Questions tagged [cryptanalysis]
Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).
1,496
questions
0
votes
0
answers
53
views
Composing subexponential L-function
Suppose $y=f(x)$ and $z=g(y)$ such that $y\in L_x[a,b]$ and $z\in L_y[c,d]$, where $L$ is the usual sub-exponential asymptotic notation
$$L_x[a,b] = \exp\left((b+o(1))(\log x)^a(\log\log x)^{1-a}\...
- 1,005
-1
votes
1
answer
110
views
Advantage of existing Cryptosystems
I have read about the concept of perfect secrecy and statistical distance. The perfect secrecy is impossible to be implemented on real world scenario. So the cryptosystems used at various websites ...
8
votes
1
answer
1k
views
Introduction to LLL algorithm applied to linear modular inequalities
What is the Lenstra–Lenstra–Lovász lattice basis reduction algorithm about?
How is it applied to solve for $x\pmod m$ a system of modular inequalities $(u_i\,x+v_i\bmod m)<w$ for $0\le i<n$?
I'm ...
- 134k
0
votes
1
answer
181
views
What would be the most recommended AES && RSA Keys for production?
While I am a front-end developer and not a security expert programmer, I am worry about the keys I am using for my AES && RSA encryption. Please help me to understand:
Is the following keys ...
- 101
3
votes
1
answer
397
views
Reverse Java seed using outputs generated from nextInt(6)+1
Given a set of numbers within the range of 1-6:
[3,4,3,4,5,6,2,3,1,5,2,3,6,2,2,3,3,6,6,4,5,2,5,3,5,2,4,4,2,6,3,6,1,5,1,3,6,1,1,2,2,4,5,3,1,2,3,4,4,6]
generated using Java's nextInt(6)+1, is it ...
2
votes
0
answers
89
views
Fisher Yates on "faulted" random number generator cryptanalysis
For the sake of curiosity and fun, i have implemented a C# program that operate as deck dealer on 40 cards deck (following the Fisher Yates shuffeling algorithm https://en.wikipedia.org/wiki/Fisher%E2%...
- 361
0
votes
1
answer
97
views
Are there any Cryptography Algorithms that involve Lots of Number Theory?
I am looking for a good, meaty cryptography algorithm that involves a good amount of number theory in which I can explore. I'm researching, and AES (Advanced Encryption System) seems interesting, but ...
2
votes
1
answer
364
views
Getting to understand the linear approximation of DES
I will make a presentation about Linear approximation (Matsui's paper 1993 Linear Cryptanalysis Method for DES Cipher ) of DES and I don't understand some parts of it.
Here my questions :
In the ...
- 45
1
vote
1
answer
153
views
Can we possible to solve the LPN problem using Arora-Ge algorithm?
I recently studied how to solve the LWE (learning with errors) using algebraic relations proposed by Arora and Ge (paper : New Algorithms for Learning in Presence of Errors).
As I understood, for LWE ...
- 149
1
vote
0
answers
532
views
Why this isn't a secure PRF?
Given that F is a secure PRF in the example $$F'(k,x)= F(k,x)\mathbin\|F(k,F(k,x))$$ I'm not sure why this isn't a secure PRF? Under what condition $F(k, F(k,x))$ when concatenated to $F(k,x)$ the ...
- 321
2
votes
0
answers
56
views
How to prove document ownership at a specific time [duplicate]
Problem
Given any piece of data, I could sign it with public key and made available online. This proves I am in possession of given data, but it doesn't tell I am the creator. The only possibility (I'...
- 121
-1
votes
1
answer
102
views
Can I derive IV, if I know Encrypted Txt, Key and Encryption Method?
I want to know is there any way to derive the initialization vector, if I know all the other details.
AES SHA 256bits
CBC pkcs5padding
Input: Hello
Key: 123
Output: xORGCDL88sa8cUrK8JNSCQ==
Now, how ...
- 3
7
votes
3
answers
2k
views
Will cryptanalysis always stay a relevant topic?
I hope this doesn't look like a silly question. In an age where our current cryptography is often impossible to crack when properly implemented and used, would we be able to decipher anything, for ...
- 176
0
votes
2
answers
118
views
Reusing encrypted message on MITM attack?
I'm using RSA public key private key for sending AES key from each client to server application.
then i'm using this AES key and IV for communicating between client and server.
what should i do for ...
1
vote
1
answer
219
views
Disrupting MITM attack against 3DES by intermingling plaintext and inter-mediate ciphertext between rounds
Let's say someone implements 3DES with three separate 56-bit keys and an attacker is attempting to execute a MITM attack.
Here is the encryption plan designed to attempt to disrupt the MITM attack, or ...
3
votes
1
answer
491
views
AES-CTR security if S-boxes substituion is omitted?
