11
votes
Stuck on a cryptanalytical research project
The fact that your attack only works when you're using "normal math" and not "cryptographical math" (by which I assume you probably mean modular arithmetic, or perhaps arithmetic ...
- 45.7k
6
votes
A modern rotor machine, could it be any safe?
No, modern standards for symmetric cryptography are heavily over-engineered and the power of chosen plaintext attacks/chosen ciphertext attacks can quickly uncover the structure of such a variant ...
- 20k
5
votes
Chosen-plaintext attact on AES with MixColumns omitted
From what I understand, he is basically saying that without MixColumns AES reduces to be a byte by byte cipher. So an attacker that can encrypt arbitrary plaintexts (that's the meaning of a chosen ...
- 432
4
votes
Accepted
Info AES cryptanalysis
There are many resources, including here on attacks on AES, which is a vast subject. Here are some pointers.
Summary: There are no noteworthy attacks on the full AES. Some attacks with gain over brute ...
- 19.9k
4
votes
Accepted
Is it safe to initialize a random number generator with MD5?
No, it is not safe to initialize a (CS)PRNG with the MD5 hash of a password.
That's not so much an issue with MD5 as it is an issue with initializing a PRNG with a function of a password that can be ...
- 134k
4
votes
Accepted
Best attack estimates on AES
The $2^{126.1}$ value is the number of AES encryptions (or equivalent computational workload) required by the attack. There is also a substantial data requirement that $2^{56}$ matched plaintext/...
- 20k
4
votes
In a PGP like Application , would compress and encrypt leak information
Compression before encryption can leak information in a few ways.
Compression occurs on the plaintext, encryption is on the result of compression, and then there's a public and quite precise relation ...
- 134k
4
votes
Accepted
Confusion+Diffusion comparison table? (e.g. with Avalanche Criterion / SAC)
xor-streaming ciphers have no (0, zero, zilch) diffusion - you switch 1 bit in the ciphertext, you know which single bit in the plaintext after decryption will be flipped.
Indeed, there is no ...
- 134k
3
votes
In a PGP like Application , would compress and encrypt leak information
Just a little clarification: PGP is mainly used for data on the move as it encrypts messages between two keys/accounts (unless you use symmetrical options which isn't really its raison d'etre).
Both ...
- 14.6k
3
votes
Accepted
How bad exactly are repetitions in the plaintext?
Padding oracles are relatively specific to a padding mode to be used. What you seem to be talking about is a specific plaintext oracle; a padding oracle can be seen as a special form of plaintext ...
- 90.2k
3
votes
Accepted
A probable attack for RSA (factorization): how to improve it?
This appears to be a special case of congruence of squares factoring. I don't see any particular reason why this form of congruence should be easier to solve than the generic form.
The congruence of ...
- 20k
3
votes
How fast does revealing parity bits leak information?
As noted by Mark, the parity bit leaks precisely one bit of information about the key. This bit of information is the parity of the key. The key observation here is that
$$\mathrm{parity}(k\oplus p)=\...
- 20k
3
votes
Accepted
Significance of theoretical weaknesses?
A theoretical weakness is IMHO defined as one that hasn't been attacked in practice. Sometimes it is clear that it never will be attacked (e.g. an attack on AES that leaves 126 bits of security ...
- 90.2k
3
votes
Accepted
What are the best known cryptanalytic attacks against AES-128 with 9 rounds?
The only academic paper for 9 rounds of AES-128 that I can find is
Structural Evaluation of AES and Chosen-Key Distinguisher of 9-Round AES-128 at here.
I also find it weird that this hasn't been ...
- 44
3
votes
Breaking RSA with P,Q LSB bits
The title of the question is about bits, but the example in the body gives decimal digits. I'll note $b$ for the base we are given digits, and I'll assume $b$ is even and coprime with $N$. I'll note $...
- 134k
2
votes
Why would the same cipher structure have a different optimal attack for different bit widths?
There are couple of reasons.
First of all, the notion that the relative power of different attack methods against a cipher depends only on the logical structure and not on the block and key size (at ...
- 539
2
votes
Accepted
Which is the smallest, cyclic in 3 directions, consistent structure of random values which can be hidden at the adversaries machine? (some comparison)
Something half baked. Let $s$ be some integer, multiple of $3$, in the order of $2^{50}$. Let the set be triplets $(x,y,z)\in[0,s)^3$, with $N=s^3\approx2^{150}$ elements. Define $$f(x,y,z)=\begin{...
- 134k
2
votes
Recover all keys on differential cryptanalysis
Generally, if you want to recover k4, you will need to use a 4-round differential trail rather than the same 5-round trail you used for k5. This is because when you generated the pairs for the latter ...
- 21
2
votes
LWE with a binary matrix A
My understanding is that when $A$ is binary, the problem is completely broken by this paper:
LP Solutions of Vectorial Integer Subset Sums - Cryptanalysis of Galbraith's Binary Matrix LWE
Alexander ...
- 1,149
2
votes
Accepted
LWE with a binary matrix A
The LWE problem is only believed to be hard when A is uniformly random, and, in fact, can easily be broken in special cases such as when A is binary or have some kind of very special structure.
Note ...
- 151
2
votes
Do snapshots of Encrypted Disk Images weaken security?
Yes, snapshots of encrypted disk images weaken security. How much they do so depends on the exact algorithm, but it's impossible to have decent performance for disk encryption with perfect security if ...
2
votes
What is the standard checklist for designing a Key Derivation Function?
By definition, one-time pad key must be truly random, not derived by function. So if you have 1MB of truly random data, you do not need KDF function to derive key. And if yo do nout have 1MB of truly ...
- 21
2
votes
Accepted
Why is the best way to solve LWE (and Cryptographic related Systems) with SVP (approx)?
The inability to show necessity in our preferred means of attacking a cryptographic system is really quite common.
Historically, our preferred method of breaking RSA when assessing security has been ...
- 20k
2
votes
Accepted
How does AES-CBC encryption achieve non-repeating blocks of ciphertext?
Have a look at the diagram in the CBC section of Wikipedia's article on modes of operation.
As indicated in that section:
In CBC mode, each block of plaintext is XORed with the previous ciphertext ...
- 548
2
votes
Stuck on a cryptanalytical research project
There is already a good answer. In addition, if you think actual cryptosystems used today are at risk but you believe "clock arithmetic" works makes me think actual (public key) ...
- 19.9k
2
votes
Rule 30 based block cipher
There have been people considering CA for cryptanalysis. The problem is that CA leads to an unbounded state and this uses unbounded memory. Thus some dubious claims of "breaking" ...
- 19.9k
2
votes
Rule 30 based block cipher
Knowing a single plaintext/ciphertext pair $(p,c)$ at least as large as the password is enough to decipher any ciphertext $c'$ at least as large as $c$ encrypted with the same password.
Just compute $...
- 134k
2
votes
Accepted
Are Schnorr's algorithm really subject to q-computer attacks?
The quantum Fourier transform is more powerful than a black box that returns the period of a cyclic group.
A more general application is the hidden abelian subgroup problem. In the case of discrete ...
- 20k
2
votes
Best Known Attacks on Discrete Logarithm in Generic Groups
The generic group model is an idealized cryptographic model for which an adversary only has access to a group oracle, which simulates a generic group of prime order. The intuition is that the group ...
- 920
1
vote
How fast does revealing parity bits leak information?
A few things.
This (clearly) leaks at most one bit per invocation
it might be good for slightly more than 128 calls, but only slightly. Roughly what happens is that each public value $\vec p_i$ ...
- 10.8k
Only top scored, non community-wiki answers of a minimum length are eligible