Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

Filter by
Sorted by
Tagged with
1 vote
0 answers
37 views

Size of messages in timing attack on RSA Montgomery

I'm codin' timing attack on RSA Montgomery which compares two sets ( the first one includes those which need a reduction in contrary to the second one ). But I got troubles with the Montgomery ...
0 votes
2 answers
123 views

AES ECB deterministic encryption to perform Private set intersection

There are two parties, and each has a list of plain-texts. My end goal is to assign indices to unique plain-texts across both parties. My present approach is the following. Both parties perform a ...
0 votes
1 answer
62 views

Canonical inclusion map in subfield attack on overstretched NTRU

I'm trying to understand subfield attacks on overstretched NTRU. In the paper https://eprint.iacr.org/2016/127.pdf authors used "canonical inclusion map" to lift vector to full lattice. What does ...
  • 103
0 votes
0 answers
113 views

Can someone explain the timing attack on RSA with Montgomery multiplication?

I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle. I understood that there is a additional ...
3 votes
1 answer
185 views

Is it possible to predict a randomly generated BigInteger that uses Java's default Random library?

I've seen it posted on different forms here and here that explain how java.util.Random library uses a linear congruential pseudorandom number generator which can be ...
1 vote
0 answers
58 views

Is there any appropriate way to break a specific S-BOX?

I have just started learning cryptography. And I came across such a question that had troubled me for several days. The picture contains an LFSR and an S-Box. The LFSR is 32-bit long and the inside ...
1 vote
0 answers
126 views

Rivest - Time Memory Tradeoff Using Distinguished Points

A while ago, Hellman introduced a time-memory tradeoff for chosen plaintext attack on block ciphers. There is an innovation due Rivest using a concept of 'distinguished points'. I am looking for the ...
  • 305
1 vote
1 answer
296 views

What is the current security level of an algorithm?

I was reading a paper of some years ago about a cryptography and a phrase got my attention. We want to ensure a security level of at least $2^{80}$ I know that $2^{80}$ was used as rule of thumb ...
  • 179
2 votes
1 answer
166 views

Cryptanalysis of a feedback shift reigister with an S-box

I’m just getting started on learning cryptography and here is a problem from exercises about which I'm totally confused: This is a 32-bit feedback shift register to encrypt some message. The register ...
2 votes
1 answer
439 views

Excluding specific factors for Pohlig-Hellman

I want to use Pohlig-Hellman and BSGS to solve the discrete log of an Elliptic Curve which has a composite order generator. The ...
  • 1,284
2 votes
1 answer
100 views

Is there any way to find out two numbers such that the XOR between them is a given number?

I have the following operation I took from a cryptanalysis I'm performing for a specific CBC encryption where the challenger has provided the key: ...
  • 253
-1 votes
1 answer
46 views

how to predict a sequence for reverse engineering of a ticketing system [closed]

i am student in the fith year of college IT-science and a crypto noob. i have been wondering how the folwing sequence of ticket i bougth in all at once were built for : how they work or how they are ...
  • 1
1 vote
1 answer
140 views

Nonce of AES-GCM generated by Counters

i am trying to generate the nonce for AES-GCM. I know people usually generate it by Counters and LFSRs. I am confused about the meaning of Counters. Is that means Counter (CTR)? Why it can generate ...
1 vote
0 answers
55 views

What is the exact algorithm for encryption and decryption with hummingbird-1 cryptography?

I have really googled the entire internet but could not find a clear algorithm for hummingbird-1 cryptography.The problem emerges in the decryption module: What is the initial value of state register ...
2 votes
0 answers
33 views

Unknown bit in the output of encryption of data using SIMECK32 cipher?

How is the unknown bits (annotated by red arrow in figure below) come in the OUTPUT after round 1 and round 2 ? Following is the pictorial representation of SIMECK round function operation. Ref: ...
  • 121
1 vote
1 answer
333 views

How to calculate the redundancy of a language

I originally asked this question on the information security stack exchange but I think it's better suited here. I'm trying to calculating the unicity distance for a cipher applied to a language I ...
  • 11
1 vote
2 answers
253 views

Symmetric versus asymmetric self encryption

I can encrypt my files with a symmetric encryption algorithm like AES, or with an asymmetric encryption algorithm like RSA or ECC (I encrypt my files with my own public key). No communication is ...
1 vote
1 answer
116 views

