18

Why don't we use Blowfish if it hasn't been cracked? The reason is well-known, it has 64-bit block size and therefore it is vulnerable to birthday attacks. This is done for HTTPS and for more information see sweet32; $$\text{Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN} $$ Is it safe to use Blowfish to encrypt strings of less than ...


10

There's simply no way to know. I find it very unlikely that AES will be vulnerable to a ciphertext-only attack in the next 20 years (remember, it has been around for over 20 years already and attacks haven't gotten very far). There's no reason to believe the same won't be true for ChaCha20. If you use a good cipher with 256-bit keys (to avoid potential ...


10

The short answer is that LLL (or more generally, lattice reduction methods) is useful when you can convert your problem into finding a small linear combination of known vectors. Let's take your example and make it concrete. Let $m = 2^{64}$, $a = 7244019458077122845$, $b=1$, and the we have a generator that outputs the upper 16 bits of the state at each ...


9

An example that literally made the headlines in France in March 2000 involves factorization of the 321-bit RSA modulus that was a safeguard to the security of most debit/credit cards issued by French banks. The incident is known as "YesCard". It started to surface publicly circa 1998. An individual factored the modulus used¹ to verify the issuer-...


8

I would also be interested in attacks against primitives that are known to be weak, provided they were against some notable company (where "notable" essentially means "something an average person may have heard of"). The first example that comes to mind in TJX's use of WEP 5 years after the break was announced; that lead to millions of ...


7

The biggest problem is the 64-bit block size already mentioned in kelalaka's answer, but Blowfish has a couple of other issues: It can't be implemented using the hardware AES acceleration found in many modern CPUs. While this is obviously unfair, it's a reality of the world right now and it's a factor in many people's choice of AES. The hardware ...


6

Phil Zimmermann did not use DES or the RSA-owned RC-2 as models for the Bass-O-Matic cipher. For the basis of that symmetric cipher, he used the work of a man named Charlie Merritt. Zimmermann's strong suit was not mathematics but programming in C, so he needed help. Merritt had called Zimmermann by phone (at Metamorphic Systems, a 1980 startup by Zimmermann)...


6

However how do I determine which transposition cipher I would need to use? Am I right to assume this is definitely a transposition cipher also? As you found out that the ciphertext has a similar frequency to the English letter frequency. This can lead to lots of possibilities It can be a shift cipher, that is the generalization of the Caesar cipher $$c = m ...


6

(This answer pertains to Signal protocol, which underlies applications like Signal and WhatsApp. As far as I know, WhatsApp software is not open source and therefore it is hard to ascertain whether/how they actually implement the Signal protocol. The source-code of Signal application is, on the other hand, available.) On a high level, the Signal protocol ...


5

You don't get empty output in AES, too. AES is a permutation and will always return a plaintext, correct or not depending on the key. If I take the SHA3_512 of the Argon2ID-ed password and include it with the ciphertext, is the ciphertext now vulnerable to attacks? One needs to find a pre-image to the key, and normally the cost of this is around $2^{512}$ ...


5

You can't under a standard assumption known as the "Decisional NTRU Assumption". This is essentially the statement that NTRU public keys are pseudorandom. The following is definition 4.4.4 of A Decade of Lattice Cryptography. NTRU Learning Problem: For an invertible $s\in R_q^*$, and distribution $\chi$ on $R$, define $N_{s, \chi}$ to be the ...


4

In this formulation you need to convert your function's output range to $\{-1,+1\}$ via $$f`(x)=(-1)^{f(x)}$$ and apply the Walsh Hadamard to the new function $f`(x)$. Using the zero one formulation means you are off by a constant depending on the number of variables since $$ (-1)^u=1-2u $$ for $u\in \{0,1\}.$ See my answer below on Boolean functions and ...


4

Some of us believe that it is possible to create ciphers and hash algorithms that are unbreakable (like when people said that we'd never run into an MD5 collision in the lifetime of the universe), but get broken in a couple of decades time (MD5 collision can be created on a modern PC in minutes). MD5 or any other hash function is not proven to be secure. ...


4

Known Plaintext Attack (KPA) is the security level that is below of Chosen Plaintext Attack (CPA) that we want at least CPA from all ciphers. Actually, we want more in the modern cryptography; Ind-CPA. The classical cryptography era contains lots of examples that can be easily broken with KPA attack; shift, permutation, Vegenere, and Hill ciphers are some ...


4

That is not practical since either you keep a sequence of the bits of the $\pi$ or regenerate them every time. You may need to store 64GB sequence if you want to encrypt such files. Then you need to multiply it with the 128-bit number. That is not practical, consider multiplication of 64GB number with a random 128-bit number. OTP needs true random bit ...


