Dmitry Khovratovich
  • Member for 8 years, 2 months
  • Last seen more than 1 year ago
AES-GCM Disadvantage
40 votes

AES-GCM has the following problems: In the case of nonce reuse both integrity and confidentiality properties are violated. If the same nonce is used twice, an adversary can create forged ciphertexts ...

View answer
Why should I use Authenticated Encryption instead of just encryption?
Accepted answer
36 votes

The crucial difference between plain encryption and authenticated encryption (AE) is that AE additionally provides authenticity, while plain encryption provides only confidentiality. Let's investigate ...

View answer
SHA-256: (Probabilistic?) partial preimage possible?
Accepted answer
19 votes

The Bitcoin mining algorithm can not be simplified by exploiting any weakness in the SHA-2 hashing algorithm with the current state of the art. The problem is manyfold. From the SHA-256 point of view,...

View answer
Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
Accepted answer
17 votes

The most efficient related-key attacks on AES-256 and resulting weaknesses AES-256-based hash functions are summarized in my PhD thesis. Though collision and preimage attacks on hash functions are out ...

View answer
Is TripleDES 168bit vulnerable to Differential Cryptanalysis?
Accepted answer
14 votes

This claim is bogus. DES itself has a 13-round differential with probability around $2^{-47}$, so TripleDES with its 48 rounds is resistant to any sort of differential attack. The paper authors are ...

View answer
Can I use HMAC-SHA1 in counter mode to make a stream cipher?
Accepted answer
12 votes

Yes, this would be secure. CTR (Counter) mode based on keyed function $F_K$ is secure as long as its output $$ W_i = F_K(i) $$ is unpredictable given previous outputs $$ F_K(1),F_K(2),\ldots,F_K(i-1). ...

View answer
Does having a known plaintext prefix weaken AES256?
Accepted answer
11 votes

AES-256 has sustained 15 years of cryptanalysis, and it can be stated that no knowledge of some plaintext bytes would help to reveal the other bytes no matter what mode of operation (CBC, CTR, etc.) ...

View answer
Has threefish successfully been attacked (practically or theoretically)?
11 votes

Pure Threefish has received less attention than Skein. Shortly speaking, it has a large security margin, and can be safely used for encryption. In more details, Threefish has been tweaked twice. The ...

View answer
Why are the initial states of hashes functions (like SHA-1) often non-zero?
Accepted answer
11 votes

In early years of hash function design it was unclear how to choose constants (not only initial vectors), and it was widely assumed that the more random they look, the more secure the function is. ...

View answer
AES-CTR mode and the Biclique Attack
Accepted answer
10 votes

I do not remember if we checked this explicitly, but my guess is that in the chosen-plaintext setting the biclique attack would still be faster than the exhaustive search, maybe by the factor of 2 ...

View answer
How can a Vigenère cipher be broken if the message is short?
Accepted answer
9 votes

If the message is shorter than the key, then the Vigenere cipher is essentially the one-time pad, which is unbreakable for a random key. If the key is not random, then you may get some information on ...

View answer
Math to replace s-boxes - Good or bad idea?
9 votes

The S-boxes in quite many encryption algorithms (for example, in AES) have been already built with math (the AES S-box is an inversion function in $GF(256)$ plus an affine transformation). The lookup ...

View answer
Problems with using AES Key as IV in CBC-Mode
Accepted answer
9 votes

CBC mode encrypts as follows: $$ C_0 = E_K(IV\oplus P_0);\\ C_i = E_K(C_{i-1}\oplus P_i), $$ where $P_i$ are plaintext blocks and $C_i$ are ciphertext blocks. Traditionally, IV must be random and is ...

View answer
In what way is XXTEA really vulnerable?
9 votes

The XXTEA cipher is badly broken. Even though the paper is not published at a conference, the author verified it on reduced versions of XXTEA. You should never ever use a cipher or a hash function, ...

View answer
DES — Can I recover the key when I have both ciphertext and the plaintext?
Accepted answer
9 votes

Efficiently - no. However, the best attack on DES - linear cryptanalysis - works with known plaintexts, and theoretically may work slightly faster than the brute force even for small amounts of data. ...