Classification of attacks against lattices

I'm interested about the cryptanalysis side of lattice-based cryptography, and was wondering whether there is a survey paper or something that gives some classification of attacks against lattices, ...
  • 1,125
2 votes
2 answers
1k views

Relationship between $N$ and $\phi(N)$ in the RSA algorithm

Recently I started learning how the RSA algorithm works and there is one single part of the computation which really confuses me and can't get over it. Let's say I chose 2 prime numbers, namely $P ...
1 vote
0 answers
47 views

Are there any state of the art crypanalysis tools for stream cipher

I am new to cryptanalysis and interested in knowing cryptanalysis tools (black boxing or white boxing) for (not any specific) stream ciphers in general sense. Scenario: I am given an assignment to ...
  • 151
2 votes
1 answer
566 views

Dieharder input file with a sequence of only binary numbers

I have a RNG producing sequences of binary numbers, ad I would like to run Dieharder test using them as an ascii txt input file. However I haven't been able to do it properly. Should I use a header ...
  • 31
5 votes
1 answer
188 views

Use large key size for RC4 to avoid RC4 bias

I saw a question on StackOverflow where RC4 was initialized by a 1024 bit key (with 2048 the maximum key size, if I'm not mistaken). Will such a large key size possibly solve any of the bias of the ...
  • 86.4k
3 votes
1 answer
230 views

Insecure MAC built on pseudorandom function

this is a question about Katz-Lindell book, introduction to modern cryptography, 2nd edition, exercise 4.7, part c. For (a) and (b) it is clear that the Macs are insecure, but for (c) I am struggling ...
1 vote
0 answers
68 views

Help on Algebraic Side Channel Attacks

I am a master student in computer security, I am preparing a dissertation thesis in the theme is: Algebraic cryptanalys by auxiliary channels, I need reference on this theme (book, thesis, ...), and ...
1 vote
1 answer
176 views

Is there any practical use of reduced rounds of AES

There are lots of attacks which are on reduced block ciphers. There are practical attack on five rounds of AES-128five rounds aes broken in six minutes. I was just wondering if there is any practical ...
  • 157
1 vote
1 answer
143 views

Can zkSNARK or other zero-knowledge proofs be used to proof message authenticity without revealing private key?

The situation: Alice and Bob are exchanging messages encrypted by some known asymmetric encryption protocol. All their encrypted messages, as well as public keys are intercepted by Charlie. Can ...
's user avatar
0 votes
1 answer
129 views

Factorization problem

Say, $X= a\cdot b$, where $(a, b) \in Z_q^*$ and $q$ is a large prime. If $X$ is given, then what is the complexity (or hardness) of finding $a$ and $b$? Note that, either $a$ or $b$ can be reused to ...
  • 75
2 votes
1 answer
85 views

Correlation power analysis attack on Camellia

I'm investigating a correlation power analysis on a black-box ASIC I have. I want to learn about correlation analysis and it seems this ASIC implements Camellia. I searched for researches that did ...
  • 41
1 vote
1 answer
97 views

18 rounds encryption in embedded?

I have a power trace of a decryption. It seems like I'm watching a 18 rounds decryption algorithm. I cannot think about any other algorithm implemented in ASIC except Cammelia who has 18 rounds. ...
  • 41
1 vote
1 answer
76 views

How to find a small generator with small inverse? Does it have negative impact to security? (for Schnorr subgroup of $\mathbb{Z}/P\mathbb{Z}$)

Given a prime $P$ with $$P= r \cdot q+1$$ with $q$ prime as well. I'm looking for a generator $g$ of the Schnorr subgroup with order $q$ which is small by value and has a inverse (to $\bmod P$) which ...
  • 475
1 vote
1 answer
84 views

What are the security implications of knowing the private polynomial $\mathcal{F}$

First, affine transformations $S,T$ are defined by $S=A_1+v_s, T=A_2+v_t$. Let the private polynomial function $\mathcal{F}$ be known. The short description of the public key map is $P(X) = T \circ \...
  • 888
1 vote
2 answers
290 views

Is there a feasible way to reconstruct the key from the (Triple-)DES round key?

Assume there is a closed source application which uses Triple-DES with a fixed/hardcoded key to decrypt large amounts of data. Someone managed to extract the round keys from a process memory dump and ...
  • 113
7 votes
0 answers
281 views

Which is the smallest safe elliptic curve (bit-length)?

At https://safecurves.cr.yp.to/ some elliptic curves are listed which passed certain security tests. The smallest bit-length of a safe curve listed there is 221 bits. At wiki page discrete logarithm ...
  • 475
1 vote
0 answers
258 views

How do I calculate the conditional probability of a Caesar cipher?

