Cryptanalysis is the part of cryptology dedicated to the mathematical analysis of the weaknesses of cryptographic algorithms, the goal being to defeat some of the security properties that the algorithm should fulfill, e.g. decrypting data which has been symmetrically encrypted with substantially ...

learn more… | top users | synonyms

4
votes
1answer
56 views

Soundness of GRC.com Haystack padding concept [duplicate]

I was wondering how sound is the concept presented by the Gibson Research Corporation (see below if you do not want to follow the link) about simple passwords (= very easy to remember) with the ...
7
votes
1answer
471 views

Is there a method to get plain-text from cipher-text in HMAC SHA-1, given that the key is known?

This is technically not even an attack. We have all the resources at hand, except for the original plain-text. We have the cipher-text (to be converted back to plain-text), as well as the key. The ...
-1
votes
1answer
43 views

Calculating the breakability of a given encryption method

I will soon be doing a very important project for school. The main goal of my project is to find a mathematical way to calculate the breakability of a given encryption method of ciphertext. Is there ...
1
vote
1answer
67 views

How to cryptoanalyze a one time pad that uses a plain text document as the pad?

I have read that in order for a one time pad to be truly secure, the pad itself must be random data. Given the practical difficulty of sharing a secure random pad, I was wondering what would be the ...
0
votes
1answer
30 views

Key Extraction via electrical signal processing

Looking for a link to what I believe was recent research that was similar to "RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis" - but instead of being based on acoustic emanations, the ...
-2
votes
2answers
135 views

Crack Unknown Encryption [closed]

I was challenged by a friend to decrypt a piece of text that was somehow encrypted. The encrypted text is the following: ...
1
vote
1answer
80 views

What keeps the private key safe if an attacker has both clear and encrypted copies of a message and the public key?

Let's say someone obtained a message in both clear text and in its encrypted copy with asymmetric cryptography, like RSA-2048. He also has the public keys. Is the private key still undiscoverable? ...
1
vote
2answers
116 views

Cryptanalysis of encrypted data at rest

Imagine I have a file encrypted using AES CBC mode with a key and a random IV. The attacker access to the encrypted text and the IV used but not the key. In this scenario there is no vulnerability ...
1
vote
1answer
60 views

Knowing Input&Output, How to determine encode method and the passkey that was used in encoding?

I've looked on this site and on SE. but I couldn't get a handle on this. Is there a way to find what type of encoding (and/or encode key) is being used? For example, I am testing a web ...
2
votes
1answer
155 views

Klein and PTW wep attack

I'm working on an implementation of Klein's wep attack. For that, I've set up a router with wep encryption and collected 50,000 unique IVs from it. I tried only calculating K[0], meaning - the first ...
3
votes
1answer
348 views

Cracking DES(Unix)/MD5 ARP

This is a basic exemple of Unix Pass Encryption. I have little Hash of MD5 ARP : user50:$apr1$w7YNTrjQ$0/71H7ze5o9/jCnKLt0mj0 user60:$apr1$AIw2h09/$Ti0TRlU9mDpCGm5zg.ZDP. I need to find the pass ...
0
votes
1answer
54 views

Frequency Analysis [closed]

I have started looking into Crytography, and the obvious starting point is frequency analysis. As a task for myself I thought it would be good to compile a script which could be used for perform the ...
0
votes
2answers
155 views

Does Known plaintext attacks lead to exposure of the key?

The back-story is long and boring so I will get down to the meat of the argument. I say that if a professional code breaker has a bunch of data, the encoded version of said data and the encoding ...
0
votes
2answers
425 views

Google's usage of RC4

I was reading about Google's usage of RC4 and an answer on stackexchange website stated the following: I know Google uses RC4 for most of its services, and this is the reason one shouldn't keep ...
45
votes
3answers
4k views

What kinds of encryption are _not_ breakable via Quantum Computers?

