Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
35 votes
Accepted

What do the signature security abbreviations like EUF-CMA mean?

Notation. Sets are represented using the calligraphic font and algorithms using the straight font. Throughout, $\Sigma:=(\mathsf{K},\mathsf{S},\mathsf{V})$ denotes a signature scheme on a key-space $\...
ckamath's user avatar
  • 5,248
24 votes
Accepted

Why is a known-plaintext attack considered a complete break?

if a cipher has a known-plaintext attack, then it is considered completely broken. Yes, pretty much... [Paraphrased] But can't we come up with a case where this isn't true, such as a One Time Pad? ...
poncho's user avatar
  • 148k
17 votes

Why is a known-plaintext attack considered a complete break?

If the user changes the key for every message sent, then what use is a known-plaintext attack? Stop right there. This is not what we are trying to prove when conducting a known-plaintext attack. A ...
mikeazo's user avatar
  • 38.6k
15 votes
Accepted

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? No. This is what is referred to as a ...
kiwidrew's user avatar
  • 488
11 votes
Accepted

Do all ciphers have equivalent decryption keys?

Do all ciphers suffer from the problem of multiple equivalent decryption keys? No. The number of non-equivalent keys is bounded by the number of permutations. Since the number of permutations is very ...
Maarten Bodewes's user avatar
  • 92.9k
10 votes

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, ...
kelalaka's user avatar
  • 48.7k
8 votes
Accepted

Why is the Domingo-Ferrer cryptosystem not used in practice?

TLDR: The scheme is symmetric only, its "provable security" argument is flawed, and it is practically insecure when even a modest amount of plaintext is available to attackers. I'm commenting on the ...
fgrieu's user avatar
  • 142k
8 votes

A modern rotor machine, could it be any safe?

No, modern standards for symmetric cryptography are heavily over-engineered and the power of chosen plaintext attacks/chosen ciphertext attacks can quickly uncover the structure of such a variant ...
Daniel S's user avatar
  • 23.9k
7 votes

How to find the keyword of the Playfair cipher, given the plaintext and the ciphertext?

First of all, you cannot uniquely determine the keyword of a Playfair cipher, or even the key table constructed from it, simply because there are multiple equivalent key tables that will produce the ...
Ilmari Karonen's user avatar
7 votes
Accepted

What's wrong with RSA and OpenSSL?

To a cryptographer, "signing a document is to encrypt its hash using signer's private key" is wrong, because: It is specific to RSA and cousin cryptosystems including Rabin, and not even remotely ...
fgrieu's user avatar
  • 142k
7 votes
Accepted

Is Paillier secure from known plaintext attack for single character message?

Yes, Paillier encryption is secure from known plaintext attack (for single-character message, and any other supported message size). With high likelihood, three ciphertexts $c_1$, $c_2$ and $c_3$ for ...
fgrieu's user avatar
  • 142k
7 votes
Accepted

Is the ChaCha20 block function reversible using known plaintext?

The function which generates keystream blocks is based on a 512-bit permutation function. A permutation is, by definition, bijective. The inverse of this permutation particular is trivial to ...
Future Security's user avatar
7 votes

AES with a different implementation of byte substitution step

If this is the mapping for the Sbox then $$ S(a\oplus b)=S(a)\oplus S(B),$$ i.e., we have a linear Sbox. If you add two vectors and shift it is the same result as shifting them first then adding. ...
kodlu's user avatar
  • 22.6k
6 votes
Accepted

Encrypting decimal values with AES

You don't normally encrypt anything with just AES. AES is a block cipher, and needs to be used with an appropriate mode of operation in order to securely encrypt general data. In general terms, there ...
Ilmari Karonen's user avatar
6 votes
Accepted

How many required known plaintexts for an attack are considered insecure?

Firstly, is this a correct threshold for considering a cipher secure? Not exactly. Security is a spectrum, so what is secure for some applications may not be secure for others. Is a $2^{-64}$ ...
forest's user avatar
  • 15.3k
6 votes
Accepted

What were Alan Turing and their team searching before doing KPA in the movie "The imitation game"?

