I know simple formulas like  $$E(x) = (ax+b)\pmod n$$  where $E(x)$ stands for encryption,  $$D(y)= z(y-b)\pmod n$$  where $D(y)$ stands for decryption,  and   $$ax==1\pmod n$$  Assuming someone gives us an encrypted string, is there a way to find $a$ and $b$ from that string? If not, what informations we should have to find $a$ and $b$ keywords from the encrypted string? Is there a way to find a and b keywords in an affine cipher when only ciphertext but no plaintext is known?    Note that this is not a duplicate of . In that other question, the user knows beginning of both encrypted and decrypted message.
120907
Suppose I have a ciphertext that I know is encrypted using an affine cipher in $\mathbb{Z}_{26}$. The plaintext begins with es and the corresponding ciphertext is FX. How can I calculate the key?
96285
Can anyone show some hints to this? If $\gcd(a,b)=1$, then $a^{\phi(b)}+b^{\phi(a)}=1 \pmod{ab}$. I know that $a^{\phi(b)}=1 \pmod{b}$, and similarly, $b^{\phi(a)}=1 \pmod{a}$, but then how do I combine the work so that I get the result I need? Thanks!
104204
If we encrypt a message twice with symmetric key $k_1$ first and then $k_2$ like $E_{k2}\{E_{k1}\{m\}\}$ , ideally we should decrypt with $k_2$ first and then $k_1$ but is it possible to decrypt with $k_1$ and then with $k_2$ ?  Using any of the AES Modes preferably ?
90748
Let's imagine a cipher that works like the following:   Plaintext is encoded to Base64. The characters in the encoded plaintext are substituted with a randomly shuffled character set(A-z, 0-9, -, _, =).  The shuffled alphabet is, in essence, the key.   Not particularly complex or even secure.  But...  What if I wanted to do frequency analysis?  For example, "RUNFORYOURLIFE" when encoded in Base64 is:  UlVORk9SWU9VUkxJRkU=  When the character set is shuffled, the final cryptext can look something like this:  xv24DYG9qxG2xYg6DYxf  The key being:   yhAc5bTOWeYvBXCpVuoMJLdg8P1jHN3ZIsi67SrK4E_D9-x2qRQmnlkwUaFt0G=zf  Which is a shuffled version of:  abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_=  Let's also assume that the character set in subsequent messages is in the same order(ie the key is re-used).  Since the bytes are basically split up resulting in different character units that may or may not correspond, is frequency analysis still feasible?  Does encoding plaintext this way before encryption add any form of security?  My question mostly pertains to longer messages, as my example may be too short for any sort of real analysis.
115222
For example $151x - 294\equiv 44\pmod 7 $. How would I go about solving that?  The answer says to simplify it into the $ax\equiv b\pmod c $ form first, but I have no clue on how to get rid of the $294$... help?
110846
While developing some code that uses the .NET AesManaged algorithm, I made some mistakes but was surprised at the results.  My encryption was correct.  I was generating a random IV block and writing it to the file (without encrypting the IV).  Then I was encrypting the plaintext and writing it.  The decryption was wrong though... instead of reading the first block from the file an using it as an IV, it was just using a random IV and decrypting everything.  The first block came out gibberish but the 2nd (and subsequent) ones were decrypted properly!  Why would this be?  And even weirder... when I tried to fix it by encrypting the IV in the encryption code (instead of writing the IV unchanged) the decryption result was the same!  (gibberish then correctly decrypted blocks).  Although I eventually fixed my code, how do these results make sense?
