A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

learn more… | top users | synonyms

9
votes
2answers
529 views

How can I implement the elliptic curve MOV attack myself?

I understand and have implemented elliptic curve signatures in Python without the use of libraries like Sage, and would like to implement the MOV attack against certain weak types of elliptic curves. ...
7
votes
5answers
259 views

Does frequent key change weaken encryption?

Following scenario: We are using OTR for communication between Alice and Bob which means after each successfull message exchange a re-keying happens for both parties leading to new AES-keys for the ...
7
votes
1answer
1k views

Is MD5 second-preimage resistant when used only on FIXED length messages?

I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient. I have read a lot about MD5 security for this ...
6
votes
1answer
4k views

The difference between these 4 breaking Cipher techniques?

I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ...
6
votes
1answer
392 views

Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
6
votes
1answer
291 views

Difference between actual attacks and theoretical attacks on SHA cryptographic series

Could anyone tell me what the difference is between a theoretical attack (Like the one done on SHA-1) and an actual, practical attack (Like the one done on SHA-0)? Is a theoretical attack a proposed ...
6
votes
0answers
182 views

Is there any practical attack to create a printable chosen prefix MD5 collision?

I would like to create two ASCII text messages with the same MD5. Is this possible? If not, is there a similar but less strict attack that could work? Or to rephrase my last question: what are the ...
5
votes
1answer
240 views

Can iterated hashing be used to mitigate collision and preimage weaknesses?

How much security does double hashing add regarding collisions and preimages? Is it helpful to iterate a hash function even more times than two? For example, can MD5 be fixed (in practice) by ...
5
votes
1answer
95 views

Are there any long term RC4 bias based exploits?

The RC4 cipher possibly exhibits low level bias in it's long run PRNG keystream. I'm specifically excluding short term bias attacks which I'm defining as outputs < 1024 bytes. Are there any real ...
5
votes
1answer
127 views

Has a Two Key TDES encryption ever been successfully attacked?

Is there any known instance of a Two Key TDES ever being successfully attacked (in real life), when the key is used to encrypt less than $2^{20}$ words?
4
votes
2answers
85 views

Do we have anyway of knowing if avoiding self-permutation in RC4 makes it any stronger?

OK, so lots of questions get asked about RC4 but I want to make mine specific and hopefully answerable. RC4 Design as I'm sure anyone reading this knows, uses self permutation in stage 1 of the KSA. ...
4
votes
3answers
1k views

SHA-1 collisions - what about practical attacks?

I understand the theoretical problem with hash collision but when it comes to practice, I get very confused. Suppose a attacker would like to forge a certificate (or any kind of structured piece of ...
4
votes
1answer
579 views

Is there a generic attack on encrypted CRC32 when used as a MAC?

I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break. The ...
4
votes
1answer
92 views

How does the Flickr length extension attack work?

I am currently reading about the length extension attack on Flickr (pdf) but not understanding what's going on there. ...
4
votes
1answer
241 views

AES as Integer Program

I read that AES can be broken by solving a Linear Integer Program (IP). From a given encrypted text, how can one construct this IP? How big is the system?
4
votes
0answers
129 views

Statistical saturation attack on block ciphers

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack against the Block Cipher ...
4
votes
0answers
102 views

What informal indicators exist for estimating the computational infeasibility of cryptographic problems?

When assuming a block cipher primitive is secure, or a number theoretic problem is hard, this assumption is usually based on how far we are from breaking the primitive or solving the problem using ...
3
votes
2answers
204 views

What, cryptographically speaking, is a “long message”?

I have read about long message attacks on some cryptographic hash functions. However, I don't quite understand what is being referred to as a "long message". Also, do long message attacks only apply ...
3
votes
1answer
137 views

RSA private key finding method

Bob uses RSA with $p=83$ and $q=103$. His public key is $e=445$. Alice claims that she can calculate Bob's private key without using the definition $d=e^{−1}\bmod φ(n)$? But how?
3
votes
3answers
29 views

What are possible caveats when generating a group for use as parameters for Diffie-Hellman key exchange?

