# Questions tagged [xor]

XOR, often written ⊕, is one of the basic operations on bits and bit-sequences. It is a building block of many cryptographic primitives (and some higher-level algorithms, like modes of operations).

211 questions
Filter by
Sorted by
Tagged with
7k views

### Reason why “XOR” is a linear operation, but ordinary “addition” isn’t?

I'm new in cryptography and try to read some articles in this field. Many of these articles talk about non-linear S-boxes, and nothing more on what they mean by their non-linearity. I have a simple ...
49k views

### How is XOR used for encryption?

I am a programmer, so when I hear XOR, I think about the bitwise operator (e.g. 0110 ^ 1110 = 1000). The mention of "XOR" comes ...
8k views

### repeating-key xor and hamming distance

I read that to break repeating-key xor you can do the following: try a keysize $n$ and compute the hamming distance between the first $n$ bits of the encrypted string and the bits $n+1$ to $2n$ of the ...
4k views

### With sufficient randomness, is XOR an acceptable mechanism for encrypting?

I have heard criticism of various cryptosystems saying that "at their heart, they were just XOR." Is this just ignorance, or is there something inherently wrong with XOR based ciphers?
5k views

### How to break an arbitrary XOR and Rotation based encryption?

I heard encryption based purely on XOR and Rotation is inherently weak. The paper Rotational Cryptanalysis of ARX says: It is also easy to prove that omitting addition or rotation is devastating, ...
27k views

### How to attack a “many-time pad” based on what happens when an ASCII space is XORed with a letter?

I've already sent my correct solution to a homework exercise from Dan Boneh's Introduction to Cryptography class on Coursera: "Let us see what goes wrong when a stream cipher key is used more than ...
4k views

### What's wrong with XOR encryption with hash and an iterated salt

Suppose you'd use the following algorithm to encrypt a message Let $k$ be the key to encrypt with Let $m$ be the message to encrypt Split $m$ into groups of 512 bytes Given a hash function with a ...
6k views

### Why is a known-plaintext attack considered a complete break?

I read somewhere that if a cipher has a known-plaintext attack, then it is considered completely broken. Say there is a cipher that someone uses where the algorithm is understood and a known-...
2k views