View answer
Formal definition of "explicit" algorithm?
9 votes

What Dan Boneh says is not a formal definition as you want it. Let me quote Rogaway on this: In cryptographic practice, a collision-resistant hash-function (also called a collision-free or ...

View answer
Why has the sponge construction's generic collision finding attack a complexity of O(min(2^(-n/2) , 2^(-c/2)))?
Accepted answer
8 votes

Denote the internal sponge state by $$ S = R\mathbin\|C, $$ where $C$ has size $c$ — capacity. Every iteration a message block of length $|R|$ is xored into $R$ and then the permutation $P$ is ...

View answer
Simple proof of work example?
Accepted answer
8 votes

Bitcoin ASIC miners are specialized hardware, which is capable of computing SHA-256 only. If you change almost any parameter in the Bitcoin proof-of-work, the existing miners will be useless. For ...

View answer
CBC-MAC based on PRF
7 votes

The CBC-MAC construction indeed can use a PRF instead of PRP. It is now based on PRP due to historical reasons: the blockciphers used for CBC-MAC were based on permutations. From the security point ...

View answer
a doubt in Rijndael's key expansion sizes
Accepted answer
7 votes

AES-128 takes a 128-bit key, produces 11 128-bit subkeys out of it with a cryptographically weak function, and uses them in 10 internal rounds. It can be said that the full key is reused 10 times. ...

View answer
Applying differential cryptanalysis to ciphers with addition mod $2^{32}$
Accepted answer
7 votes

This is called an Even-Mansour cipher. Actually, for the differential cryptanalysis it does not matter what sort of difference you use, you only need that it propagates deterministically through ...

View answer
Are there any practical examples of breaking a system using linear attacks?
7 votes

The most well known example of a cipher practically broken with linear attacks is by no doubt DES, a cipher with 56-bit key and 64-bit block. Equipped with a cluster of PCs in the year 1994, Mitsuru ...

View answer
Why to try get key out of white box crypto? How can one protect WBC itself?
7 votes

The initial motivation was as follows. If you do not know the key, you are bind to a particular implementation even if you can invert the encryption. The implementation might have some sort of ...

View answer
rotational cryptanalysis on modulo multiplication?
Accepted answer
6 votes

The rotational cryptanalysis considers applying the transformation $E$ to both $X$ and $\overrightarrow{X}$, where $$ \overrightarrow{(x_1, x_2,x_3,\ldots, x_n)} = (x_{r+1},x_{r+2},\ldots, x_n, x_1,\...

View answer
Are there valid attacks on full SHA-1?
6 votes

The cost of finding collision for SHA-1 is currently estimated as $2^{61}$ SHA-1 calls. To understand how much (or how little) it is, we could look at Bitcoin mining. Right now (September 2014) the ...

View answer
Simple proof that shows AES is not a uniform permutation on any n-bit string?
Accepted answer
6 votes

There is no uniform permutation; there is a permutation uniformly chosen from the set of all possible permutations over $Z_2^{128}$. It is evident that AES is not a uniformly chosen permutation, ...

View answer
Two-dimensional S-Box
Accepted answer
6 votes

I understand the question as you have a single 4-bit S-box, which you first apply rowwise, and then columnwise. As already mentioned, this is equivalent to a large S-box $\mathcal{S}$ $$ c = \...

View answer
Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
6 votes

It is not entirely clear what you want, but suppose you need a trapdoor permutation - the function that is easy to invert only if you know a secret parameter - and which is not based on number-...

View answer
Security proofs for CBC mode
Accepted answer
6 votes

The classic proof is contained in http://www.cs.ucdavis.edu/~rogaway/papers/sym-enc.pdf (1997), but it is not quite easy.

View answer
Can you explain what the AES paper means by "sharing active S-boxes"?
6 votes

We talk about cryptanalytic tools here. A differential trail describes how a certain difference evolutes throughout the cipher, which helps to find out a key in a standard differential cryptanalysis. ...

View answer