Questions tagged [cryptanalysis]
Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).
1,496
questions
1
vote
1
answer
343
views
How to determine secp256r1 or secp256k1 is used on the web sites
I'm pretty new at Cryptography (and at Cryptanalysis), but I went to the website Elliptic to try to discover the elliptic curve they use, and I found they use ECDP 256. So, by SEC2 I discovered they ...
- 45
1
vote
1
answer
84
views
Quadratic Equations to Describe SBox
I am using a 8 bit Sbox having 16 entries with a lookup table of 4x4 in cryptographic algorithm. Sbox is constructed on subgroup of galois field 2^8. I want to calculate number of quadratic equations ...
- 11
2
votes
2
answers
237
views
Does the diffie helman rachet in double ratchet do anything if one side never replies?
I am a little confused on how this functions so apologies in advance if the question is naive.
The way i understand it, the function of the standard sending and receiving ratchets in Double Ratchet is ...
- 45
0
votes
0
answers
319
views
Cryptographic Principles: Bit-Flipping Attack
I'm working and reading about bit-flipping attack and how to set it up. I just got a question, which I am not sure, how I should answer.
Question: 'Why is this easy with a stream cipher but not ...
- 1
9
votes
0
answers
1k
views
Comparison of SNARK-friendly hash algorithms MiMC7, Poseidon, Pederson?
There are some cryptographically secure hash algorithms designed to be efficient for SNARKs, STARKs and FHE. Some of them already implemented in Zcash, Zokrates and circom. The ones that I know of are:...
- 941
1
vote
1
answer
84
views
Paillier estimate attack costs on short keys
I was thinking about how to use the homeomorphic property of that cryptosystem to achieve not a "semantic security" but a less ambitous obfuscation of the source code (an ipotetical scenario ...
- 361
0
votes
0
answers
40
views
Difficult to guess the targeted receiver
The protocol is defined as :
Bob want to send message to one of his friends say $k$ friends , he does not want his others friends (except one whom he want to send message ) to tell who is targeted ...
- 49
0
votes
0
answers
205
views
0
votes
0
answers
33
views
How do I model this system?
I was trying to work out the security of an system that used the polarized LCD panel over an OLED display (the point being that you can only block certain pixels) and the pixels are either on or off (...
6
votes
2
answers
377
views
Examples of Weak Cryptography being exploited in the wild by cybercriminals?
As a theorist, I often motivate the need for strong cryptography via simplistic methods, such as "If this did not exist, your online bank transactions would be vulnerable". This is of course ...
- 10.8k
3
votes
2
answers
122
views
Using $key^{th}$ multiple of $\pi$ as a one-time pad
With a key $k$ of sufficient length, say 128 bits, is it possible to use $k^{th}$ multiple of $\pi$ as a one-time pad?
Please enlighten on the security as well as practical aspects (only if secure of ...
- 319
3
votes
1
answer
99
views
What are "unspecified" differentials in a differential characteristic?
I've been studying many papers on differential cryptanalysis and I see that in the published differential characteristics, such as in the appendices of [1], [2] and [3], some differences are left &...
- 63
3
votes
1
answer
92
views
How exactly to concatenate two differential trails to form a boomerang disguisher in practice?
I've been reading many papers on boomerang/rectangle attacks. The general strategy is to find two trails for a small number of rounds and then concatenate them to form a longer distinguisher. ...
- 63
-3
votes
1
answer
295
views
Can Big Data together with deep neural networks attack RSA by affording the vast calculation of prime multiplications in advance?
This is a spin-off from Can Big Data attack RSA by just calculating many prime multiplications in advance? [duplicate].
Intro
I am somewhat new to cryptography.
Repeating the basics of RSA from How ...
- 99
0
votes
0
answers
85
views
Can Big Data attack RSA by just calculating many prime multiplications in advance? [duplicate]
Intro
I am somewhat new to cryptography.
Repeating the basics of RSA from How are the primes used to generate RSA keys?:
Textbooks say the one-way function is merely two primes (with some
critical ...
- 99
3
votes
1
answer
171
views
How does AES bit security increase by round?
As AES progresses through multiple rounds, approximately how does it security increase round by round up to its maximum? I'm curious about the shape of the curve. Is it linear, some kind of ...
- 876
1
vote
1
answer
192
views
In the reduction proof below, where OWF exists only if is a PRG. I am not able to understand the highlighted part
I am able to understand how G(x) id generated. But then what is the use of variable z. Also if the probability is >1/2 + e then the distinguisher wins! Then how is this still a OWF
1
vote
0
answers
66
views
How to prove that the given encryption scheme have ciphertext indistinguishability for all PPT adversaries?