8584
Given a string:  $AABBC=A^2B^2C^1$   I am trying to find the Total Permutations (this may be incorrect):  $\dfrac{5!}{2!\cdot2!}=30$  My question is how would I find the partial sums (perhaps the wrong choice in words) when added together would give an index such that:   $AABBC=1$ $ABABC=2$ $CBABA=29$ $CBBAA=30$   (30 might be the wrong number here but is suppose to be the last)   I have tried to draw out a tree structure to get an idea and thought with as the minimum:  $CAABB$  $4(\dfrac{4!}{2!\cdot2!})$ + 1  And:  $CABAB$  I would get something like:  $4(\dfrac{4!}{2!\cdot2!}) + 0 + 1(\dfrac{2!}{2!}) + 0 + 0$  But I am missing something here. How would I find the sums needed for $BACAB$ ?  More specifically I am trying to find the index of a word that is arbitrarily long in alphanumeric.  So the string may also be something like:  $AAAAABBBBDDEEFFFGGGGGHIIIIJJJJKLMOOOPZZZZZ$
82522
Suppose there is a message that is encrypted with AES-128-CBC.  The message is as follows, new lines are used to delimit the 16 byte boundary for each block:  Wire funds from: Alice to Bob in   the amount of $ 1   Because this message is encrypted using CBC mode,  any modification of the first block of cipher text would propagate throughout the message.   However, the amount of the fund transfer falls in the last block.  I am under the assumption that an attacker can use the property of  to alter the last block and produce a valid amount that is greater than \$1 in far fewer than $2^{128}$ operations.   Is this a correct assumption?  Is there a name for this attack or do you know of a real world example?    My instinct is that if you just need one byte of the 16 byte block to be of a specific value then it would only require $2^8$ operations because the other 120 bits of the plain text could be any value. For example lets say we wanted the last block of cipher text to decrypt to 9\0 (where \0 denotes a single null byte, and the message would be interpreted as \$9), then it would take only $2^{16}$ operations to find this cipher text block.  Is there something I am missing?
106888
A block cipher is a bijective map from the set of possible plaintexts to the set of ciphertexts, which are the same size and might as well be considered the same thing: $\theta: S\to S$. In this there must exist a fixed point m $\in S$ such that $\theta(m) = m$ (alternatively you could consider encryption to be a binary operator acting on the set $S$ then you could write encryption under key $k$ as $m \odot k = m$, with $m,k \in S$. Unfortunately this cannot form a group since there is no unit $e$ that makes $e \odot k = e$ for all $k \in S$).  It is clear that when the block size is equal to the key size a single fixed point will exist when you hold the plaintext message constant and permute the key. The key allows you to select one of all the possible possible unique mappings, of which one must surely be a fixed point (am I right about my use of the word unique here?).  What I don't understand is how a key that is longer than a block size provides any extra security. From what I understand this would suggest the existence of many fixed points, or equivalently many different keys that will decrypt a ciphertext.  Note: I would also be interested to see articles that apply algebra to the study of block ciphers. Specifically constructing groups to aid analysis that also consider the fact that a block cipher is a composition of several round functions.
59726
I have read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are – for example – vulnerable to differential cryptanalysis.  I have a general idea that the application of differential cryptanalysis is to look at the difference between inputs;  makes that fairly clear. However, I could take any two inputs for any given block cipher and I am pretty certain I'd be staring at random differences.    I am aware this is the idea of a well written block cipher; however, assuming a broken or vulnerable cipher (feel free to provide simple examples) how do I go about choosing differences to try?  Are there any clues in algorithm design that would inform a decision on which values to choose?  How does being vulnerable to differential cryptanalysis impact a cipher in the wild?  If all I have are differences between known plain-texts and known keys as my analysis and a captured ciphertext as my data to exploit, what can I actually deduce?
3478
Isn't finding the inverse of $a$, that is, $a'$ in $aa'\equiv1\pmod{m}$ equivalent to solving the diophantine equation $aa'-mb=1$, where the unknowns are $a'$ and $b$? I have seem some answers on this site (where the extended Euclidean Algorithm is mentioned mainly) as well as looked up some books but there is no mention of this. Am I going wrong somewhere or is this a correct method of finding modular inverses? Also can't we find the Bézout's coefficients by solving the corresponding diophantine equation instead of using the extended Euclidean Algorithm?
117173
I want to implement AES algorithm,instead of LUT based S-box, but I’m stuck at point creating "Inverse of equation" during implementation.  In creation of S-box I am using the following steps:    ($a_7a_6a_5a_4a_3a_2a_1a_0$) bits converting in to field equation. Calculating the inverse of the field equation modulo($x^8 + x^4 + x^3 + x + 1$). Doing the affine transformation. Return the 8 bits.          In these steps I did not find a way to calculate inverse of the field equation.  Can anyone help me in calculating inverse of equation in Galios field mod($x^8 + x^4 + x^3 + x + 1$)?
44698
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse of $d \bmod \varphi(n)$).  Given a plaintext message $m$, we obtain the ciphertext $c = m^e \bmod n$; we subsequently decrypt the ciphertext by calculating $c^d \bmod n$.  Suppose I'm trying to implement RSA on a device with low computational power, and these exponentiations take too long.  I decide to make my implementation run faster by choosing small values for $e$ and $d$ (e.g. in the tens or hundreds).    Are there efficient attacks against such an implementation?
