85 votes
Accepted

What is the new attack on SHA-1 "SHAttered" and how does it work?

In order to get a collision on a $n$ bit Random Oracle using the birthday paradox, one needs $\sqrt{\pi / 2} \cdot 2^{n/2}$ calls. In other words, in the case of the 160 output bits of SHA-1 the limit ...
Biv's user avatar
  • 9,979
77 votes

Why does the FBI ask Apple for help to decrypt an iPhone?

I'll try to take a stab at this. From Apple's iOS Security Guide, we learn that The metadata of all files in the file system is encrypted with a random key, which is created when iOS is first ...
Johannes Weiss's user avatar
69 votes

Are there two known strings which have the same MD5 hash value?

Just to show you how easy it is today to create collisions on MD5: One could create collisions using Marc Steven's HashClash on AWS and estimated the the cost of around $0.65 per collision. ...
Silverfox's user avatar
  • 861
56 votes
Accepted

What are the implications of the new alleged key recovery attack preprint on SIMON?

TL;DR: this paper seems to be a joke, or delusional; the "zero-knowledge proof" proves nothing. The report purports to have found an efficient cryptanalysis on SIMON-32/64, a small block cipher. The ...
Thomas Pornin's user avatar
38 votes
Accepted

What are recommended, general strategies to start block-cipher design and/or analysis?

In order to design and analyze a cipher, we have to establish what a cipher is supposed to accomplish. Put simply, we would like to be able to transform information in such a way that only those who ...
Ella Rose's user avatar
  • 19.6k
37 votes

Applicability of IBM's projected 50-qubit quantum computer Q to cryptanalysis?

What would be the applicability of that to cryptanalysis? It wouldn't appear to have any direct applicability to cryptanalysis, for two reasons: 50 Qbits is just not enough to attack any ...
poncho's user avatar
  • 146k
34 votes
Accepted

Why can't the commitment schemes have both information theoretic hiding and binding properties?

It's impossible. In order to be perfectly hiding, it must be the case that two different messages can produce the same commitment string. But then that commitment can be opened in two ways (by an ...
Chris Peikert's user avatar
33 votes
Accepted

Why is double encryption that's equivalent to single encryption no better than single encryption?

This is simply saying that if a cryptosystem has a functional composition that is $$ h_{k}(x) = f_{k_1}(g_{k_2}(x)) $$ then you can find a key for single encryption that works as the double encryption....
kelalaka's user avatar
  • 48.3k
32 votes
Accepted

Applicability of IBM's projected 50-qubit quantum computer Q to cryptanalysis?

TL;DR: Not much. If the qubits were very high quality, some very tricky algorithms could use them to do some algorithm subprocesses more quickly, but we actually have more quantity than quality. So it'...
Charles's user avatar
  • 528
29 votes

How effective is quantum computing against elliptic curve cryptography?

Elliptic curve cryptography is not presently vulnerable to quantum computing because there are no quantum computers big and reliable enough to matter. But it would be vulnerable to quantum computers ...
Squeamish Ossifrage's user avatar
29 votes
Accepted

Can neural cryptanalysis be applied to AES?

No. Neuro-Cryptanalysis fails on serious ciphers, including DES and AES. Sebastien Dourlens's Neuro-differential cryptanalysis of DES (in sections 5.4.2 and 5.4.3 of his 1996 mémoire) learns an S-box. ...
fgrieu's user avatar
  • 140k
29 votes

How to check a file was encrypted (really & correctly)

If you can't get access to the key for at least some sample uses, there's no way to be sure. For example, it's impossible to distinguish AES-128 from AES-256 if you don't have access to the key. That'...
Gilles 'SO- stop being evil''s user avatar
28 votes

What are recommended, general strategies to start block-cipher design and/or analysis?

There is no such thing as a clearly defined, unambiguous, optimal learning path. However, drawing from my own experience, I would suggest tackling the following in due sequence: Linear cryptanalysis: ...
Thomas Pornin's user avatar
24 votes

What is the new attack on SHA-1 "SHAttered" and how does it work?