I am not sure how to prove that the given two scheme is perfectly indistinguishable for all PPT adversaries!
1
vote
4
answers
339
views
Any famous approach for analyzing the randomness of data?
I'm writing a function that will allow me to analyze the randomness of some input data and return some stats about the probability of this data to be random.
Obviously it should be based on two things:...
- 113
0
votes
1
answer
173
views
Affine Cipher: what to do if the number isnt invertible over mod n? [duplicate]
I am currently solving a simple cryptanalysis problem where I need to decrypt a text file using frequency analysis. The text has been encrypted using an affine cipher over a 68 character alphabet ...
- 123
3
votes
1
answer
107
views
Backdoor Designer Key Recovery in LowMC-M
The paper https://eprint.iacr.org/2020/986.pdf proposed a framework for embedding a malicious backdoor in LowMC cipher, that will later help the designer to recover the secret key in the known-...
- 31
1
vote
2
answers
129
views
Hashes as mutually independent keys
For cascading encryption (ie. AES-Twofish-Serpent), the most secure implementation is with mutually independent keys. My question is if it is secure to hash the previous key for each layer of ...
- 421
1
vote
0
answers
62
views
What is the easiest cipher to use in designing double ciphers?
I want to make a double cipher consisting of two encryption method Enc1 and Enc2, and two corresponding decryption mechanisms Dec1 and Dec2. I want it so that:
(1) we can encrypt any message M1 to a ...
- 31
1
vote
1
answer
133
views
Is this constant-time comparison secure?
I was thinking about constant-time comparison and how it differs from "==", when I thought of a simple way that's could be constant-time. Being a beginner in cryptography, I'd like to know ...
- 421
1
vote
1
answer
221
views
How does the frequency work with Vigenère Cipher?
So I have an unknown key but with the length of 6. I understand that I calculate my own English letter frequency of my letters. I then compare it with the standard English letter frequency and ...
- 11
0
votes
1
answer
68
views
Can a broken cipher reveal the key?
Suppose I cascade cipher A and cipher B to encrypt a message. Both ciphers use the same key. I know that theoretically, the security of the setup when used correctly is at least as secure as the most ...
- 421
3
votes
2
answers
2k
views
What are best practices for long term storage (~20 years) of encrypted / sensitive files?
I have some very sensitive family files that I want to store in the cloud on multiple providers for maximal reliability and redundancy. It's essentially a large archive of all our family photos, ...
- 421
0
votes
0
answers
52
views
Fundamentals of XL algorithm
I am trying to understand XL algorithm and F4/F5 algorithms for solving multivariate polynomial systems.
Is XL related to the Grobner basis?
I would be grateful if anyone could suggest me the topics (...
- 21
2
votes
2
answers
259
views
How to decode Playfair when only a small part of key is available?
How to decode Playfair when only a small part of key is available?
What is the plain text for this message?
Can someone explain how to recover the plain text for this message?
Is there a program that ...
2
votes
1
answer
362
views
Is tagging the hash of a password along with ciphertext secure?
Suppose I have a password, in which I use Argon2ID with 1GB memory to derive an encryption key. Then, I encrypt my data using XChaCha20 using that encryption key. The problem with ChaCha is that any ...
- 421
0
votes
0
answers
284
views
One-time pad: Using Cribdrag for Decipherment and Key Recovery
I have been given three different strings:
...
- 117
0
votes
0
answers
78
views
Reversing black box algorithm
I'm trying to solve the next problem:
We have X - input vector, its length is 128 bits.
Output vector Y, its length 2048 bits. ...
10
votes
0
answers
186
views
Do CCM and EAX provide key commitment?
In an interesting paper called "Partitioning Oracle Attacks" by Julia Len, Paul Grubbs & Thomas Ristenpart an attack is presented on 1.5 pass AEAD schemes that utilize GMAC (GCM, AES-GCM,...
- 90.2k
0
votes
0
answers
66
views
Is there a LPN estimator like LWE?
I recently studied the LPN problem and BKW algorithm for solving LPN problem. Several papers deal with the concrete parameters of LPN to be secure against BKW algorithm, but I cannot measure the ...
- 149
2
votes
1
answer
202
views
Significance of parameter q in NTRU lattice attack
In NTRU (N,p,q,d), N is usually chosen to be prime and q be a power of 2. Why is it that if I increase the parameter q, the probability of finding a key or spurious key that can decrypt the message is ...