I have a frequency distribution of letters for the plaintext and the ciphertext. I'm trying to determine the conditional probabilities to identify the plaintext/ciphertext pairings. If I encrypt ...
4 votes
0 answers
173 views

Breaking RC5 without rotations

I'm trying to follow Schneier's self-study course in cryptanalysis and am ashamed to say I am stuck on the very first problem of breaking 8-round RC5 without any rotations (i.e. just XOR and modular ...
4 votes
0 answers
73 views

Help with cryptanalysis of branching in schemes based on Multivariate Public Key Cryptography

I'm familiarized with the structure of branching found in Multivariate Cryptography, as it allows us to partition a $n$-tuple over $F_{q}$ into a $k$-tuple where the $i$-th element is in $F_{q^{\...
  • 888
1 vote
1 answer
87 views

Understanding Fourier Coefficient

In Bogdanov's and others, PRESENT: An Ultra-Lightweight Block Cipher, they mention that the S-box in PRESENT fulfill four primary conditions. They denote the Fourier coefficient as $$S_b^W (a) = \sum_{...
  • 11
0 votes
2 answers
738 views

How can I find the original message of two encrypted (Vernam Cipher) text without the key [duplicate]

Can I get the steps or the solution if possible?
4 votes
1 answer
652 views

Reverse Java random seed using 81 calls to nextInt with a bound of 4?

I'm trying to reverse the Java random seed using 81 calls to nextInt(bound) with a bound of 4. I am wondering if it is at all ...
  • 141
0 votes
1 answer
145 views

How safe is my method

I'm building a website. I have an API which takes 2 parameters: delete_user(user_id, hash). And there is method to evaluate hash using SHA512: ...
0 votes
0 answers
18 views

Scrypt cipher - known vulnerabilities and cryptanalysis? [duplicate]

there is a Scrypt cipher which is used for exmaple by some cryptos like LItecoin for their mining algorithm. I never heared of scrypt. I know eg SHA256 which is well analyzed and considered as secure ...
2 votes
0 answers
48 views

what if the S-boxes in DES were "optimal"

if we assume that the s-boxes in DES were optimal. that is for each s-box, every cell in the DDT equals to 4. is there a differential characteristic in a good probability?
  • 21
1 vote
0 answers
96 views

Symbolic computation in finite fields [closed]

What I want to know is how to perform symbolic finite field computations in SAGE math? Such computations are required in building algebraic models for cryptanalysis. To explain this mathematically ...
2 votes
1 answer
65 views

A5/2 session key derivation

Let talk about Implementation and performance analysis of Barkan, Biham and Keller’s attack on A5/2. In this paper, mentioned that we need to brute force attack on register 4 ($R_4$) to get keystream ...
2 votes
1 answer
83 views

At what modulus size does the logjam reduction stage become impractical?

Attacking a Diffie-Hellman exchange with logjam involves a massive precomputation effort once for the group, and then a comparatively simple reduction stage that is necessary to break each individual ...
  • 13.8k
1 vote
0 answers
90 views

How to break transposition cipher? [closed]

how to break a transposition cipher, especially a turning-grille-cipher? For example: $\begin{array}{rrrrrr} T & E &R& E & W& E \\ ...
's user avatar
2 votes
3 answers
135 views

Is there practical Attack on A5/1 Cryptosystem?

There are several and several attacks on A5/1 Cryptosystem, but most of them are impractical. In 2008, Elad Barkan , Eli Biham and Nathan Keller release a practical attack on GSM. Is there any ...
1 vote
0 answers
53 views

Why is this attack complexity equal that exact number of bit operations?

in the this paper,section 3,autors attack hamsi-256. Im trying to make a parametrized version, so i need to understand how do they estimate the complexity of attack in bit operations,that reads as ...
  • 55
2 votes
1 answer
146 views

Why isn't there a final permutation on SPN-based ciphers?

I am doing some research on differential cryptanalysis. Most people who are familiar with that cryptanalysis technique do know the tutorial from Heys (Heys Tutorial). I came currently to the question, ...
  • 479
0 votes
0 answers
122 views

How to extract the keyword from a mono-alphabetic substitution cipher

I am a beginner to cryptography and I have the following question. I know that to extract plaintext from a mono-alphabetic substitution cipher I can perform shifting the characters by $n$ times until ...
  • 1

1
3 4
5
6 7
29