It is an approximately1 $2^{64}$ time identical-prefix collision attack on SHA-1 based on the same principles as Marc Stevens' earlier attacks on SHA-1. It is the first practical collision attack on ...
otus's user avatar
  • 32.1k
24 votes
Accepted

What is hardened SHA-1, how does it work and how much protection does it offer?

Hardened SHA-1 detects collisions built of a certain form, If someone were to find a collision using brute-force birthday attack (currently not feasible) the detection would not work. The vectors are ...
Meir Maor's user avatar
  • 11.8k
22 votes
Accepted

Why is Pearson hash not used as a cryptographic hash?

Observation: An individual 1-byte pearson hash behaves like an 8 bit block cipher, encrypting the initial state using the message as key. This means that given a fixed message, each possible initial ...
CodesInChaos's user avatar
  • 24.8k
22 votes
Accepted

What does a "real" quantum computer need for cryptanalysis and/or cryptographic attack purposes?

For example: the 5-qubit quantum computer created at MIT by using the technique of ion traps succeeded in prime-factorizing 15. Does that mean that since it succesfully managed that, that it is a all-...
DanielSank's user avatar
22 votes
Accepted

How to prove security of a randomized encryption algorithm?

What you want to do is the right way. However it's not an easy one. What you really want to do is to show the following implication: $$ \newcommand{\hard}{\operatorname{hard}} \newcommand{\assumption}...
SEJPM's user avatar
  • 45.9k
22 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Bruce Schneier foresaw your skepticism and directly answered this question in "Applied Cryptography": Known-plaintext attacks and chosen-plaintext attacks are more common than you might think. It ...
Wildcard's user avatar
  • 320
21 votes
Accepted

How long does it take to crack RSA 1024 with a PC?

RSA-768 took 2000 years of 2.2Ghz single-core Opteron from the year 2009. DJB et al wrote in 2013 (see page 30) (see also: 29C3: FactHacks (EN); slide 87/112; about 10 minutes) that RSA-1024 would ...
Z.T.'s user avatar
  • 824
20 votes

How Far Ahead of Academia Are Government Agencies?

Disclaimer: This post is possibly opinion based. How far ahead (if at all) are governmental agencies of open source (specifically academic) research? This question is impossible to answer. By ...
Biv's user avatar
  • 9,979
20 votes
Accepted

Why don't we use Blowfish if it hasn't been cracked?

Why don't we use Blowfish if it hasn't been cracked? The reason is well-known, it has 64-bit block size and therefore it is vulnerable to birthday attacks. This is done for HTTPS and for more ...
kelalaka's user avatar
  • 48.3k
18 votes

Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?

Using $H(m\mathbin\Vert k)$ with hash function $H$, message $m$ and key $k$, is one possible way to build a MAC algorithm. It is not necessarily a good one; it depends on the used hash function. Even ...
Thomas Pornin's user avatar
18 votes
Accepted

Understanding the wide trail design strategy

Given the importance of the wide-trail strategy in modern symmetric-key cryptography, this question really deserves an answer (and a much better score). Since nobody else has tried, I'll give a brief ...
Aleph's user avatar
  • 1,856
17 votes

Why does the FBI ask Apple for help to decrypt an iPhone?

The encryption key isn't derived only from the passcode; it's also derived from a number of cryptographic keys etched directly into the CPU's silicon. These keys are impossible to read out in software—...
Becca Royal-Gordon's user avatar
17 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

It's not necessary that you encounter a situation like this in the real world to motivate the definition. There are some weaker adversaries that you would like to rule out in your security model, and ...
Daniel's user avatar
  • 3,932
17 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Practical chosen-plaintext attacks have been discovered against modern cryptosystems like TLS/SSL. One noteworthy type of vulnerability can occur when a cryptosystem includes a compression step before ...
nomadictype's user avatar
16 votes
Accepted

Does exposing algorithm, key size and IV weaken the security?

No cryptography worth its salt should become less secure because its inner workings are known. It is usually assumed that the adversary has all that information when doing security proofs (Kerchoff's ...
Adrian's user avatar
  • 196
16 votes
Accepted

Deep Learning application in decryption?

There is no evidence of deep learning breaking modern cryptography. Deep learning is simply glorified gradient descent. With a reasonable cipher you get no indication of almost finding the key, so I ...
Meir Maor's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible