences are left &...
92 views

How exactly to concatenate two differential trails to form a boomerang disguisher in practice?

I've been reading many papers on boomerang/rectangle attacks. The general strategy is to find two trails for a small number of rounds and then concatenate them to form a longer distinguisher. ...
295 views

Can Big Data together with deep neural networks attack RSA by affording the vast calculation of prime multiplications in advance?

This is a spin-off from Can Big Data attack RSA by just calculating many prime multiplications in advance? [duplicate]. Intro I am somewhat new to cryptography. Repeating the basics of RSA from How ...
85 views

Can Big Data attack RSA by just calculating many prime multiplications in advance? [duplicate]

Intro I am somewhat new to cryptography. Repeating the basics of RSA from How are the primes used to generate RSA keys?: Textbooks say the one-way function is merely two primes (with some critical ...
171 views

How does AES bit security increase by round?

As AES progresses through multiple rounds, approximately how does it security increase round by round up to its maximum? I'm curious about the shape of the curve. Is it linear, some kind of ...
1 vote
192 views

In the reduction proof below, where OWF exists only if is a PRG. I am not able to understand the highlighted part

I am able to understand how G(x) id generated. But then what is the use of variable z. Also if the probability is >1/2 + e then the distinguisher wins! Then how is this still a OWF
1 vote
66 views

How to prove that the given encryption scheme have ciphertext indistinguishability for all PPT adversaries?

I am not sure how to prove that the given two scheme is perfectly indistinguishable for all PPT adversaries!
1 vote
339 views

Any famous approach for analyzing the randomness of data?

I'm writing a function that will allow me to analyze the randomness of some input data and return some stats about the probability of this data to be random. Obviously it should be based on two things:...
• 113
173 views

Affine Cipher: what to do if the number isnt invertible over mod n? [duplicate]

I am currently solving a simple cryptanalysis problem where I need to decrypt a text file using frequency analysis. The text has been encrypted using an affine cipher over a 68 character alphabet ...
107 views

Backdoor Designer Key Recovery in LowMC-M

The paper https://eprint.iacr.org/2020/986.pdf proposed a framework for embedding a malicious backdoor in LowMC cipher, that will later help the designer to recover the secret key in the known-...
• 31
1 vote
129 views

Hashes as mutually independent keys

For cascading encryption (ie. AES-Twofish-Serpent), the most secure implementation is with mutually independent keys. My question is if it is secure to hash the previous key for each layer of ...
• 421
1 vote
62 views

What is the easiest cipher to use in designing double ciphers?

I want to make a double cipher consisting of two encryption method Enc1 and Enc2, and two corresponding decryption mechanisms Dec1 and Dec2. I want it so that: (1) we can encrypt any message M1 to a ...
1 vote
133 views

Is this constant-time comparison secure?

I was thinking about constant-time comparison and how it differs from "==", when I thought of a simple way that's could be constant-time. Being a beginner in cryptography, I'd like to know ...
• 421
1 vote
221 views

How does the frequency work with Vigenère Cipher?

So I have an unknown key but with the length of 6. I understand that I calculate my own English letter frequency of my letters. I then compare it with the standard English letter frequency and ...
68 views

Can a broken cipher reveal the key?

Suppose I cascade cipher A and cipher B to encrypt a message. Both ciphers use the same key. I know that theoretically, the security of the setup when used correctly is at least as secure as the most ...
• 421
2k views

What are best practices for long term storage (~20 years) of encrypted / sensitive files?

I have some very sensitive family files that I want to store in the cloud on multiple providers for maximal reliability and redundancy. It's essentially a large archive of all our family photos, ...
• 421
52 views

Fundamentals of XL algorithm

I am trying to understand XL algorithm and F4/F5 algorithms for solving multivariate polynomial systems. Is XL related to the Grobner basis? I would be grateful if anyone could suggest me the topics (...
• 21
259 views

How to decode Playfair when only a small part of key is available?