There's the recent article NSA seeks to build quantum computer that could crack most types of encryption. Now I'm not surprised by the NSA trying anything1, but what slightly baffles me is the word ...
-3
votes
2answers
101 views

Facing hard encryption [closed]

I have a little problem with encryption. I have this cipher text "AA969CF9657F77C597C8EAFF1594D59374E4977F" and i know that correspond to "http://jogos.meo.pt/". I have another samples, but i can´t ...
0
votes
2answers
282 views

cold boot attacks

To quote the wikipedia article on Cold Boot Attacks: In cryptography, a cold boot attack (or to a lesser extent, a platform reset attack) is a type of side channel attack in which an attacker with ...
8
votes
4answers
797 views

At what point does adding more iterations to PBKDF2 provide no extra security?

If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an ...
1
vote
2answers
247 views

What is (“ASCII” redundancy) which is said to be required to retrieve the original plain text in 2 times pad?

Sorry for the long title :$ In a video speaking about attacks on the one time pad which uses psudorandom generators (PRG), It's said that Eve can retrieve the plain text of 2 messages that have been ...
0
votes
1answer
134 views

Timing analysis attack and cryptosystem

Why is a “Timing Analysis Attack” a problem for a cryptosystem? I've been trying to learn security, and have a question about timing analysis attack.
12
votes
2answers
628 views

Correct way to get a number from 0-9 from a random byte?

If I have a good random number generator that gives me a byte of data at a time, and I want to extract a random decimal digit of 0 to 9 from that byte stream, what is the correct way to do that? At ...
1
vote
1answer
159 views

The basics of cryptanalysis [closed]

There are a lot of books on encryption. Is there a must read intro, something like Smashing the Stack for Fun and for profit, that more or less everyone reads?
-1
votes
1answer
140 views

Who can view my https browsing habbits? [closed]

I was wondering about HTTPS security and how easily is compromised. I have already read the similar threads in here, but I have some more questions: Let's say I am searching something at Google. ...
5
votes
1answer
413 views

Known plaintext; What cipher is being used here? [closed]

plaintext: CANDY VERY CRANBERRY ciphertext: TXOtWjYhVk 8&O$4AmSA plaintext: http ciphertext: cZf. plaintext: http ciphertext: r5Hz This is definitely somehow decodable from ...
-3
votes
2answers
420 views

how to identify plain text from cipher [closed]

I am trying to find what encryption algorithm has been used in this code original text: 11011698 encrypted text/cipher: uIC4hZFECIAYMi%20FWxamjQ== original text:11008569 encrypted text/cipher: ...
4
votes
2answers
549 views

How can i calculate the number of possible passwords?

I have found a flaw in a site where the password reset feature resets passwords in the following format UpperCaseLetter-Number-LowerCaseLetter-Number-LowerCaseLetter-Number-UpperCaseLetter ...
6
votes
7answers
651 views

How easy is it to find a password in a huge text file?

Say that my password is PASSWORD1 I have a 10MB jumbled text file. I hide my password in two parts in the text, between > and < so I can find it myself. Then I put the 2 parts together and add the ...
74
votes
8answers
8k views

How would one crack a weak but unknown encryption protocol?

I was reading this interesting question: Is my developer's home-brew password security right or wrong, and why? It shows a weak home-brew algorithm developed by "Dave", and the answers discuss ...
2
votes
1answer
240 views

Legality and ethics of cryptanalysis on password hashes

I'm working on my dissertation concerning cryptanalysis on password hashes. I'd like to delve into the legal and ethical aspects of cryptanalysis, however, seeing as I'n not at all well versed in law ...
3
votes
2answers
246 views

Remedy for not having filled the disk with random data?

Filling a large HDD with /dev/urandom prior to encryption can be extremely slow (even with netcat, multiple instances in parallel, etc) and for this reason I'm sure a lot of users skip this advice ...
3
votes
2answers
274 views

is it easier to get the original password if you have multiple hashes of it?

Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
3
votes
0answers
281 views

Can an attacker guess my password length from a hash? [duplicate]

Possible Duplicate: Possible to detect password length from hash? Is doubling your password adds more security? Considering I do not provide him any personal information relating to it, are ...
0
votes
2answers
1k views

Tool for generating MD4 collisions

There are a lot of research papers available online that discuss vulnerabilities of MD4 algorithm, but I couldn't find any implementation of these. Uptill now I have used tools like John the Ripper ...
2
votes
2answers
886 views

How to test security of an encryption algorithm?

