概率积分密码分析

在传统的积分密码分析中,积分区分器都是以概率1成立的.虽然Knudsen等学者提到过:“就像差分一样,积分也可以是概率的”,但是,没有文献报道过进一步的研究.文中对此问题进行了探讨,提出了概率积分密码分析方法,并从理论和实验两方面验证了概率积分分析方法的有效性.对于采用S盒设计的分组密码,文中证明了如果S盒的差分均匀性越接近随机概率,则分组密码抵抗概率积分密码分析的能力就越强.同时,文中指出高阶积分分析的某些技巧对于概率积分分析是行不通的,主要原因是随着求和变量个数的增加,积分特征概率趋近于随机概率.最后,文中通过对AES和LBlock这两个算法的概率积分分析实例,说明目前广泛使用的分组密码算法对于概率积分密码分析方法都是免疫的.     

针对流密码K2算法的猜测决定攻击

针对K2算法进行猜测决定攻击,指出猜测9个状态的攻击结果不正确,并给出一组猜测10个状态的攻击结果。修正无LFSR-A的简化K2算法的猜测决定攻击结果,使计算复杂度由O(2192)降低至O(2160)。分析结果表明,在K2算法中,利用LFSR-A引入动态反馈多项式控制机制可以提高算法的抵抗猜测决定攻击能力。     

演化密码对抗多重线性密码分析能力的研究

演化密码是我国学者提出的一种新型密码.文中对演化密码对抗多重线性密码分析的能力进行研究,研究表明演化密码对抗多重线性攻击方面的能力高于普通固定算法密码.文中介绍了基于对数似然比(LLR)统计方法的两种多重线性密码分析方法,这两种方法利用多个线性逼近式分别扩展了Matsui最初提出的线性攻击算法1和算法2.在考察这两种算法的数据复杂度N、比特优势a,以及预期成功率PS三者关系的基础上,证明了在比特优势和预期成功率相同的条件下,攻击演化密码的数据复杂度大于攻击固定算法密码的数据复杂度,并论述了在数据复杂度N相同的情况下,攻击演化密码的时间复杂度和空间复杂度都明显高于攻击固定算法密码的情形.这表明演化密码在对抗多重线性攻击方面的安全性高于固定算法密码.     

MAGENTA的差分密码分析

对１５个ＡＥ候选算法之一的ＭＡＧＥＮＴＡ算法进行了差分密码分析,利用的是ＭＡＧＥＮＴＡ算法的结构缺陷,结果显示：利用算法１和算法２攻击ＭＡＧＥＮＴ算法,所需的选择明密文对分别为２＾７０和２＾６４。     

AC分组密码的差分和线性密码分析

讨论AC分组密码对差分和线性密码分析的安全性,通过估计3轮AC的差分活动盒子的个数下界和12轮AC的线性活动盒子的个数下界,本文得到AC的12轮差分特征概率不大于2-128和线性逼近优势不大于2-67.因此,AC分组密码对差分和线性密码分析是安全的.     

Q的线性密码分析

对NESSIE公布的17个分组密码之一的Q进行了线性密码分析，攻击所需的数据复杂不大于2^118(相应的成功率为0．785），空间复杂度不大于2^33 2^19 2^18 2^12 2^11 2^10。此结果显示Q对线性密码分析是不免疫的。     

多重线性密码分析中线性逼近方程的构造

到目前为止,还没有利用构造多个逼近方程来实现B.S.Kaliski和M.J.B.Robshaw的多重线性逼近的例子。利用Mastui构造的线性组合传递链是周期为8的线性组合传递链这个特点,选取该线性组合传递链的8个不同起点,就可由该线性组合传递链构造出8条新的线性组合传递链,再加上其对偶的线性组合传递链,共可构造出16条线性组合传递链,利用它们可实现对DES的密钥比特进行攻击。     

欧洲分组密码标准SHACAL-2算法的研究分析

由标准哈希算法SHA-2演变面来的SHACAL-2是新当选的3个欧洲分组密码标准算法中分组长度和密钥长度最长的算法,其安全强度被认为最高。提案沿袭单向哈希函数的形式来描述算法,文章以分组密码传统的规范形式刻画SHACAL-2算法的完整加密过程,指出算法扩散特性较差的缺点,给出分组密码算法加密过程与哈希算法压缩过程的对应关系,并提供了算法的详细解密过程和相应的加解密数据,为算法实现提供参照：补充了相应的轮常数;进一步研究了长分组长度和密钥长度的必要性。指出算法加解密结构不具有相似性。最后,对欧美4个分组密码标准进行了比较分析。     

Cryptanalysis of Liaw's broadcasting Cryptosystem

In 1999, Liaw proposed a new broadcasting cryptosystem, which requires smaller bandwidth as compared to the previously proposed broadcasting cryptosystems. However, this article will show that the proposed system is insecure enough by presenting a conspiracy attack on it. We will also point out some ambiguous problems in Liaw's paper. Moreover, we propose an improved broadcasting cryptosystem, which is a slight modification of the proposed system to overcome the conspiracy attack.     