I understand why s-boxes are needed in general especially when ECB mode is used(because of using the same key for encryption of other blocks)but I wonder if it's ...
- 403
0
votes
1
answer
342
views
Why would you want to keep the Initialization Vectors Public?
So I was researching Initialization Vectors (IV) and even took a look at this thread... What is the main difference between a key, an IV and a nonce? ,but I was hoping that I could get some clarity.
...
- 11
0
votes
0
answers
87
views
Decrypting an AES string
I'm dealing with a website that loads a javascript file which eventually sets an AES hash/value (whatever it's called) as a cookie. The file is heavily obfuscated making it hard to understand certain ...
- 1
1
vote
1
answer
438
views
Double permutation patterns for transposition ciphers, how to crack
I'm reading from Cornell , I know for a single permutation, I can find the ciphertext length (100), divide in some key lengths (10x10, 5x20), then try all permutation (10x9x8... 5x4x3x2x1). then find ...
0
votes
1
answer
505
views
Can you break a Vigenere cipher with key length of 2 and message/cipher text length of 4?
I am currently working on a problem where an attacker knows that a user's password is either "pqrs" or "jmlo" and also knows that the encryption scheme is using the Vigenere cipher ...
- 11
0
votes
1
answer
69
views
Security of a custom AES-based attack model
Provided that:
$AES(plaintext, key)$ is the standard AES block cipher for a 128 bits block.
$\oplus$ is the standard XOR operation.
$K$ is a constant 128 bits pseudorandom value, which is used as the ...
- 3
1
vote
0
answers
315
views
Breaking vulnerable ElGamal encryption
In a ctf, I encountered this problem:
...
3
votes
1
answer
109
views
Are these two methods of differential cryptanalysis different?
I'm trying to understand how differential analysis works. I'm reading this and this tutorials, but it looks like they do different things. In the first paper author tells us to bruteforce last round ...
- 55
1
vote
0
answers
79
views
Differential analysis for dummies, how key position impact on tactic? [closed]
Im new to cryptoanalysis and started reading A Tutorial on
Linear and Differential Cryptanalysis. The author is trying to explain it as simple as he can. But I still got some questions, can anybody ...
- 55
0
votes
2
answers
97
views
Which encryption algorithm is sensitive to an attacker having access to it?
We are contemplating hiding a sensitive information from our business partner by encrypting it.
However, customers have access to both the sensitive and the encrypted information. Furthermore, they ...
- 103
0
votes
1
answer
196
views
Find first two blocks of plaintext given a final plaintext block, the IV and ciphertext for CBC?
I have the following:
complete ciphertext;
iv;
last block of plaintext including the padding which is 04040404.
The encryption was made using AES-CBC-256. I can ...
- 3
1
vote
1
answer
105
views
When attacking keyed algorithms, how is it known when the output is correct?
I've been reading a little bit about cryptanalysis, and I'm wondering how attacking algorithms that work on keys is performed.
It's obvious how algorithms like MD5 are attacked, in pseudocode:
...
- 13
3
votes
0
answers
585
views
Identifying correct cipher
I am trying to decrypt a text(~900 characters) and I started with the assumption that its a Vigenère cipher as the one of the identifier tool identified it as Vigenère cipher and also the Index of ...
- 33
2
votes
2
answers
285
views
Is this permutation secure?
Let vector ${\bf d} \in \{ \pm 1 \}^n$ be the message we want to send. In my system, ${\bf d}$ is multiplied by an $n \times n$ Fourier matrix ${\bf F}$, as follows
$$ {\bf x} = {\bf F} {\bf d} $$
...
- 35
3
votes
1
answer
154
views
How much information do I leak if I upload multiple ciphertexts with cleartext overlaps?
Suppose that $t_1, t_2, \ldots, t_n$ are my clear texts. Suppose that for any $(i,j) \in \{1,2,\ldots,n\}^2$, $t_i$ and $t_j$ only differ in, say, the 1st $m$-many characters. Finally, suppose that I ...
- 553
2
votes
1
answer
335
views
are outputs of sha256 independent when padded with different seed each time, in other words, when inputs can be somewhat related
So I was wondering about what will be the dependence of the outputs when I padded one input with two different strings two times for technically generating two different strings, say the input string ...
1
vote
1
answer
180
views
Examples of multi output bit balanced Boolean functions
I am trying to find out and learn more about Balanced boolean functions.
Wikipedia states that " a balanced boolean function is a boolean function whose output yields as many 0s as 1s over its ...
- 111
3
votes
2
answers
161
views
Is the one-time pad secure if the key is computed so the ciphertext will consist only of "A"?
I recently learned about the one-time pad method, which has perfect security if the following conditions are met :
The key must be truly random.
