34
votes
Accepted
What do the signature security abbreviations like EUF-CMA mean?
Notation.
Sets are represented using the calligraphic font and algorithms using the straight font. Throughout, $\Sigma:=(\mathsf{K},\mathsf{S},\mathsf{V})$ denotes a signature scheme on a key-space $\...
- 5,133
24
votes
Accepted
Why is a known-plaintext attack considered a complete break?
if a cipher has a known-plaintext attack, then it is considered completely broken.
Yes, pretty much...
[Paraphrased] But can't we come up with a case where this isn't true, such as a One Time Pad?
...
- 145k
17
votes
Why is a known-plaintext attack considered a complete break?
If the user changes the key for every message sent, then what use is a known-plaintext attack?
Stop right there. This is not what we are trying to prove when conducting a known-plaintext attack. A ...
- 38.5k
15
votes
Accepted
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.
Can I recover that key?
No. This is what is referred to as a ...
- 488
11
votes
Accepted
Would adding daily changing nulls in front of their messages have made the Engima harder to crack?
No, padding would make the message much easier to crack. This is a great example of why cryptography is left to the professionals (I am not a professional cryptographer, I'm not even a very good ...
- 461
11
votes
Accepted
Do all ciphers have equivalent decryption keys?
Do all ciphers suffer from the problem of multiple equivalent decryption keys?
No. The number of non-equivalent keys is bounded by the number of permutations. Since the number of permutations is very ...
- 91.9k
10
votes
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, ...
- 47.6k
8
votes
Accepted
Why is the Domingo-Ferrer cryptosystem not used in practice?
TLDR: The scheme is symmetric only, its "provable security" argument is flawed, and it is practically insecure when even a modest amount of plaintext is available to attackers.
I'm commenting on the ...
- 138k
8
votes
A modern rotor machine, could it be any safe?
No, modern standards for symmetric cryptography are heavily over-engineered and the power of chosen plaintext attacks/chosen ciphertext attacks can quickly uncover the structure of such a variant ...
- 21.9k
7
votes
Accepted
What's wrong with RSA and OpenSSL?
To a cryptographer, "signing a document is to encrypt its hash using signer's private key" is wrong, because:
It is specific to RSA and cousin cryptosystems including Rabin, and not even remotely ...
- 138k
7
votes
How to find the keyword of the Playfair cipher, given the plaintext and the ciphertext?
First of all, you cannot uniquely determine the keyword of a Playfair cipher, or even the key table constructed from it, simply because there are multiple equivalent key tables that will produce the ...
- 45.9k
7
votes
Accepted
Is Paillier secure from known plaintext attack for single character message?
Yes, Paillier encryption is secure from known plaintext attack (for single-character message, and any other supported message size). With high likelihood, three ciphertexts $c_1$, $c_2$ and $c_3$ for ...
- 138k
7
votes
Accepted
Is the ChaCha20 block function reversible using known plaintext?
The function which generates keystream blocks is based on a 512-bit permutation function. A permutation is, by definition, bijective.
The inverse of this permutation particular is trivial to ...
- 3,283
7
votes
AES with a different implementation of byte substitution step
If this is the mapping for the Sbox then
$$
S(a\oplus b)=S(a)\oplus S(B),$$
i.e., we have a linear Sbox. If you add two vectors and shift it is the same result as shifting them first then adding.
...
- 21.2k
6
votes
Why is AES resistant to known-plaintext attacks?
Since no one really answered the question:
AES is only resistant to known-text attacks if you always use a different randomized initialization vector (IV) for every single message.
To oversimplify a ...
- 169
6
votes
Accepted
Encrypting decimal values with AES
You don't normally encrypt anything with just AES. AES is a block cipher, and needs to be used with an appropriate mode of operation in order to securely encrypt general data.
In general terms, there ...
- 45.9k
6
votes
Accepted
How many required known plaintexts for an attack are considered insecure?
Firstly, is this a correct threshold for considering a cipher secure?
Not exactly. Security is a spectrum, so what is secure for some applications may not be secure for others. Is a $2^{-64}$ ...
- 15.1k
6
votes
Accepted
What were Alan Turing and their team searching before doing KPA in the movie "The imitation game"?
It's wrong to treat a Hollywood historical movie as a documentary. It's also wrong to think of Enigma as a single problem with a single solution. There were many variants of the Enigma machine which ...
- 21.9k
5
votes
Accepted
Affine plaintext attack with GCD != 1
You seem to have made a mistake in your arithmetic: $$108108 - 72097 = 36011 \ne 36012.$$
The number $36011$ is invertible modulo $256256$, and thus you can find $a$ and $b$ in a straightforward ...
- 45.9k
5
votes
What's wrong with RSA and OpenSSL?
We all know that signing a document is to encrypt its hash using
signer's private key.
Wrong.
Because...
Textbook RSA is not secure, and secure schemes are not just the reverse of each other. ...
- 1,187
5
votes
Is predictable ciphertext/plaintext bad?
Yes, if your ciphertext is repetitive, that's bad.
We can't really say how bad, since you haven't told us enough about your cryptosystem. It could be because you're using AES in ECB mode, which is ...
- 45.9k
5
votes
Understanding ransomware – What makes plain-text-attacks or brute-forcing so hard?
Does the length of the public key imply the length of the private key, or can they be unrelated?
Yes.
The sizes of public and private keys depend on the cryptosystem. Usually they are related ...
- 32k
5
votes
Accepted
Why does DESX break if one removed post whitening?
The goal of DESX is to improve the security above the 56-bit level offered by DES. So an attack that's merely as expensive as brute-forcing the DES key is an attack, even if it's still rather ...
- 24.8k
5
votes
One round of AES-128
UPDATE: improved attack to $2^{40}$, previous version of this answer had attack complexity $2^{48}$
I will try to improve the answer by @poncho for a single plaintext-ciphertext pair. My attack ...
- 3,067
5
votes
Construction of a "simple", nothing-up-my-sleeves, provably KPA resistant symmetric cipher
With this in mind, one would obviously want a cipher that is mathematically provable to be resistant to KPA.
Any scheme that has a message space larger than the key space and is unconditionally ...
- 45.7k
4
votes
Accepted
Could a strong round function be immune to slide attacks
Wikipedia is correct: any cipher that consists of a repeated number $n$ of iterations of the same function $F$ is vulnerable to the slide attack. Once you find a slid pair, the security of the cipher ...
- 12.4k
4
votes
Why is a known-plaintext attack considered a complete break?
Another, more indirect take on this: because of the semantic security requirement, we evaluate ciphers by their ability to resist an adaptive chosen-plaintext attack—where the attack not only sees ...
- 14.4k
4
votes
Accepted
Hill's Cipher - Known Plaintext Attack
Actually it seems to me that you are using the wrong basis and got the key for the other way around:
Suppose you have the plain text $x_1 = \pmatrix{5\\17}$ and $x_2= \pmatrix{8\\3 \\}$ and the ...
- 7,629
4
votes
Accepted
Brute force, get AES keys by multiple plain-texts with their cipher-texts
No, you can't get the key. That would require a key-recovery attack on the AES block cipher itself, and there are no known practical ways to do that.
Yes, with a fixed key and IV, and the ability to ...
- 45.9k
Only top scored, non community-wiki answers of a minimum length are eligible