As reusing a widely used group for Diffie-Hellman key exchanges might lead to far easier third-party key discovery through precomputation for that specific group, I would like to know what can ...
3
votes
2answers
339 views

What are the implications of a birthday attack on a HMAC?

After collecting approximately $2^{n/2}$ message-tag pairs a collision can be observed. So two different messages (m1 and m2) will have the same tag. This paper states: Then, for any string x, ...
3
votes
1answer
63 views

Fixed-points in block ciphers; why don't they indicate a vulnerability?

I've seen a few questions here on fixed-points in ciphers, most asking about the possibility and existence. Most of the answers however pointed out that fixed points are not exactly a security threat. ...
3
votes
1answer
911 views

SHA-256 Partial Collision of initial 36 bits and more

I was lucky enough to, by brute force, have found two different messages, whose SHA-256 hashes collide in the first 9 hexadecimal characters, which are 36 bits, ...
3
votes
2answers
101 views

Best attack on double DES followed by XOR with third key

What is the best attack here? $E_k(m)=DES_{k1}(DES_{k2}(m)) \oplus k3$
3
votes
1answer
89 views

Practical attack on an impractical implementation of Rijndael (AES?)

My understanding of the cryptanalysis of AES, is based on what I've read on Wikipedia and my intuition, I have nothing but self-taught education on the subject. So I want you to imagine: I have only ...
3
votes
1answer
239 views

Are RSA or ECC vulnerable to an attack where the same (unknown) plaintext is encrypted with multiple public keys?

I'm not sure what this attack model is called - it's not known-plaintext and also not quite cipher-text-only. It is similar to this question except the general case (not just two keys) and using keys ...
3
votes
0answers
39 views

Cost of attack on DSA with attack on DLP

Are there any (recent) estimates of cost of attack on DSA by solving the discrete logarithm? I'm especially interested in attacks that use Pollard's rho algorithm. Are there any optimized ...
3
votes
0answers
65 views

Pollard's Rho - Restricting the random function to the exponents

Pollard's Rho is usually constructed using a function $f:G \rightarrow G$ which behaves 'random enough' in order to detect a collision with Floyd's cycle detection trick. It is easy enough to observe, ...
3
votes
2answers
136 views

Basic attacks on McEliece; finding S and P

Take a McEliece cryptosystem with public generator matrix $G' = S G P$ where $G$ is a generator of a secret code with known fast decoding (not necessarily a Goppa code over $\mathbb{F}_2$), $S$ is ...
2
votes
3answers
171 views

One Time Pads and reuse of the decrypted message?

How is it insecure when Alice encrypts a message with a One-Time-Pad to Bob, and Bob then uses the decrypted message from Alice as the next One-Time-Pad? For example: Alice sends Bob a message ...
2
votes
3answers
125 views

How much processing power should you assume an attacker has?

The answer to this question says that you should assume an attacker can do one billion operations per second: Key Size for Symmetric Homomorphic Encryption Over the Integers Is that a single attacker ...
2
votes
2answers
64 views

How badly does disclosing an M-bit prefix of an N-bit private key compromise security?

I apologize profusely for knowing nothing about cryptography, please go easy on me! I'm working on a project where I have a 2048-bit RSA private key and a public certificate generated from the ...
2
votes
1answer
381 views

The Boneh-DeMillo-Lipton fault attack (RSA CRT)

I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature. Suppose that we sign a message $m$ with RSA-CRT : $d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$ $s_p = ...
2
votes
1answer
87 views

Is there really any way to nullify or avoid MITM attacks?