The key must be at least as long as the plaintext.
The ...
- 176
3
votes
0
answers
233
views
Understanding Linear Cryptanalysis
I'm reading about the linear cryptanalysis of an SPN and I have some questions about the practicality of this. The example I'm looking at is from 3.3.3 of Stinson's Book and I believe the same example ...
- 141
0
votes
0
answers
51
views
RSA PADDING WITH e=3 [duplicate]
I have a ciphertext which has been padded with spaces from left the message is 31 bytes long and e = 3 how can I recover the message with python code .
- 1
1
vote
1
answer
1k
views
Frequency Analysis on DES, AES, 3DES using Cryptool2
I am trying to analyze symmetric block ciphers like DES, 3DES and AES, using Cryptool 2.
I want to do a frequency analysis on each of these ciphers, in order to comment whether this is an effective ...
- 113
2
votes
1
answer
554
views
Is AES without T-Tables nor S-Box resistant to side-channel?
T-Tables and S-Boxes are prone to side-channel attacks, is an implementation without any lookup tables resistant to side-channel ? In this answer, https://crypto.stackexchange.com/a/63520/80926, the ...
- 353
-1
votes
1
answer
110
views
Are there issues in how cryptography is used in this short code sample?
I want to encrypt some small text files so I can put them online, in non-restricted access (not the best idea, but it's cheap and simple). I know I should use something like Truecrypt instead of this, ...
- 703
1
vote
1
answer
464
views
Is AES S-Box resistant to side-channel attacks?
I know that implemntations with T-tables such as Golang's are prone to side-channel attacks, but is AES's S-Box wihtout any additional table also insecure ?
- 353
1
vote
1
answer
127
views
Can someone help me understand this?
In the book Serious Cryptography
It says for a cipher's permutation to be secure
"Different keys should result in different permutations. Otherwise it becomes easier to decrypt without the key: ...
- 11
0
votes
0
answers
34
views
Finding the relationship given by the generating elements of a non-abelian group (for a maximum case) where they correspond to finding cycles
Let $G=(\mathbb{Z}_p \times \mathbb{Z}_p) \rtimes_{\phi} \mathbb{Z}_q$, where $p$ and $q$ are odd distinct primes. Let $G$ be generated by the elements $s=(g_1,e_q)$ and $t=(e_p,g_3)$,
$g_1,e_p \in \...
3
votes
0
answers
171
views
Solving LPN using algorithm for syndrome decoding
Given an algorithm $A_D$ which solves an instance of the decoding problem $e \in \mathbb{F}_2^n$ in time $T_D$ given a parity check matrix $H \in \mathbb{F}_2^{(n-k)\times n}$ and a syndrome $s \in \...
- 31
0
votes
1
answer
120
views
Anonymous key exchange protocol not secure vs. computationally unbounded adversary
Explain why an anonymous key exchange protocol cannot be secure against a computationally unbounded adversary.
2
votes
2
answers
145
views
What is the difference between different corona tracing protocols?
At
https://corona-tracing.org/ and
https://www.cryptool.org/en/cto-highlights/corona-tracing
an easy to understand way was presented how such contact tracing apps work from a cryptographical point ...
- 51
3
votes
1
answer
181
views
Cryptosystems defined over the real numbers
In a computational setting it is clear that we cannot do computation over the real numbers, as we couldn't generate, much less store them, so we have to instead deal with numbers that approximate them....
- 514
0
votes
1
answer
281
views
Attacks on LCG with "self-XOR" output function?
Consider an ordinary LCG modulo $2^n$ with an internal state of $n$ bits and an output of $n/2$ bits, with the twist that instead of simply truncating the state to produce an output, we take the upper ...
- 7,418
0
votes
2
answers
80
views
would this be classed as a cipher text attack?
Say i'm given a cipher text to decrypt, however i also have access to a server that performed the encryption; where i could enter
any plaintext and observe the result of encryption.
would it be ...
- 1
0
votes
1
answer
219
views
Hash function without avalanche effect but with few collisions
I am searching for a hash function which has these attributes:
low Avalanche Effect, similiar files should get similiar outputs
low number of collisions (if I have 0*10000 in one file, and 0*99999 + ...
- 103
1
vote
0
answers
43
views
Size of messages in timing attack on RSA Montgomery
I'm codin' timing attack on RSA Montgomery which compares two sets ( the first one includes those which need a reduction in contrary to the second one ). But I got troubles with the Montgomery ...
1
vote
2
answers
165
views
AES ECB deterministic encryption to perform Private set intersection
There are two parties, and each has a list of plain-texts. My end goal is to assign indices to unique plain-texts across both parties. My present approach is the following.
Both parties perform a ...
- 111