Questions tagged [xor]

XOR, often written ⊕, is one of the basic operations on bits and bit-sequences. It is a building block of many cryptographic primitives (and some higher-level algorithms, like modes of operations).

Filter by
Sorted by
Tagged with
28
votes
2answers
6k views

Reason why “XOR” is a linear operation, but ordinary “addition” isn’t?

I'm new in cryptography and try to read some articles in this field. Many of these articles talk about non-linear S-boxes, and nothing more on what they mean by their non-linearity. I have a simple ...
24
votes
3answers
46k views

How is XOR used for encryption?

I am a programmer, so when I hear XOR, I think about the bitwise operator (e.g. 0110 ^ 1110 = 1000). The mention of "XOR" comes ...
24
votes
3answers
8k views

repeating-key xor and hamming distance

I read that to break repeating-key xor you can do the following: try a keysize $n$ and compute the hamming distance between the first $n$ bits of the encrypted string and the bits $n+1$ to $2n$ of the ...
22
votes
4answers
3k views

With sufficient randomness, is XOR an acceptable mechanism for encrypting?

I have heard criticism of various cryptosystems saying that "at their heart, they were just XOR." Is this just ignorance, or is there something inherently wrong with XOR based ciphers?
20
votes
1answer
5k views

How to break an arbitrary XOR and Rotation based encryption?

I heard encryption based purely on XOR and Rotation is inherently weak. The paper Rotational Cryptanalysis of ARX says: It is also easy to prove that omitting addition or rotation is devastating, ...
18
votes
1answer
27k views

How to attack a “many-time pad” based on what happens when an ASCII space is XORed with a letter?

I've already sent my correct solution to a homework exercise from Dan Boneh's Introduction to Cryptography class on Coursera: "Let us see what goes wrong when a stream cipher key is used more than ...
14
votes
2answers
4k views

What's wrong with XOR encryption with hash and an iterated salt

Suppose you'd use the following algorithm to encrypt a message Let $k$ be the key to encrypt with Let $m$ be the message to encrypt Split $m$ into groups of 512 bytes Given a hash function with a ...
13
votes
4answers
5k views

Why is a known-plaintext attack considered a complete break?

I read somewhere that if a cipher has a known-plaintext attack, then it is considered completely broken. Say there is a cipher that someone uses where the algorithm is understood and a known-...
10
votes
5answers
2k views

Why is XOR preferred over XNOR?

The XOR operator seems to be a frequently used building block inside many cryptographic primitives. As far as I can see, its most desirable properties seem be that for the XOR of two bits $a\oplus b=...
10
votes
1answer
2k views

Why Addition Mod 32?

I was looking at the algorithm for Twofish, and I noticed that in some places a XOR is used, but in others, they use "addition modulo-32." What makes modulo-32 special? Why not always use XOR? Why not ...
8
votes
2answers
2k views

Extracting randomness from highly-biased RNG

I have a source with a very low entropy (like 3 entropy bits per 1024 source bits). But I need to construct a 128 bit seed from the source. Will it be helpful to XOR 350 bits with jump 128 bits, e.g....
8
votes
3answers
2k views

Combining several symmetric ciphers using XOR

I have seen a talk by Rüdiger Weis, where he says that you can combine two symmetric ciphers using XOR. According to him, that has the effect that its sufficient if only one of the ciphers is secure. ...
8
votes
1answer
2k views

XOR a set of random numbers

Basic question about XOR and entropy - given a set $S$ of pseudo-random numbers in the range $[0,b]$, will XORing them produce a new pseudo-random number in $[0,b]$ or will the operation decrease the ...
8
votes
1answer
106 views

GCM mode of operation with long-term keys

Cross-post: https://cstheory.stackexchange.com/q/41435/873 Regarding GCM, NIST specifies the following: The total number of invocations of the authenticated encryption function shall not exceed $2^...
7
votes
3answers
2k views

Can I safely replace XOR with ADD in a stream cipher?

In a stream cipher, the bytes of the plaintext are usually XORed with the keystream to produce the ciphertext. Would there be anything wrong with adding the bytes instead (with overflow), if adding ...
7
votes
2answers
4k views

What does ⊕ mean in cryptography?