The question pretty much sums it up. Is there any way to make an attacker who is successfully performing an MITM attack to actually not be able to read or change the messages? Assuming there is no ...
2
votes
1answer
319 views

How multiplicative property of RSA can be exploited

It is known that RSA has the multiplicative property $E(m_1) \cdot E(m_2) = E(m_1 \cdot m_2)$ because $m_1^e \cdot m_2^e = (m_1 \cdot m_2)^e \pmod n$ But how can this property be used to break ...
2
votes
1answer
111 views

What aspect of elliptic curve encryption paradigms makes them especially susceptible to quantum based attack algorithms?

This was a statement made during a talk at today's DFN-CERT conference but unfortunately it wasn't explained further. Can anyone shed light on why elliptic curves are susceptible to quantum based ...
2
votes
1answer
279 views

Elliptic curve cryptography attack vector

I would expect a complicated answer for what seems like a simple question about Elliptic curve cryptography. I've read several entries here such as "Elliptic curve cryptography related key attacks" ...
2
votes
1answer
80 views

Attack on textbook RSA with small messages

We learned in class that if Alice wants to send a small message $m$, such that $m < N^{\frac{1}{e}}$, so we can break the system using $e$-th square of $m^e$. But what if Alice knows this flaw and ...
2
votes
1answer
160 views

RSA 1024 bit forge a new matching signature from a chosen message

I have an RSA signature scheme with 1024-bit key where I know the following: Public modulus $N$ Public exponent $e=3$ A lot of signatures Summary: To compute a signature, an MD5 hash is ...
2
votes
3answers
128 views

Attack on Double Encryption Scheme

In this protocol: A → B : { <[A, {K}pk(B)]> }pk(B) B → A : { <[B, {K}pk(A)]> }pk(A) I'd like to determine why this is insecure. How can the attacker learn the key K if A and B are both ...
2
votes
2answers
87 views

Is this commutative encryption protocol secure?

My assumptions are: encryption must be commutative man-in-the-middle is not an issue I would like to implement the following scheme between 2 parties ($A$ and $B$) to exchange a key: Lets $C = P ...
2
votes
1answer
118 views

security in format preserving encryption

In format preserving encryption an attacker knows the format and data type of the plain text. The format of the plain text and cipher text are same. usually cipher text are unreadable form. then how ...
2
votes
1answer
346 views

What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?

This page on Twist security mentions a combined attack and a twist rho attack, applicable in particular to NIST P-224 curve with cost $2^{58.4}$ something, with no mention precise definition of ...
2
votes
0answers
44 views

What are the current known weaknesses/attacks on quantum key distribution?

I am writing a paper on the implementation of QKD in the future. I want to know if there are any viable attacks on the BB84 protocol or QKD in general? I know of the Photon Number Splitting attack or ...
2
votes
0answers
105 views

Timing Attack on OpenSSL by Brumley

I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003). In this paper on page 4, Brumley ...
2
votes
0answers
83 views

Implementation Attacks on Hashes

So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc. What implementation attacks are there against hashes or hashed based functions ...
1
vote
1answer
20 views

What happens when domain parameter $q$ in DSA is not prime number

Suppose that attacker creates domain parameters $(p,q,g)$ where $q$ is not prime number (but $q$ still divides $p-1$) and that signer generates new key pair using these domain parameters. How exactly ...
1
vote
1answer
147 views

Shared modulus attack on RSA

Consider a scenario in which a group of people use a common modulus $n$ in the textbook RSA crypto system, where $n=pq$, $p$ and $q$ are large distinct prime numbers. Is there any chance for an ...
1
vote
1answer
94 views

RSA padding confusion attacks

Server A produces signed messages on request. You can tell server A what type of RSA padding to use in the signature (either RSASSA-PKCS1v1_5 or RSASSA-PSS). Either way, the message will be signed ...
1
vote
1answer
78 views

Necessity of changing $p$ and $q$ when your private key is exposed?

Suppose your private key $d_1$ has been exposed. Instead of changing $p$ and $q$, instead you just choose a new public and private key (say $e_2$ and $d_2$) and use these instead. What kinds of ...