Tag Info

Accepted

How to check whether the permutation is random or not

There are at most $n \cdot (n - 1)$ permutations of $\mathbb Z/n\mathbb Z$ of the form $x \mapsto ax + b$: if $n$ is prime, there are $n - 1$ choices for $a$ and $n$ choices for $b$ under which this ...
• 48.8k
Accepted

Are encryption algorithms with fixed-point free permutations inherently flawed?

Are all encryption algorithms with fixed-point free permutations inherently flawed? Yes - when fixed points, or the lack of them, is knowable and detectable. This is a violation of multiple ...
• 369

Are encryption algorithms with fixed-point free permutations inherently flawed?

Are all encryption algorithms with fixed-point free permutations inherently flawed? No, they are not inherently flawed. Consider the following cipher: Let $k_0$ be a key for AES-256, and let $k_1$...
• 48.8k
Accepted

• 1,157
Accepted

Relationship between existence of OWFs and OWPs

Short answer: "No". The standard way to establish a statement of the form if a primitive $B$ exists then another primitive $A$ also exists is through a black-box reduction. This involves two steps: ...
• 5,368

Why is AES not a Feistel cipher?

The simple answer is "Because its an SPN cipher". What is difference between Feistel and SPN? SPN operates on whole data in one round, where as Feistel divides data into N parts where N>=2 , then ...
• 2,449

Randomness Testing

There is no such thing as randomness of a sequence (or of a permutation, or of a string, etc.). There is only randomness of a process for choosing sequences (permutations, strings, etc.), which is ...
• 48.8k
Accepted

Parity attack on block cipher

When dealing with a block cipher of large block size, the text appearing as a quote in the question Most modern block ciphers have a 128-bit block size, but they operate on 32-bit words. They build ...
• 143k

Can we exchange the permutation of a sponge construction?

The permutation should be as close to a random permutation as possible. This is essentially a block-cipher with a fixed key. A random permutation with given width $b$ is a permutation drawn ...
• 24.9k
Accepted

One-way permutation over a small interval?

How about this. Find an elliptic curve mod $p$, say $E:y^2=x^3+ax+b$ for some 256-bit prime $p$ such that the curve $E$ and its twist $E':dy^2=x^3+ax+b$ with $(\frac dp)_L=-1$ are both of prime order. ...
• 24.1k

Creating single-cycle permutations

The obvious way to construct such a pseudorandom single-cycle permutation is to take a pseudorandom permutation $P$ (which need not be single-cycle), a simple fixed single-cycle permutation $Inc$ (e.g....
• 149k

Are encryption algorithms with fixed-point free permutations inherently flawed?

Block ciphers operators from $\{0,1\}^n \to \{0,1\}^n$. Each key selects one permutation among all possible permutations $n!$ and this is very small one if you compare $2^{128}$ to $128^{128}$ For ...
• 49.1k
Accepted

How strong is XooDoo vs AES?

Gimli is an unkeyed permutation, mapping a 384-bit input to a 384-bit output, $\{0,1\}^{384} \rightarrow \{0,1\}^{384}$. It is not a cipher by itself as you can reverse the output if you have it in ...
• 15.4k
Accepted

Are any block ciphers provably free of equivalent keys?

Yes, some block ciphers provably have no equivalent keys. For a start, it's very easy to exhibit such a block cipher, by restricting the key and message spaces to something enumerable. Granted, that ...
• 143k

Shannon confusion and diffusion concept

I find the terms "confusion" and "diffusion" to be slightly nebulous and can lead to over-simplifications. Confusion For example, saying that "substitution" is responsible for "confusion" is not ...
• 19.7k
Accepted

Can we exchange the permutation of a sponge construction?

The security of the sponge construction rely on two parts: the size of the capacity. and the strength of the permutation used in the construction. This permutation is expected to have at least the ...
• 10k

DES: how does Richard Outerbridge's Initial Permutation operate?

By definition, applying the initial Permutation of DES is shuffling bits per ...
• 143k

modified substitution permutation networks

Your construction is completely insecure: a single known plaintext / ciphertext block pair is sufficient to decrypt all blocks encrypted with the same key. Specifically, let me write your block ...
• 46.2k

How to check whether the permutation is random or not

This precise issue recently arose in light of suspicious patterns in the S-box of a Russian cipher Kuznyechik. See: Xavier Bonnetain and Léo Perrin and Shizhu Tian: Anomalies and Vector Space ...
• 13.9k
Accepted

Why I can't permutate an email and get away with it?

I can understand why a simple substitution cipher can be broken easily due to English letter frequencies can be used and even English diagrams like th can be used, ...
• 49.1k

Why I can't permutate an email and get away with it?

It's worth mentioning that permuting things can still leak a lot of information. For example, imagine you see an email with some (small) number of numerals (say 3 or 4), and a symbol such as ...
• 13.5k

Pseudo-random permutation of a range

The problem is small enough that the desired PRP can be implemented as a small array of 16 values initialized using the Fisher-Yates shuffle, with a pseudo-random generator deciding the indexes of the ...
• 143k

What is the importance of $f_k$ in a feistel network being a permutation

I assume that you are referring to the round function. This is false. The whole advantage of a Feistel network is that $f_k$ does not need to be a permutation. Indeed in DES, it is not a permutation. ...
Accepted

Permutation for which an inverse is a hard problem

It is obviously possible; one simple example is the function $f(x) = g^x - 1 \bmod p$, where $p$ is a large prime, and $g$ generates the entire group $\mathbb{Z}_p^*$; this is permutation over the ...
• 149k

Are encryption algorithms with fixed-point free permutations inherently flawed?

There are three nice answers here, each supported with well thought out arguments. It seems to me that not only is it difficult to distinguish between fixed point free and non fixed point free ...
• 22.9k
Accepted

Sponge with PRF instead of PRP

I sent a mail to the Keccak team asking about this, and I got a response from one of the authors (Joan Daemen to be specific). According to him, we actually can instantiate Sponge functions and ...
• 9,509