4

No, breaking the collision property of SHA-256 does not require any close to $2^{128}$ space. We know how to exhibit collision in any $n$-bit hash $H$ with $\mathcal O(2^{n/2})$ hash evaluations and $\mathcal O(n)$ space. The simplest suitable method is Floyd's cycle finding, which will exhibit with non-vanishing probability two distinct $n$-bit bitstrings $...


4

Indeed, modulo a prime, already $r^2$ are non-uniform - only half of the values are possible. While the computed polynomials indeed do not follow uniform distribution, the non-uniformity is bounded: each output value of the polynomial may have at most $L$ preimages (roots), where $L$ is its degree, equal to the number of blocks. Meaning that the probability ...


3

Playfair key grids are often generated by filling in the letters of a key phrase, then completing the grid with the remaining unused letters of the alphabet. It looks to me like the partial grid you provided has been created in this way. If so, you can fill in several more letters straight away (assuming there is no J): ? A ? D ? ? A ? D ? ? ? ? ...


3

Basically, the norm of the secret key does not depend on $q$, while the norm of the second minimum of the lattice does, so, when you increase $q$, you increase the gap between the first and the second minima of the lattice, which makes the problem easier. For instance, if the secret key is composed by two degree-$(N-1)$ polynomials $f$ and $g$ with ...


3

$\chi^2$ measures the uniformity of a sample distribution. It's commonly used to test samples for randomness (I don't want any hassle on this), to do with true and pseudo random number generators. Uniformity is absolutely necessary for cryptography which you can read about elsewhere herein. E.g. $dd if=/dev/urandom of=/tmp/urandom bs=1000 count=1000 $ent /...


3

I know that theoretically, the security of the setup when used correctly is at least as secure as the most secure. That's true if they use independent keys. If they use the same key, the security of the cascaded cipher may be much worse. Consider the case where cipher B happens to be the exact inverse of cipher A with the same key. However, that doesn't ...


3

Are there any problems with this constant-time comparison scheme? One obvious issue is that it'll claim the strings "AB" and "BA" are the same; during the first character, it'll see 'A'-'B' = -1, for the second character, it'll see 'B'-'A' = 1; those two sum to 0. On the other hand, that's actually fairly close to the standard way to do ...


3

Is there an algorithm [...] that receives $\it C$ and $s$ as input and the output is the probability that $\it C$ is encrypted by $s$? No. Not unless the system $s$ in question is horribly broken. The reason is simple: Most modern symmetric encryption schemes are built from primitives which are designed to heuristically achieve one of three security ...


3

A few data points for AES-128. In 2018 Bar-On, Dunkelman, Keller, Ronan and Shamir described a 32-bit attack on 5 round AES (attack complexity here is the maximum of data, memory and computation requirements) and claimed a 99-bit attack on 7 round AES. The 2011 biclique cryptanalysis paper of Bogdanov, Khovratovich and Rechberger claims a 125.4-bit attack on ...


3

In these papers they are trying to search for a strong boomerang trail and are semi-exhaustively searching over families of trails where each family has a higher chance of holding than a trail chosen uniformly at random from all possible trails. In these families the unspecified differentials are what we (semi-)exhaust over and the specified parts of the ...


3

I'm going to treat this question as a strict one time pad one. With a key k of sufficient length, say 128 bits, is it possible to use kth multiple of π as a one-time pad? That's 107 characters of description plus 128 bits of secrecy (plus $\pi$ which is a known constant). Your Kolmogorov complexity cannot exceed 200 characters if you consider that:- $$\pi =...


3

An Elliptic curve defined over the finite Field $\mathbb F_p$ means that all of the coordinates are elements of $\mathbb F_p$, i.e. in affine coordinates, let $P=(x,y)$ be a point then $x,y \in \mathbb F_p$. Actually, all of the arithmetic is done over $\mathbb F_p$ In the encoding 04 11 95 23 03 f0 f1 f1 45 67 14 98 e4 39 80 ce 25 39 02 6e 72 34 fe 02 38 8a ...


3

DES keys are considered to be weak for two reasons depending on the context for what "weak" means. First, DES keys are considered to be weak because they are only 56 bit keys giving only $2^{56}$ possible keys. That small of a key space is searchable by brute force by even fairly low-capability attackers. Second, DES keys can be considered to be ...


3

The question asks if this paper, and in particular it's table 3 (the second image in the question, more readable here) shows a cryptographic weakness of SHA-256. No, it does not. The table tells that the SHA-256 hash of password, 123456789, 111111, qwerty, and dragon are identified as such by Crackstation, Cmd5, and Hashcat; but the (different) hash of these ...


2

The encryption process will use MiniAES which IS same as normal AES with all component reduced while maintaining the same structure and security of normal AES. MiniAES most certainly does not have the same security as normal AES. To quote the original paper: It is meant to be a purely educational cipher and is not considered secure for actual applications. ...


Only top voted, non community-wiki answers of a minimum length are eligible