How to decode Playfair when only a small part of key is available? What is the plain text for this message? Can someone explain how to recover the plain text for this message? Is there a program that ...
362 views

Is tagging the hash of a password along with ciphertext secure?

Suppose I have a password, in which I use Argon2ID with 1GB memory to derive an encryption key. Then, I encrypt my data using XChaCha20 using that encryption key. The problem with ChaCha is that any ...
• 421
284 views

One-time pad: Using Cribdrag for Decipherment and Key Recovery

I have been given three different strings: ...
• 117
78 views

Reversing black box algorithm

I'm trying to solve the next problem: We have X - input vector, its length is 128 bits. Output vector Y, its length 2048 bits. ...
186 views

Do CCM and EAX provide key commitment?

In an interesting paper called "Partitioning Oracle Attacks" by Julia Len, Paul Grubbs & Thomas Ristenpart an attack is presented on 1.5 pass AEAD schemes that utilize GMAC (GCM, AES-GCM,...
66 views

Is there a LPN estimator like LWE?

I recently studied the LPN problem and BKW algorithm for solving LPN problem. Several papers deal with the concrete parameters of LPN to be secure against BKW algorithm, but I cannot measure the ...
• 149
202 views

Significance of parameter q in NTRU lattice attack

In NTRU (N,p,q,d), N is usually chosen to be prime and q be a power of 2. Why is it that if I increase the parameter q, the probability of finding a key or spurious key that can decrypt the message is ...
• 237
772 views

The chi-square test for cryptography

I have a question about the chi-square test How can we use it in cryptography? And what results should we expect from it when a file is encrypted? I mean, when a file is encrypted, should its value ...
• 43
1 vote
468 views

Known Plaintext attacks using standard greetings etc

In all modern ciphers, even if one bit of input changes, then half of the output will change because of diffusion. Considering this, how exactly will knowing standard salutations, etc. ("Hello ...
• 2,310
1 vote
1k views

Is it theoretically possible to create an unbreakable cipher?

I know this question might sound strange, but is it theoretically possible to create an unbreakable cipher if we don't consider bruteforce? Some of us believe that it is possible to create ciphers and ...
• 421
8k views

Why don't we use Blowfish if it hasn't been cracked?

Since Blowfish is old, well-audited, and has no published attacks, why are we using AES instead? I know that Bruce Schneier said that Blowfish is insecure and told people to transition to Twofish, but ...
• 421
74 views

Cascading encryption with blocks or output

For educational purposes, I'm trying to build a cascading encryption implementation with AES, Twofish, Blowfish, Salsa20, and ChaCha20. First of all, please don't judge my paranoia or choices, this is ...
• 421
1k views

How to determine which type of transposition cipher I have?

I have some ciphertext that I have determined using frequency analysis to be most likely encrypted using a transposition cipher, as the letter frequencies are similar to plain English language text. I ...
175 views

Truth table for the Boolean function $f(x,y) = x \oplus xy$ - Conflict with answer computed by sagemath

By hand, I computed $f(x,y) = x \oplus xy = (0, 0, 1, 0)$ since, in ascending (lexicographical) order, $f(0,0) = 0 \\ f(0,1) = 0 \\f(1,0) = 1 \\ f(1,1) = 0$ However, using the following code on ...
• 175
246 views

Why is the nonlinearity of this Boolean function evaluating to $\frac12$?

I am using the method presented in this paper to find the nonlinearity of the function $$f: \mathbb{F}^1_2 \to \mathbb{F}^1_2 \\ f(x) = x$$ The truth table is $f = [0 \space \space 1]$. Now, I read ...
• 175
1 vote
220 views

AES 5 and 6 round SQUARE Attack

SQUARE attack on AES128 requires a single delta set for 4-round variant, or I assume single delta set is enough since keyspace is reduced to few keys which can be easily brute-forced. However, as we ...
55 views

1 vote