29 votes
Accepted

What do the signature security abbreviations like EUF-CMA mean?

Notation. Sets are represented using the calligraphic font and algorithms using the straight font. Throughout, $\Sigma:=(\mathsf{K},\mathsf{S},\mathsf{V})$ denotes a signature scheme on a key-space $\...
user avatar
  • 4,503
23 votes
Accepted

Why is a known-plaintext attack considered a complete break?

if a cipher has a known-plaintext attack, then it is considered completely broken. Yes, pretty much... [Paraphrased] But can't we come up with a case where this isn't true, such as a One Time Pad? ...
user avatar
  • 134k
16 votes

Why is a known-plaintext attack considered a complete break?

If the user changes the key for every message sent, then what use is a known-plaintext attack? Stop right there. This is not what we are trying to prove when conducting a known-plaintext attack. A ...
user avatar
  • 37.8k
15 votes
Accepted

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? No. This is what is referred to as a ...
user avatar
  • 478
11 votes

Does having a known plaintext prefix weaken AES256?

When using CTR Mode the AES is used to generate a kind of key stream which itself is the XORed to your plaintext. So AES is actually encrypting an incrementing counter. At the moment there is no ...
user avatar
  • 768
11 votes
Accepted

Does having a known plaintext prefix weaken AES256?

AES-256 has sustained 15 years of cryptanalysis, and it can be stated that no knowledge of some plaintext bytes would help to reveal the other bytes no matter what mode of operation (CBC, CTR, etc.) ...
user avatar
11 votes
Accepted

Would adding daily changing nulls in front of their messages have made the Engima harder to crack?

No, padding would make the message much easier to crack. This is a great example of why cryptography is left to the professionals (I am not a professional cryptographer, I'm not even a very good ...
user avatar
  • 451
11 votes
Accepted

Do all ciphers have equivalent decryption keys?

Do all ciphers suffer from the problem of multiple equivalent decryption keys? No. The number of non-equivalent keys is bounded by the number of permutations. Since the number of permutations is very ...
user avatar
  • 85.9k
10 votes

Breaking ZIP 2.0 encryption without password

I will start with all relevant references I found, then tentatively answers the question. Feel free to improve this community wiki. It was originally asked the effort to break PKZIP 2 encryption, ...
10 votes
Accepted

RC4 , Is it possible to find the key if we know the plaintext and ciphertext?

No, to the best of our knowledge, it is not possible, apart from a brute force search over all possible keys. RC4 has known cryptographical weaknesses; however, none of them are of much help in ...
user avatar
  • 134k
10 votes

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, ...
user avatar
  • 43.5k
7 votes
Accepted

What's wrong with RSA and OpenSSL?

To a cryptographer, "signing a document is to encrypt its hash using signer's private key" is wrong, because: It is specific to RSA and cousin cryptosystems including Rabin, and not even remotely ...
user avatar
  • 125k
7 votes
Accepted

Is Paillier secure from known plaintext attack for single character message?

Yes, Paillier encryption is secure from known plaintext attack (for single-character message, and any other supported message size). With high likelihood, three ciphertexts $c_1$, $c_2$ and $c_3$ for ...
user avatar
  • 125k
7 votes
Accepted

Why is the Domingo-Ferrer cryptosystem not used in practice?

TLDR: The scheme is symmetric only, its "provable security" argument is flawed, and it is practically insecure when even a modest amount of plaintext is available to attackers. I'm commenting on the ...
user avatar
  • 125k
7 votes

AES with a different implementation of byte substitution step

If this is the mapping for the Sbox then $$ S(a\oplus b)=S(a)\oplus S(B),$$ i.e., we have a linear Sbox. If you add two vectors and shift it is the same result as shifting them first then adding. ...
user avatar
  • 16.7k
6 votes

Known plaintext attack on ElGamal encryption

Your parameters that you provide are incomplete (in what group are you working?). Anyways, lets assume that you work in $\mathbb{Z}_p^*$, your have a generator $g$ and your public key is $y=g^x$. ...
user avatar
  • 12.1k
6 votes

Why is AES resistant to known-plaintext attacks?

Since no one really answered the question: AES is only resistant to known-text attacks if you always use a different randomized initialization vector (IV) for every single message. To oversimplify a ...
user avatar
  • 169
6 votes

How to find the keyword of the Playfair cipher, given the plaintext and the ciphertext?

First of all, you cannot uniquely determine the keyword of a Playfair cipher, or even the key table constructed from it, simply because there are multiple equivalent key tables that will produce the ...
user avatar
6 votes
Accepted

Encrypting decimal values with AES

You don't normally encrypt anything with just AES. AES is a block cipher, and needs to be used with an appropriate mode of operation in order to securely encrypt general data. In general terms, there ...
user avatar
6 votes
Accepted

How many required known plaintexts for an attack are considered insecure?

Firstly, is this a correct threshold for considering a cipher secure? Not exactly. Security is a spectrum, so what is secure for some applications may not be secure for others. Is a $2^{-64}$ ...
user avatar
  • 13.6k
5 votes

Is the idea of a known plaintext attack really that new?

No, the idea is much older. Don't trust the movie too far, Turing actually searched for the word "eins" (one) because it was the most common number used. Far more likely to appear than "Heil Hitler" ...
user avatar
5 votes

Understanding ransomware – What makes plain-text-attacks or brute-forcing so hard?

Does the length of the public key imply the length of the private key, or can they be unrelated? Yes. The sizes of public and private keys depend on the cryptosystem. Usually they are related ...
user avatar
  • 31.3k
5 votes

Is predictable ciphertext/plaintext bad?

Yes, if your ciphertext is repetitive, that's bad. We can't really say how bad, since you haven't told us enough about your cryptosystem. It could be because you're using AES in ECB mode, which is ...
user avatar
5 votes

What's wrong with RSA and OpenSSL?

We all know that signing a document is to encrypt its hash using signer's private key. Wrong. Because... Textbook RSA is not secure, and secure schemes are not just the reverse of each other. ...
user avatar
  • 1,187
5 votes
Accepted

Affine plaintext attack with GCD != 1

You seem to have made a mistake in your arithmetic: $$108108 - 72097 = 36011 \ne 36012.$$ The number $36011$ is invertible modulo $256256$, and thus you can find $a$ and $b$ in a straightforward ...
user avatar
5 votes
Accepted

Why does DESX break if one removed post whitening?

The goal of DESX is to improve the security above the 56-bit level offered by DES. So an attack that's merely as expensive as brute-forcing the DES key is an attack, even if it's still rather ...
user avatar
  • 24.1k
5 votes

One round of AES-128

UPDATE: improved attack to $2^{40}$, previous version of this answer had attack complexity $2^{48}$ I will try to improve the answer by @poncho for a single plaintext-ciphertext pair. My attack ...
user avatar
  • 3,009
5 votes

Construction of a "simple", nothing-up-my-sleeves, provably KPA resistant symmetric cipher

With this in mind, one would obviously want a cipher that is mathematically provable to be resistant to KPA. Any scheme that has a message space larger than the key space and is unconditionally ...
user avatar
  • 44.7k

Only top scored, non community-wiki answers of a minimum length are eligible