The XOR operator seems to be a frequently used building block inside many cryptographic primitives. As far as I can see, its most desirable properties seem be that for the XOR of two bits $a\oplus b=... 1answer 2k views ### Why Addition Mod 32? I was looking at the algorithm for Twofish, and I noticed that in some places a XOR is used, but in others, they use "addition modulo-32." What makes modulo-32 special? Why not always use XOR? Why not ... 1answer 120 views ### GCM mode of operation with long-term keys Regarding GCM, NIST specifies the following: The total number of invocations of the authenticated encryption function shall not exceed$2^{32}$, including all IV lengths and all instances of the ... 2answers 2k views ### Extracting randomness from highly-biased RNG I have a source with a very low entropy (like 3 entropy bits per 1024 source bits). But I need to construct a 128 bit seed from the source. Will it be helpful to XOR 350 bits with jump 128 bits, e.g.... 3answers 2k views ### Combining several symmetric ciphers using XOR I have seen a talk by Rüdiger Weis, where he says that you can combine two symmetric ciphers using XOR. According to him, that has the effect that its sufficient if only one of the ciphers is secure. ... 1answer 2k views ### XOR a set of random numbers Basic question about XOR and entropy - given a set$S$of pseudo-random numbers in the range$[0,b]$, will XORing them produce a new pseudo-random number in$[0,b]$or will the operation decrease the ... 3answers 2k views ### Can I safely replace XOR with ADD in a stream cipher? In a stream cipher, the bytes of the plaintext are usually XORed with the keystream to produce the ciphertext. Would there be anything wrong with adding the bytes instead (with overflow), if adding ... 2answers 4k views ### What does ⊕ mean in cryptography? Can someone please help me with the question below? Explain why 0 ⊕ x ≠ 1 ⊕ x, whatever the value of the bit x. Hence, explain why flipping a bit in the plaintext produces a predictable ... 1answer 586 views ### Why XOR and NOT is free in garbled circuit I am having trouble understanding the term "free" in V.Kolesnikov et al's paper. 1. Why NOT is free In page 4, section 3.1, they said that NOT gate is free by simply eliminating them and ... 1answer 1k views ### Confusing XOR notation in textbook sample solution I am preparing for the midterm exam in my Data Security class so I am trying to read and understand the textbook's exercise questions. The sample solution at the end the textbook makes this problem ... 2answers 3k views ### Is it a good idea to use bitwise XOR on a set of MD5 sums? I have designed an SQL aggregate function in Oracle that bitwise XORs all MD5 sums of the values stored in a column. For example, if my table is: ... 2answers 875 views ### Can I use PBKDF2 as a stream cipher? Unfortunately I have to implement some naive homemade symmetric crypto, since ordinary AES CTR is not implemented in available API on target platform. What I’m going to do is, given encryption ... 2answers 7k views ### ASCII to same-length ASCII encryption? I need to encrypt an ASCII string [a-zA-Z0-9:] to an ASCII [a-zA-Z0-9] string of the same length. It doesn't have to be unbreakable, it's sufficient that it won't be readable at the first sight. The ... 1answer 1k views ### Hash functions to generate a one-time pad Maybe this is a newbie question: Stream cypher, will XOR message bits with one-time pad bits. Suppose I have a pseudorandom number generator, like a Mersenne Twister or something similar. I could use ... 2answers 292 views ### Where is the proof of security of Diffie's cipher? There is an apparently provably secure cipher that was proposed by Diffie, but enhanced by R.A. Rueppel. The scheme, which was mentioned in Applied Cryptography, works like this: Measure the length ... 1answer 87 views ### Difficulty to find any preimages$a$and$b$for given$V$so that$H(a) \oplus H(b) = V$? Suppose I have the values$a$,$b$, and$V = H(a) \oplus H(b)$with inputs$a \neq b$and$H$being SHA-224. None of these values are a secret. How secure is it to assume that no other possible values ... 2answers 484 views ### power consumption in a XOR I'm trying to understand how a XOR affect traces of power consumption in a Differential Power Analysis on smartcards. What's the difference in energy radiated in a$1 \oplus 1$and in a$0 \oplus 1$? ... 2answers 315 views ### Is a simple stream cipher “partially homomorphic” if no integrity check is applied? My understanding is that, simply put, a stream cipher is just a CSPRNG such that$R(i,k)$will produce a deterministic but statistically random sequence, where$i$is an IV, and$k$is the session key.... 2answers 242 views ### Is there an efficient 2 out of 3 secret sharing scheme based on XOR? I want to know if there is an efficient secret sharing scheme based on XOR such that a share of the message is given to three people and at least two must combine their share in order to construct the ... 2answers 561 views ### MAC security using encryption If a message$M$contains$n$message blocks and I XOR the message blocks and encrypt the result using AES, can i use the resulting cipher-text as MAC? is it a good design or bad one? 3answers 1k views ### Is all of encryption based on xor? For a long time I've been under the impression that all of encryption uses xor at its basic level. Is this true? What other method could be used to encrypt plaintext with a key? Asymmetrically, as ... 