Questions tagged [cryptanalysis]

Analysis of individual security aspects of a cipher or algorithm, not the security of a cipher or algorithm in general (which would lean towards “algorithm-design”).

184 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
0answers
155 views

Efficient way of knowing large factors of $\phi(n)$ given small prime factors and $n$

Knowing large prime factor$(r > n^{1/4})$ of $\phi(n)$ can easily factorize n and hence learn $\phi(n)$. If we have knowledge on all small prime factors $(2< r_i << n^{1/4})$ of $\phi(n)$...
2
votes
0answers
177 views

Strict Avalanche Criteria in Sage

Is there any inbuilt functionality in sage to check if any S-Box satisfies Strict Avalanche Criterion or not?
2
votes
0answers
79 views

Using XL Algorithm to solve overdetermined systems, simple example required

Can someone give an example of how the XL algorithm is used to solve an overdetermined system as apposed to just a general case? I have a fairly good understanding of how steps of the algorithm work, ...
2
votes
0answers
66 views

Does secure LWE implementation leak bit information?

We know RSA leaks one bit about the factors and improper yet secure implementations of Discrete Logarithm leak one bit about the discrete logarithm. Does LWE leak any information?
2
votes
0answers
129 views

Known Plaintext Attack A5/2

I am trying to understand the non-optimized known plaintext attack on A5/2 from Barkan, Bikan and Keller. I don't understand the construction of the equation system: $$S_{R4_1} * S_1 = k$$ Where $S$ ...
2
votes
0answers
139 views

How can I identify the linear equations for a block cipher with 4 different s-boxes?

For a block cipher with 4 different s-boxes (each used in an individual round) how can I identify the linear equations? Normally, for ciphers like AES with a single s-box, linear cryptanalysis can be ...
2
votes
0answers
42 views

Why the permutation of the right hand rotor given in Rejewski's paper is $PNP^{-1}$?

I would like to know why the permutation of the right hand rotor given in Rejewski's paper is $PNP^{-1}$. First of all I can't get how he added an $P$(alphabetic permutation) at the front of $N$(...
2
votes
0answers
103 views

List of security protocols that have been proved to have bugs using formal methods

I'm looking for articles about finding bugs in security protocols using formal methods so I can test them using tools like proverif I've searched a lot of references but most of them seem to be about ...
2
votes
1answer
534 views

Cracking a key using a combination of partial keys

As part of a cryptanalytic attack I've carried out, I used a divide-and-conquer strategy to divide the secret key $k$ into several equal-sized partial keys $k = {k_1, k_2, ...}$. The attack works ...
2
votes
0answers
35 views

Explanation of the generalisation of multiset properties to a concatenation of a block

I am trying to learn about SASAS cryptanalysis. I am reading the paper related to this where the authors use multisets are used within the cryptanalysis of this cipher. I did not understand the part ...
2
votes
0answers
136 views

Get LCG from output?

Given a standard LCG output, let's say 3 consecutive numbers, I'm wondering how I could get $a$ and $c$ if I already know $m$ LCG formula: Sn+1 = ( aSn + c ) mod m I've seen this posted in a lot of ...
2
votes
0answers
124 views

Would using a symmetric list of subkeys in a Feistel cipher make our messages vulnerable to oracle attacks?

Suppose I have a Feistel cipher structure that has $16$ rounds. I come up with $8$ subkeys $k_1,k_2,...,k_8$ to be used for the first $8$ rounds and then assign the rest of the keys so that $k_9=k_8,...
2
votes
0answers
38 views

Does the length of the keyword used for keytable for Playfair matter?

So for Playfair, we choose a keyword and put that in the keytable with no duplicates. Then, we fill the rest of the table with alphabets in order that are not in the keyword without 'J'. Does the ...
2
votes
0answers
121 views

Homomorphic proxy re-signature

Alice has a value $a$ and she signs it using her secret key $d_1$ as: $s_1 = (r_1 * g^a)^{d_1} \bmod p$, and Bob has a value $b$ and he signs it using his secret key $d_2$ as: $s_2 = (r_2 * g^b)^{d_2} ...
2
votes
0answers
114 views

Infer encoding mechanism from $n$-grams distance?