92411
If I have an encoding function  $f(x)$ that maps a message $m$ to a point $P$ on a suitable Elliptic Curve $E$ . If I have the public key $Q$ of my recepient then I can encrypt the message as follows:  Choosing a random number $k &lt; n -1 $ where $n$ is the order of the curve E .  Calculating $C = [k] G $ where $G$ is the generator point of the curve E   Calculating $R = [k]Q $ where $Q$ is the recipient's public key   Now the message is encrypted by adding $P$ to $R$ to get          $C_e$ $( = R + P)$ which is sent along with $C$ to the recepient.  DECRYPTION:  Now for the recepient to decrypt my message they compute $R = [privatekey] C $ (where $C = [k]G $) and simply subtract $R$ from $C_e$ to get the encoded point $P$ back which is then decoded by an inverse function $f^{-1}(x)$ to recover $m$.  Now , two problems arise : If the attacker knows the plaintext (suppose if I follow a particular format of data while sending messages ) he could encode his guessed plaintext and subtract it from $C_e$ to recover $ R $ back ! . If I used that same $ R  $ to encrypt further "blocks" of my message then the security of the later parts of my message has been breached!   I realize that doing  something like a scalar multiplication over and over again for every block of data, would be a huge drawback in efficiency and speed.   Is there any way to compute a different $ R $ for every block of data, without using much resources and that too quickly ?   Does reusing the same $R$ for another message break security ?  NOTE: This question is for educational purposes only. It's for the sake of expanding my knowledge on Crypto.
96085
Regarding the cryptosystem known as the Hill Cipher,  has an exercise asking you to find the number of involutory keys for $m=2$ over $\mathbb Z_{26}$. This means that we are to find the number of $2\times 2$ matrices over $\mathbb Z_{26}$ that satisfies $K=K^{-1}$. This can be considered a basic mathematical problem regardless of the details of the Hill Cipher cryptosystem.    I have found the number to be $736$ by applying the easily proven result $$ K=K^{-1}\implies\det(K)=\pm1\pmod{26} $$ stated in the previous exercise, and the general formula $$ \begin{pmatrix} a&amp;b\\c&amp;d \end{pmatrix}^{-1} =\det(K)^{-1} \begin{pmatrix} d&amp;-b\\-c&amp;a \end{pmatrix} $$ stated elsewhere in the textbook and hinted at in the exercise in question.    But here is my problem:     This approach seemed far from general, dividing into cases and subcases regarding whether $\det(K)=1$ or $\det(K)=-1$ and regarding the profiles of $a,b,c$ modulo $2,13$ respectively (Chineese Remainder Theorem [CRT]). This lead to conclusions equivalent to saying that for $\det(K)=-1$ the equation $K=K^{-1}$ has $4$ solutions over $\mathbb Z_2$ and $182$ solutions over $\mathbb Z_{13}$. By [CRT] this provides $4\cdot182=728$ solutions over $\mathbb Z_{26}$ for the subcase $\det(K)=-1$. The case $\det(K)=1$ provided $8$ matrices in my analysis.   So my question is:     Is there a general approach for finding the number of solutions to the matrix equation $K=K^{-1}$ over a prime field $\mathbb Z_p$ for matrices of arbitrary size $m\times m$?
32266
What I am thinking was I need two formulas, AX.p(X) => something AX.p(X) => ~ something   I guess something maybe is the p(x) and the other is ~p(x) since we was given EX.~p(x)..But actually it can't work for me. And I guess maybe is EX.~p(x) and ~EX.~p(x)..But if I am doing that then the it will go to deadend..so I give up..;(  Wish someone can help me.   For note about EE: 1: EX.p(X) 2: AX.(p(X) => something) 3: something EE1,2 But something cann't have the free variable from p..in this sample, then soemthing cannot including X..so if something is p(X) it cannot use EE, but if p(Y) then can use EE.
55566
I'm trying to understand how the AES S-Boxes are calculated. I understand how the multiplicative inverse is calculated over $GF(2^8)$, but I'm confused by the description of the affine transformation. I haven't been able to Google a good explanation of how the S-Box values are calculated. Can someone explain how this works, starting after the calculation of the multiplicative inverse?