Can someone please help me with the question below? Explain why 0 ⊕ x ≠ 1 ⊕ x, whatever the value of the bit x. Hence, explain why flipping a bit in the plaintext produces a predictable ...
7
votes
1answer
540 views

Why XOR and NOT is free in garbled circuit

I am having trouble understanding the term "free" in V.Kolesnikov et al's paper. 1. Why NOT is free In page 4, section 3.1, they said that NOT gate is free by simply eliminating them and ...
6
votes
1answer
1k views

Confusing XOR notation in textbook sample solution

I am preparing for the midterm exam in my Data Security class so I am trying to read and understand the textbook's exercise questions. The sample solution at the end the textbook makes this problem ...
6
votes
2answers
3k views

Is it a good idea to use bitwise XOR on a set of MD5 sums?

I have designed an SQL aggregate function in Oracle that bitwise XORs all MD5 sums of the values stored in a column. For example, if my table is: ...
6
votes
2answers
856 views

Can I use PBKDF2 as a stream cipher?

Unfortunately I have to implement some naive homemade symmetric crypto, since ordinary AES CTR is not implemented in available API on target platform. What I’m going to do is, given encryption ...
6
votes
2answers
7k views

ASCII to same-length ASCII encryption?

I need to encrypt an ASCII string [a-zA-Z0-9:] to an ASCII [a-zA-Z0-9] string of the same length. It doesn't have to be unbreakable, it's sufficient that it won't be readable at the first sight. The ...
6
votes
1answer
1k views

Hash functions to generate a one-time pad

Maybe this is a newbie question: Stream cypher, will XOR message bits with one-time pad bits. Suppose I have a pseudorandom number generator, like a Mersenne Twister or something similar. I could use ...
6
votes
2answers
282 views

Where is the proof of security of Diffie's cipher?

There is an apparently provably secure cipher that was proposed by Diffie, but enhanced by R.A. Rueppel. The scheme, which was mentioned in Applied Cryptography, works like this: Measure the length ...
6
votes
1answer
86 views

Difficulty to find any preimages $a$ and $b$ for given $V$ so that $H(a) \oplus H(b) = V$?

Suppose I have the values $a$, $b$, and $V = H(a) \oplus H(b)$ with inputs $a \neq b$ and $H$ being SHA-224. None of these values are a secret. How secure is it to assume that no other possible values ...
6
votes
2answers
465 views

power consumption in a XOR

I'm trying to understand how a XOR affect traces of power consumption in a Differential Power Analysis on smartcards. What's the difference in energy radiated in a $1 \oplus 1$ and in a $0 \oplus 1$? ...
5
votes
2answers
311 views

Is a simple stream cipher “partially homomorphic” if no integrity check is applied?

My understanding is that, simply put, a stream cipher is just a CSPRNG such that $R(i,k)$ will produce a deterministic but statistically random sequence, where $i$ is an IV, and $k$ is the session key....
5
votes
2answers
171 views

Is there an efficient 2 out of 3 secret sharing scheme based on XOR?

I want to know if there is an efficient secret sharing scheme based on XOR such that a share of the message is given to three people and at least two must combine their share in order to construct the ...
5
votes
2answers
548 views

MAC security using encryption

If a message $M$ contains $n$ message blocks and I XOR the message blocks and encrypt the result using AES, can i use the resulting cipher-text as MAC? is it a good design or bad one?
5
votes
3answers
1k views

Is all of encryption based on xor?

For a long time I've been under the impression that all of encryption uses xor at its basic level. Is this true? What other method could be used to encrypt plaintext with a key? Asymmetrically, as ...
5
votes
2answers
561 views

Any stream cipher with avalanche effect?

As far as I know, all stream ciphers work by generating a stream of pseudo random bytes, and XOR it with the plain text to get the cipher text. It has the property that one bit change in the cipher ...
5
votes
2answers
553 views

Using a one-time pad with a block cipher

The one-time pad is often described with a simple XOR cipher. This is nice for showing the theoretical strengths of the one-time pad, but not so great in real-world scenarios where key reuse is a ...
5
votes
1answer
1k views

Hamming Distance vs. Index of Coincidence

When analyzing a repeating-key xor cipher to find the key length, I've read about two key methods (assuming there aren't just repeating chunks of ciphertext for Kasiski's method), for some assumed key ...
5
votes
2answers
158 views

Collision resistance of partial SHA-256 hashes XOR'ed

My hashing algorithm computes the SHA-256 for each of 12 input strings and XORs them to get the final hash. Is there a risk of an attacker being able to forge 2 sets of inputs that yield the same ...
5
votes
0answers
591 views

How can I find two strings $m_1$ and $m_2$, knowing that I know $m_1 \oplus m_2$? [duplicate]

Possible Duplicate: How does one attack a two-time pad (i.e. one time pad with key reuse)? I recently started to follow the cryptography class of Dan Boneh on coursera.org and the first part is ...
4
votes
3answers
595 views

Is this “layered” XOR cipher secure?