I have a series of obfuscated strings which across the set of strings have regions of high variance and regions of low variance – implying some encoding mechanism as opposed to an encryption procedure ...
2
votes
0answers
89 views

Cracking an appliance's network protocol

I'm trying to crack my thermostat's network protocol. I've captured several rounds of network traffic and here is what I've got to work with. Communicating via HTTP POST The POST data is JSON ...
2
votes
0answers
78 views

Why the same characteristics cannot be used to recover all FEAL4 keys

I am trying to understand how differential Cryptanalysis works. Here I read how to use differential cryptoanalysis for cracking FEAL4 cipher. The big gotcha with this process is that you cannot ...
2
votes
1answer
235 views

Applications of machine learning in classical ciphers?

Machine learning is definitely applicable in analyzing simple shift ciphers like Caesar and affine ciphers, as well as substitution ciphers like Vigenère, but is it possible for machine learning to ...
2
votes
1answer
95 views

How to construct the blind factors in practice?

I'm Implementing a protocol that uses masking techniques (or blinding factors), so we can mask a value $y_0$ as $m_0=y_0 \cdot r_0$ where $y_0 \in \mathbb{Z}_p$ and $r_0 \stackrel {R}\leftarrow \...
1
vote
0answers
42 views

ε-close to t-wise inependence of SPN (AES)

According to theorem 3.13, the 6 rounds of AES is 0.472-close to pairwise independence. It is also mentioned t-wise independence used to analyze higher order derivates attacks. it is also mentioned 3-...
1
vote
0answers
31 views

Differential cryptanalysis to ciphertext-only attacks on xxTEA

In my IOT project, I use the xxTEA encryption algorithm to encrypt my data. I use the same encryption key for all my packets because I don't have the possibility to do a key exchange between Alice and ...
1
vote
0answers
70 views

Comparison of SNARK-friendly hash algorithms MiMC7, Poseidon, Pederson?

There are some cryptographically secure hash algorithms designed to be efficient for SNARKs, STARKs and FHE. Some of them already implemented in Zcash, Zokrates and circom. The ones that I know of are:...
1
vote
0answers
50 views

How to prove that the given encryption scheme have ciphertext indistinguishability for all PPT adversaries?

I am not sure how to prove that the given two scheme is perfectly indistinguishable for all PPT adversaries!
1
vote
0answers
37 views

What is the easiest cipher to use in designing double ciphers?

I want to make a double cipher consisting of two encryption method Enc1 and Enc2, and two corresponding decryption mechanisms Dec1 and Dec2. I want it so that: (1) we can encrypt any message M1 to a ...
1
vote
0answers
63 views

Nth term for Linear Congruence Generators

We can get the N+1th term for a Linear Congruence Generator like this: x[n+1] = A * x[n] (mod m) by raising the A to the exponent of n like this: ...
1
vote
0answers
46 views

Kernel attack on MinRank - How do we check if we can stop?

I have some trouble understanding how Kernel Attack to MinRank is implemented. MinRank: Let $k, n, r$ be positive integers, and let $M_0, M_1, \dots, M_k$ be $n \times n$ matrices with entries in a ...
1
vote
2answers
116 views

RSA algorithm implementation

$$m^{ed} \equiv m \bmod n$$ $n =pq$, so by Chinese Remainder Theorem it is equivalent to $$m^{ed} \equiv m \bmod 𝑝, m^{ed} \equiv m \bmod q$$ where $n=p\cdot q$ So how did 2 come from 1 by the ...
1
vote
0answers
36 views

cascade encryption - If I encrypt my data using many different encryption algorithms

If I encrypt my data using many different encryption algorithms (using different passwords) how will an adversary be able to decipher the message?
1
vote
0answers
65 views

Matsui's Linear Attack algorithms

I'm trying to understand Matsui's linear attack on DES and I don't understand something in the paper. I can't understand how the algorithms 1 & 2 work.
1
vote
0answers
123 views

Why this isn't a secure PRF?

Given that F is a secure PRF in the example $$F'(k,x)= F(k,x)\mathbin\|F(k,F(k,x))$$ I'm not sure why this isn't a secure PRF? Under what condition $F(k, F(k,x))$ when concatenated to $F(k,x)$ the ...
1
vote
0answers
83 views

Breaking vulnerable ElGamal encryption

In a ctf, I encountered this problem: ...
1
vote
0answers
29 views

Size of messages in timing attack on RSA Montgomery

I'm codin' timing attack on RSA Montgomery which compares two sets ( the first one includes those which need a reduction in contrary to the second one ). But I got troubles with the Montgomery ...
1
vote
0answers
51 views

Is there any appropriate way to break a specific S-BOX?