2answers 575 views ### Any stream cipher with avalanche effect? As far as I know, all stream ciphers work by generating a stream of pseudo random bytes, and XOR it with the plain text to get the cipher text. It has the property that one bit change in the cipher ... 2answers 617 views ### Using a one-time pad with a block cipher The one-time pad is often described with a simple XOR cipher. This is nice for showing the theoretical strengths of the one-time pad, but not so great in real-world scenarios where key reuse is a ... 1answer 1k views ### Hamming Distance vs. Index of Coincidence When analyzing a repeating-key xor cipher to find the key length, I've read about two key methods (assuming there aren't just repeating chunks of ciphertext for Kasiski's method), for some assumed key ... 2answers 188 views ### Collision resistance of partial SHA-256 hashes XOR'ed My hashing algorithm computes the SHA-256 for each of 12 input strings and XORs them to get the final hash. Is there a risk of an attacker being able to forge 2 sets of inputs that yield the same ... 0answers 597 views ### How can I find two strings$m_1$and$m_2$, knowing that I know$m_1 \oplus m_2$? [duplicate] Possible Duplicate: How does one attack a two-time pad (i.e. one time pad with key reuse)? I recently started to follow the cryptography class of Dan Boneh on coursera.org and the first part is ... 3answers 603 views ### Is this “layered” XOR cipher secure? I am aware of the vulnerabilities of simple xor ciphers and recently I came across a block cipher that claims to solve those vulnerabilities. The cipher goes as follows with both the block and key ... 2answers 464 views ### Reusing message in One Time Pad One of the main rules of the OTP is, that a key should never ever be reused. But if we use some commutative operation (XOR for example) for generating the cipher text, then I don't see any difference ... 1answer 399 views ### Salsa20 Implementation: Sum of 2 Words with Carries Suppressed I'm working on the 2nd part of the Salsa20 spec, and I want to implement a closure for the exclusive-or of two words(u32). The author defines the operation as the sum of two words with carries ... 1answer 417 views ### What is the name of this kind of protocol There is a communication protocol that I believe creates the equivalent of a one time pad, with the downside that the secret message must be transferred multiple times. The protocol is so simple that ... 2answers 119 views ### What are linear and non-linear elements in cryptography? I was reading this answer, How secure is XOR for encryption, and it stated that XOR's aren't good for securing messages as they are linear in Nature. And therefore should be paired with some non-... 2answers 118 views ### Why is this MAC flawed? Consider a function to create a tamperproof cookie as follows: $$\text{cookie}(m, k) = m \| \text{hash}(m \oplus k)$$ where$m$is a message provided by Alice, and k is a secret key known only to ... 1answer 596 views ### Reversing decryption function involving XORs and bit rotations? I am trying to reverse this equation to find the encrypted number given to it. Here is the equation: $$y = x \oplus n \oplus (x \ggg 3) \oplus (x \lll 7)$$$\oplus$is the bitwise exclusive or ... 1answer 160 views ### Memory hardness of key derivation function through XOR-ring multiple matrix values For theoretical purposes in order to enhance my own understanding, and NOT in order to create my own cryptography, I am asking a question about the memory-hardness of a key derivation function ... 1answer 251 views ### How hard is it to find plaintexts whose hashes satisfy$h(a)\oplus h(b)=h(c)$? Given a cryptographic hash function$h$, for example SHA256, how hard is it to find plaintexts$a,b,c$such that $$h(a)\oplus h(b)=h(c) \text?$$ 1answer 129 views ### How many primitive cryptography operations are there? [closed] Every cipher I've encountered seems to be built from slight variations of only three basic operations: the S-box, the P-box, and the XOR. I’m just wondering, are there any others? And if there aren'... 1answer 146 views ### A problem in secret sharing and mixed operators over$\mathbb{Z}$Recently, I studied an article in which it was written that having$(A-B)\oplus C$and$B\oplus C$, we cannot find$A$. The authors used this result to build a secret sharing scheme, but they did not ... 1answer 804 views ### Fast reduction in$GF(2^{128})\$ using x86 PCLMULQDQ

Modern x86 CPUs support the PCLMULQDQ instruction, which does an XOR-multiply of two 64-bit numbers instead of an add-multiply (i.e. typical arithmetic ...
81 views

### Upgrading key derivation by adding a XOR with a known value

In general keys for password based key derivation are derived from a password hash such as the old PBKDF2 function or Argon2, possibly followed by another derivation function to derive data and ...
424 views

### XOR Encryption with bcrypt password de-biasing

Objective: To have a very simple to verify, but very secure small message encryption. Idea: Message ⊕ bcrypt( Password). We remove password biases with bcrypt ...