I am aware of the vulnerabilities of simple xor ciphers and recently I came across a block cipher that claims to solve those vulnerabilities. The cipher goes as follows with both the block and key ...
4
votes
2answers
442 views

Reusing message in One Time Pad

One of the main rules of the OTP is, that a key should never ever be reused. But if we use some commutative operation (XOR for example) for generating the cipher text, then I don't see any difference ...
4
votes
1answer
380 views

Salsa20 Implementation: Sum of 2 Words with Carries Suppressed

I'm working on the 2nd part of the Salsa20 spec, and I want to implement a closure for the exclusive-or of two words(u32). The author defines the operation as the sum of two words with carries ...
4
votes
1answer
412 views

What is the name of this kind of protocol

There is a communication protocol that I believe creates the equivalent of a one time pad, with the downside that the secret message must be transferred multiple times. The protocol is so simple that ...
4
votes
2answers
100 views

What are linear and non-linear elements in cryptography?

I was reading this answer, How secure is XOR for encryption, and it stated that XOR's aren't good for securing messages as they are linear in Nature. And therefore should be paired with some non-...
4
votes
2answers
114 views

Why is this MAC flawed?

Consider a function to create a tamperproof cookie as follows: $$\text{cookie}(m, k) = m \| \text{hash}(m \oplus k)$$ where $m$ is a message provided by Alice, and k is a secret key known only to ...
4
votes
1answer
548 views

Reversing decryption function involving XORs and bit rotations?

I am trying to reverse this equation to find the encrypted number given to it. Here is the equation: $$y = x \oplus n \oplus (x \ggg 3) \oplus (x \lll 7) $$ $\oplus$ is the bitwise exclusive or ...
4
votes
1answer
157 views

Memory hardness of key derivation function through XOR-ring multiple matrix values

For theoretical purposes in order to enhance my own understanding, and NOT in order to create my own cryptography, I am asking a question about the memory-hardness of a key derivation function ...
4
votes
1answer
124 views

How many primitive cryptography operations are there? [closed]

Every cipher I've encountered seems to be built from slight variations of only three basic operations: the S-box, the P-box, and the XOR. I’m just wondering, are there any others? And if there aren'...
4
votes
1answer
247 views

How hard is it to find plaintexts whose hashes satisfy $h(a)\oplus h(b)=h(c)$?

Given a cryptographic hash function $h$, for example SHA256, how hard is it to find plaintexts $a,b,c$ such that $$h(a)\oplus h(b)=h(c) \text?$$
4
votes
1answer
145 views

A problem in secret sharing and mixed operators over $\mathbb{Z}$

Recently, I studied an article in which it was written that having $(A-B)\oplus C$ and $B\oplus C$, we cannot find $A$. The authors used this result to build a secret sharing scheme, but they did not ...
4
votes
1answer
754 views

Fast reduction in $GF(2^{128})$ using x86 `PCLMULQDQ`

Modern x86 CPUs support the PCLMULQDQ instruction, which does an XOR-multiply of two 64-bit numbers instead of an add-multiply (i.e. typical arithmetic ...
4
votes
0answers
70 views

Upgrading key derivation by adding a XOR with a known value

In general keys for password based key derivation are derived from a password hash such as the old PBKDF2 function or Argon2, possibly followed by another derivation function to derive data and ...
4
votes
2answers
393 views

XOR Encryption with bcrypt password de-biasing

Objective: To have a very simple to verify, but very secure small message encryption. Idea: Message ⊕ bcrypt( Password). We remove password biases with bcrypt ...
3
votes
1answer
2k views

Can we replace the XOR operation in DES with some other operation?

Can we replace the XOR operation in the DES algorithm with some other operation? If so, does it work for both encryption and decryption?
3
votes
1answer
385 views

AES in Counter mode for 64 bit input

I was reading how AES can be used for 64 bit data. Than i came to this answer :Is it possible to implement AES with a 64-bit I/O block size? The answer here is given that by running AES in counter ...