I have just started learning cryptography. And I came across such a question that had troubled me for several days. The picture contains an LFSR and an S-Box. The LFSR is 32-bit long and the inside ...
1
vote
0answers
60 views

Rivest - Time Memory Tradeoff Using Distinguished Points

A while ago, Hellman introduced a time-memory tradeoff for chosen plaintext attack on block ciphers. There is an innovation due Rivest using a concept of 'distinguished points'. I am looking for the ...
1
vote
1answer
197 views

What is the current security level of an algorithm?

I was reading a paper of some years ago about a cryptography and a phrase got my attention. We want to ensure a security level of at least $2^{80}$ I know that $2^{80}$ was used as rule of thumb ...
1
vote
0answers
51 views

What is the exact algorithm for encryption and decryption with hummingbird-1 cryptography?

I have really googled the entire internet but could not find a clear algorithm for hummingbird-1 cryptography.The problem emerges in the decryption module: What is the initial value of state register ...
1
vote
0answers
44 views

Are there any state of the art crypanalysis tools for stream cipher

I am new to cryptanalysis and interested in knowing cryptanalysis tools (black boxing or white boxing) for (not any specific) stream ciphers in general sense. Scenario: I am given an assignment to ...
1
vote
0answers
64 views

Help on Algebraic Side Channel Attacks

I am a master student in computer security, I am preparing a dissertation thesis in the theme is: Algebraic cryptanalys by auxiliary channels, I need reference on this theme (book, thesis, ...), and ...
1
vote
0answers
153 views

How do I calculate the conditional probability of a Caesar cipher?

I have a frequency distribution of letters for the plaintext and the ciphertext. I'm trying to determine the conditional probabilities to identify the plaintext/ciphertext pairings. If I encrypt ...
1
vote
0answers
46 views

Why is this attack complexity equal that exact number of bit operations?

in the this paper,section 3,autors attack hamsi-256. Im trying to make a parametrized version, so i need to understand how do they estimate the complexity of attack in bit operations,that reads as ...
1
vote
0answers
309 views

Question about RSA timing attack and a Chosen Ciphertext Attack on RSA

I am quite new to the RSA and I have a couple of questions that confuse me. Q1: A Timing attack on RSA can be prevented _____________________________ A. By performing the “square and multiply” ...
1
vote
0answers
38 views

Algorithms for solving systems of quadratic multivariate polynomials

What are the best algorithms for solving systems of $k$ polynomials equations where these are quadratic multivariate polynomials on $k$ variables? I've encountered such systems on my research and I'm ...
1
vote
0answers
64 views

In DES : Matsui's notation(LC) vs Biham's notation(DC)

I'm doing linear attack for 8 rounds DES. And I just wondering about the difference between Matsui's notation and Biham's notation. In Matsui's paper, numbers bits from 0 to 63 from right to left. In ...
1
vote
0answers
43 views

Finding repeated groups of letters in the Kasiski examination

While doing the Kasiski examination I came to a problem. If there is the following group of letters in the cipher: AA and later on a group AAA is found. Does it count as two repeats or just one? And ...
1
vote
0answers
44 views

Are slide attacks effective if the primitive is sandwiched? And key schedule vs. Even-Mansour

Suppose you have a cryptographic permutation consisting of identical rounds, that makes it vulnerable to a slide attack. But if you sandwich it between two XORs of key material. Is it still vulnerable?...
1
vote
0answers
32 views

How can I guess that a combination of Atbasch and Caesar / Vigenère has been used?

If I'm given a ciphertext, what kind of patterns, index of coincidence, frequency analysis would lead me to guess that it had been encrypted by a combination of Atbasch plus Caesar / Vigenère?
1
vote
0answers
45 views

Guess the number of characteristics in differential cryptanalysis

I am doing some research on differential cryptanalysis for my master thesis. I analyzed some toy ciphers like the one in the popular tutorial about differential and linear cryptanalysis from heys Link....
1
vote
0answers
133 views

zero knowledge proof of range and set membership

I have a large number of items with a unique serial number and a score (score isn't always unique). There is a list which contains all of the serial numbers and their respective scores. I select 3 ...
1
vote
0answers
130 views

Implementation of differential cryptanalysis

This question is a little bit more implementation based of differential cryptanalysis. I hope it is okay. I am working with the book "The Block Cipher Companion" on the topic differential ...
1
vote
0answers
98 views

Method for cryptanalysis of a keyword-keyletter cipher?

I am a CS student who is in an introductory cryptography course. I am not looking for the complete plaintext of this message, as I am not looking to cheat. I am simply stuck and have no idea what to ...