What are the standards methods to test the quality of an encryption algorithms. Secondly if i am trying to implement an encryption algorithm then what practices should i adopt?
2
votes
2answers
697 views

Determine encoding/hashing methods used based on knowing the input and output only?

If I know the initial value of a string and the resulting hash but have no access to the system that produces the output, how can I determine what has actually occurred so I can reproduce the hashing ...
6
votes
1answer
385 views

Identifying, analyzing, and predicting weak session cookies

To elaborate on this, I'm looking at this from the perspective of a hacker/penetration tester. Many times I have seen web applications that I know have weak cookies. I can tell this because I can ...
1
vote
2answers
93 views

Encryption app stroring the password

The encryption app that we are using seems to generate the same output for the same input. That is bad right? I'm not smart enough to understand the scheme being used though. The header of each ...
0
votes
1answer
268 views

How key_derivation and key_verification functions are implemented of a 7-zip archive's encryption mechanism?

I am curious about how password recovery works for password protected files. And I want to know the exact flow of the 7-zip encryption mechanism :) !! 7-zip uses the AES-256 encryption algorithm in ...
1
vote
1answer
262 views

Can I combine two of SHA-3 candidates cryptography hash functions and obtain more secure Algorithm? [duplicate]

Possible Duplicate: Are different hash algorithms ever used together? For example, Is possible to combine (Concatenate or Chain or XOR) Skein SHA-3 candidate with Grostl SHA-3 candidate to ...
9
votes
2answers
2k views

Estimating the size of a rainbow table

What are rainbow tables and how are they used? Gives a very precise answer about what rainbow tables are and how they are used. I had always confused hash-tables and rainbow tables. My question is ...
0
votes
1answer
277 views

any small idea to decode this algortihm from php script [closed]

So I think the algorithm is based on the php function ENCODING_decode defined in includes/encoding.php (which i don't have) . The encoded result $xId_campaign_encoded from the php script has ...
1
vote
1answer
184 views

Stripping / appending characters from user password before hashing to conceal it forever?

I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is secret123, the system will strip it down to ...
3
votes
2answers
625 views

Can key files be brute-forced like passwords?

Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
8
votes
6answers
886 views

Does repeating one word to form a password result in a similar pattern in its encrypted format?

If i use a single word to form a password by repeating it like the examples below: securesecuresecuresecuresecuresecure SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe ...
3
votes
2answers
1k views

How does a brute force attack actually determine it has succeeded? [duplicate]

Possible Duplicate: If someone breaks encryption, how do they know they're successful? First off, this is not about cracking hashed passwords. I know that a brute-force or dictionary ...
5
votes
2answers
700 views

Zero padding in HMAC

Section 2 of RFC 2104 defines the key used in HMAC should be padded with zero bytes up to the block length of the underlying hash algorithm. Isn't this a potential security vulnerability since any key ...
3
votes
1answer
163 views

Does knowing encrypted information make it easier to find an unknown key?

I'm curious if knowing the exact content of an encrypted message or several messages makes it theoretically any easier to discover the encryption key. Does this speed up a brute force attack in any ...
0
votes
3answers
454 views

Best protection against a “chosen-ciphertext” attack?

What is the best protection against a "chosen-ciphertext" attack when transmitting (=streaming) secured (=crypted) data via networks using the TCP protocol?
4
votes
2answers
5k views

Is it possible to decrypt a SSL/TLS session without doing a MITM-attack?

I'm not talking about decrypting the connection while the SSL/TLS is happening (MITM) but after the connection is closed and I have a pcap file of the entire negotiation/data transfer process. How ...
1
vote
2answers
930 views

How effective have statistical methods been at breaking encryption?

If we look at how statistical engines run on-line translators, and how they are built, we see that they look at a new language and run a statistical model over it searching for what's probably the ...