对Chen等人电子选举方案的密码学分析和修正

摘要2004年,Chen等人提出一个安全的匿名网络选举方案。指出Chen等人给出的方案是不安全的;另外,给出一个满足电子选举安全要求的修正方案。     

Cryptanalysis of an encryption scheme for binary images

In 1998, Chung and Chang proposed a new method to encrypt binary images. When compared to its predecessors, their method can actually obtain better compression ratio by putting different scan patterns at the same level in the scan tree structure and using the two-dimensional run-encoding technique. However, their scheme seems to be quite vulnerable to attacks if it uses the same key to encrypt different images. In this paper, we show that their scheme can be broken with some pairs of plain image and cipher image.     

Cryptanalysis of an EPC Class-1 Generation-2 standard compliant authentication protocol

Recently, Chen and Deng (2009) proposed an interesting new mutual authentication protocol. Their scheme is based on a cyclic redundancy code (CRC) and a pseudo-random number generator in accordance with the EPC Class-1 Generation-2 specification. The authors claimed that the proposed protocol is secure against all classical attacks against RFID systems, and that it has better security and performance than its predecessors. However, in this paper we show that the protocol fails short of its security objectives, and in fact offers the same security level than the EPC standard it tried to correct. An attacker, following our suggested approach, will be able to impersonate readers and tags. Untraceability is also not guaranteed, since it is easy to link a tag to its future broadcast responses with a very high probability. Furthermore, readers are vulnerable to denial of service attacks (DoS), by obtaining an incorrect EPC identifier after a successful authentication of the tag. Moreover, from the implementation point of view, the length of the variables is not compatible with those proposed in the standard, thus further discouraging the wide deployment of the analyzed protocol. Finally, we propose a new EPC-friendly protocol, named Azumi, which may be considered a significant step toward the security of Gen-2 compliant tags.     

MS PPTP密码分析

点到点隧道协议（PPTP）是用来保护在TCP／IP上的PPP连接安全的。分析Microsoft‘s Windows NT是如何实现PPTP的。给出如何破译MS CHAP和RC4加密协议（MPPE），如何攻击由MS实现的PPTP的控制隧道，而不需要破译PPTP。     

Cryptanalysis of an authentication scheme using truncated polynomials

An attack on a recently proposed authentication scheme of Shpilrain and Ushakov is presented. The public information allows the derivation of a system of polynomial equations for the secret key bits. Our attack uses simple elimination techniques to distill linear equations. For the proposed parameter choice, the attack often finds secret keys or alternative secret keys within minutes with moderate resources.     

COMP128算法分析中关键问题研究

COMP128算法是GSM协议采用的认证算法。该文分析了该算法攻击过程中的一个关键问题,在证明该问题为NP难题后,用贪婪算法给出了实用的较优解,这个结果比已知最好的攻击软件采用的值有所优化。     

Cryptanalysis of RSA with two decryption exponents

In this paper, we consider RSA with N=pq, where p,q are of same bit size, i.e., q<p<2q. We study the weaknesses of RSA when multiple encryption and decryption exponents are considered with same RSA modulus N. A decade back, Howgrave-Graham and Seifert (CQRE 1999) studied this problem in detail and presented the bounds on the decryption exponents for which RSA is weak. For the case of two decryption exponents, the bound was N^0.357. We have exploited a different lattice based technique to show that RSA is weak beyond this bound. Our analysis provides improved results and it shows that for two exponents, RSA is weak when the RSA decryption exponents are less than N^0.416. Moreover, we get further improvement in the bound when some of the most significant bits (MSBs) of the decryption exponents are same (but unknown).     

关于Hash函数MD5的解析

在王小云写的关于分析MD5算法文章的基础上,对MD5算法的破译进行进一步的解析.以MD5算法第八步为例,介绍了F函数的性质和差分路径的有效控制.从手工推算和程序实现两方面时MD5算法进行了解析和测试,对王的文章进行了部分修正,进一步说明了满足差分特征的条件和关键点.这对MD5和其他Hash函数的分析破译有着重要的作用.     

Cryptanalysis of simple three-party key exchange protocol

Recently, Lu and Cao published a novel protocol for password-based authenticated key exchanges (PAKE) in a three-party setting in Journal of Computers and Security, where two clients, each shares a human-memorable password with a trusted server, can construct a secure session key. They argued that their simple three-party PAKE (3-PAKE) protocol can resist against various known attacks. In this paper, we show that this protocol is vulnerable to a kind of man-in-the-middle attack that exploits an authentication flaw in their protocol and is subject to the undetectable on-line dictionary attack. We also conduct a detailed analysis on the flaws in the protocol and provide an improved protocol.