- 237
4
votes
1
answer
772
views
The chi-square test for cryptography
I have a question about the chi-square test How can we use it in cryptography? And what results should we expect from it when a file is encrypted? I mean, when a file is encrypted, should its value ...
- 43
1
vote
2
answers
468
views
Known Plaintext attacks using standard greetings etc
In all modern ciphers, even if one bit of input changes, then half of the output will change because of diffusion. Considering this, how exactly will knowing standard salutations, etc. ("Hello ...
- 2,310
1
vote
5
answers
1k
views
Is it theoretically possible to create an unbreakable cipher?
I know this question might sound strange, but is it theoretically possible to create an unbreakable cipher if we don't consider bruteforce? Some of us believe that it is possible to create ciphers and ...
- 421
13
votes
2
answers
8k
views
Why don't we use Blowfish if it hasn't been cracked?
Since Blowfish is old, well-audited, and has no published attacks, why are we using AES instead? I know that Bruce Schneier said that Blowfish is insecure and told people to transition to Twofish, but ...
- 421
0
votes
0
answers
74
views
Cascading encryption with blocks or output
For educational purposes, I'm trying to build a cascading encryption implementation with AES, Twofish, Blowfish, Salsa20, and ChaCha20. First of all, please don't judge my paranoia or choices, this is ...
- 421
3
votes
2
answers
1k
views
How to determine which type of transposition cipher I have?
I have some ciphertext that I have determined using frequency analysis to be most likely encrypted using a transposition cipher, as the letter frequencies are similar to plain English language text. I ...
2
votes
1
answer
175
views
Truth table for the Boolean function $f(x,y) = x \oplus xy$ - Conflict with answer computed by sagemath
By hand, I computed $f(x,y) = x \oplus xy = (0, 0, 1, 0)$ since, in ascending (lexicographical) order,
$f(0,0) = 0 \\ f(0,1) = 0 \\f(1,0) = 1 \\ f(1,1) = 0$
However, using the following code on ...
- 175
3
votes
2
answers
246
views
Why is the nonlinearity of this Boolean function evaluating to $\frac12$?
I am using the method presented in this paper to find the nonlinearity of the function
$$ f: \mathbb{F}^1_2 \to \mathbb{F}^1_2 \\ f(x) = x$$
The truth table is $f = [0 \space \space 1]$. Now, I read ...
- 175
1
vote
1
answer
220
views
AES 5 and 6 round SQUARE Attack
SQUARE attack on AES128 requires a single delta set for 4-round variant, or I assume single delta set is enough since keyspace is reduced to few keys which can be easily brute-forced. However, as we ...
- 96
2
votes
0
answers
55
views
How is the 'Algebraic Degree' calculated in the paper about analysing the white-box AES(Chow et al. 2002) by exploiting internal collisions?
This paper proposed a new attack on the initial white-box AES implementation of Chow et al.
In order to determine the good solution, we use the
particular structure of the function $S_{0}$.
$S^{-1} \...
- 21
1
vote
0
answers
60
views
Kernel attack on MinRank - How do we check if we can stop?
I have some trouble understanding how Kernel Attack to MinRank is implemented.
MinRank: Let $k, n, r$ be positive integers, and let $M_0, M_1, \dots, M_k$ be $n \times n$ matrices with entries in a ...
- 11
0
votes
1
answer
111
views
The Probability to Detect or Identify an Unknown Ciphertext
Let $\it C$ be a ciphertext such that we have no information about the type of symmetric encryption algorithm used to generate $\it C$.
Let $\bf S$ be the source bank of most block and stream ciphers ...
- 253
1
vote
2
answers
211
views
RSA algorithm implementation
$$m^{ed} \equiv m \bmod n$$
$n =pq$, so by Chinese Remainder Theorem it is equivalent to
$$m^{ed} \equiv m \bmod 𝑝, m^{ed} \equiv m \bmod q$$
where $n=p\cdot q$
So how did 2 come from 1 by the ...
- 19
1
vote
0
answers
54
views
cascade encryption - If I encrypt my data using many different encryption algorithms
If I encrypt my data using many different encryption algorithms (using different passwords)
how will an adversary be able to decipher the message?
- 11
0
votes
1
answer
68
views
Time and Space complexity of MiniAES
I am currently doing my masters research on security of wireless sensor networks, the topic is "ENHANCING THE SECURITY OF WIRLESS SENSOR NETWORKS BY COMBINING GEOENCRYPTION AND LIGHT WEIGHT ...