It's wrong to treat a Hollywood historical movie as a documentary. It's also wrong to think of Enigma as a single problem with a single solution. There were many variants of the Enigma machine which ...
Daniel S's user avatar
  • 23.9k
5 votes

What's wrong with RSA and OpenSSL?

We all know that signing a document is to encrypt its hash using signer's private key. Wrong. Because... Textbook RSA is not secure, and secure schemes are not just the reverse of each other. ...
deviantfan's user avatar
  • 1,187
5 votes

Is predictable ciphertext/plaintext bad?

Yes, if your ciphertext is repetitive, that's bad. We can't really say how bad, since you haven't told us enough about your cryptosystem. It could be because you're using AES in ECB mode, which is ...
Ilmari Karonen's user avatar
5 votes
Accepted

Affine plaintext attack with GCD != 1

You seem to have made a mistake in your arithmetic: $$108108 - 72097 = 36011 \ne 36012.$$ The number $36011$ is invertible modulo $256256$, and thus you can find $a$ and $b$ in a straightforward ...
Ilmari Karonen's user avatar
5 votes
Accepted

Why does DESX break if one removed post whitening?

The goal of DESX is to improve the security above the 56-bit level offered by DES. So an attack that's merely as expensive as brute-forcing the DES key is an attack, even if it's still rather ...
CodesInChaos's user avatar
  • 24.9k
5 votes

One round of AES-128

UPDATE: improved attack to $2^{40}$, previous version of this answer had attack complexity $2^{48}$ I will try to improve the answer by @poncho for a single plaintext-ciphertext pair. My attack ...
Fractalice's user avatar
  • 3,097
5 votes

Construction of a "simple", nothing-up-my-sleeves, provably KPA resistant symmetric cipher

With this in mind, one would obviously want a cipher that is mathematically provable to be resistant to KPA. Any scheme that has a message space larger than the key space and is unconditionally ...
SEJPM's user avatar
  • 46.1k
4 votes

Why is a known-plaintext attack considered a complete break?

Another, more indirect take on this: because of the semantic security requirement, we evaluate ciphers by their ability to resist an adaptive chosen-plaintext attack—where the attack not only sees ...
Luis Casillas's user avatar
4 votes
Accepted

Hill's Cipher - Known Plaintext Attack

Actually it seems to me that you are using the wrong basis and got the key for the other way around: Suppose you have the plain text $x_1 = \pmatrix{5\\17}$ and $x_2= \pmatrix{8\\3 \\}$ and the ...
Lery's user avatar
  • 7,699
4 votes
Accepted

Could a strong round function be immune to slide attacks

Wikipedia is correct: any cipher that consists of a repeated number $n$ of iterations of the same function $F$ is vulnerable to the slide attack. Once you find a slid pair, the security of the cipher ...
Samuel Neves's user avatar
  • 12.6k
4 votes
Accepted

Brute force, get AES keys by multiple plain-texts with their cipher-texts

No, you can't get the key. That would require a key-recovery attack on the AES block cipher itself, and there are no known practical ways to do that. Yes, with a fixed key and IV, and the ability to ...
Ilmari Karonen's user avatar
4 votes
Accepted

AES-ECB known ciphertext/plaintext attack

Knowing the AES-ECB ciphertext for I am not tall does not help you find you the ciphertext for I am yes tall. (Well, it does, ...
Gilles 'SO- stop being evil''s user avatar
4 votes
Accepted

It's safe to store a known value (for checking) next to the actually encrypted values

Yes, it is secure to do this. Any cipher should be secure against known plaintext attacks after all. However, if you're using RSA then the RSA decryption routine will already throw an exception ...
Maarten Bodewes's user avatar
  • 92.9k
4 votes

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

As the other answers have mentioned, you basically have no hope of executing a key-recovery attack. This does not mean, however, that you should give up and go home. Key recovery is not the only kind ...
ymbirtt's user avatar
  • 678

Only top scored, non community-wiki answers of a minimum length are eligible