Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

Filter by
Sorted by
Tagged with
0 votes
0 answers
37 views

How to break RSA when $c = (secret * e) \pmod n $? [closed]

In a challenge I participated recently, I was given: $n = p * q$ $e = 463671$ $c = (secret * e) \pmod n $ The $e$ has a comment attatched that said "fermat" and nothing more. Maybe it could ...
user avatar
0 votes
1 answer
54 views

How to break RSA when $q = e^{-1} \bmod p$?

This problem was posed during a recently ended contest. I am given a value for n and e. e = 65537. n is a 2048-bit number. p is a 1024-bit prime number. q is the modular inverse of e mod p. That's ...
user avatar
0 votes
1 answer
48 views

Encrypting two messages with the same content with different keys/IVs still secure if attacker knows they are the same?

I want to store two ciphertexts inside the same file. The data stored in each ciphertext is the same (except for padding), but the data was encrypted with different keys and IVs. Both ciphertexts were ...
user avatar
  • 3
3 votes
1 answer
99 views

Key Committing AES-GCM

There is a handful of attacks against AEAD, and GCM in particular, which demonstrates that it is feasible for an attacker $\mathcal{A}$ to obtain a ciphertext $C$ which encrypts to multiple key/...
user avatar
0 votes
0 answers
33 views

An adversary does know the block cipher key and some bits of the message and the cipher (same length as key). Does this help him to find pairs? (ECB)

Given a $N$-bit AES or similar block cipher with his $N$-bit key $k$. We can encrypt a $N$-bit message $m$ to a $N$-bit cipher $c$ and decrypt it again. $$E(m,k) = c$$ $$D(c,k) = m$$ An adversary does ...
user avatar
  • 475
4 votes
0 answers
104 views

About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?

Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$ with $$p=(p_1, p_2)$$ $$q=(q_1,q_2)$$ $$p_1,q_1 \in [0,s)$$ $$p_2,q_2 \in [0,s^2)$$ We want to find a path in between ...
user avatar
  • 475
3 votes
1 answer
55 views

How to solve LWE/RLWE under partial information about $s$

For LWE/RLWE, it's difficult to find $s$ from $\left(A, b = As + e\right)$. But if the partial information of $s$ is leakaged, such as partial $s$ or parity of $s$, how easy would it become to solve ...
user avatar
0 votes
1 answer
85 views

Proving you're from the year 2069

Just a question I thought of while playing an amazing game about time travel (13 sentinals aegis rim). What are the most bullet-proof cryptographic methods for proving you've come from beyond a ...
user avatar
  • 335
0 votes
1 answer
70 views

Proving that RSA CCA is possible

I'm reading from William Stalling's Cryptography & Network Security - 7th Edition To me the first line suggests $$(M^e\bmod n)\times(2^e\bmod n)=((2M)^e\bmod n)$$ which means that if we want to ...
user avatar
  • 103
0 votes
0 answers
97 views

RSA Hastad's broadcast attack with large numbers

I understand the theory behind Hastad's broadcast attack. Namely if we have three encrypted messages with the exponent e=3: ...
user avatar
  • 143
1 vote
1 answer
50 views

What's the probability of cracking this cipher using partial information about the private key obtained from $k$ public keys?

For the following cipher, what is the probability of someone without the private key generating a valid public key, using only information from a list of $k$ public keys previously generated with the ...
user avatar
3 votes
0 answers
121 views

Is Ntru-Encrypt still secure in 2022

I'm going to use NTRU as post-quantum public-key encryption algo in my project. I've googled attacks on NTRU and found a lot of them but since I'm new to NTRU and don't understand the math used, and ...
user avatar
  • 31
3 votes
3 answers
611 views

How can we prevent duplicate key attacks on digital signatures

A limitation digital signatures is that for a given signature σ of a message m corresponding to a public key pk, an adversary could generate a pk', sk' that produces a signature σ' for m, such that σ'...
user avatar
1 vote
0 answers
52 views

How to find strength of a cryptographic hash function?

I am having an idea to create a cryptographic hashing algorithm. I found a mathematical function $f: x \rightarrow y$ . By using Merkle-Damgård construction wide pipe, I designed a hashing function. ...
user avatar
2 votes
2 answers
181 views

Help with RSA CTF question

I'm trying to solve a CTF problem relating to RSA encryption. I can run a challenge binary that will read a flag from a file, the flag will match the following RegEx: ...
user avatar
2 votes
2 answers
104 views

Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 vulnerable to Zombie POODLE/GOLDENDOODLE attacks?

I'm getting mixed reports on this one. I have a web host and multiple SSL scanning tools (including the one run by Qualsys SSL Labs), saying that the cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ...
user avatar
1 vote
0 answers
85 views

Invalid point attack yields wrong results for low order points

I've recently tried to replicate the results of the question Ruggero asked and which Samuel Neves answered here: Understanding Twist Security with respect to short Weierstrass curves In my attempt to ...
user avatar
2 votes
1 answer
124 views

Invalid point attack on quadratic twist of Elliptic Curve when -1 is a quadratic residue

I'm replicating an invalid point attack on ECC using Short Weierstrass curves. For this I have written a "dumb" implementation that does not validate points are on the curve before going ...
user avatar
26 votes
7 answers
5k views

Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?

Are there moderns (post World War II) and famous protocols that were proven secure (in any model: game-based, UC...) but whose proof was wrong and could have led to real-world attacks? Note that: I'm ...
user avatar
2 votes
1 answer
41 views

How difficult is finding $i$ for sequence $s_{i} = g^{s_{i-1}} \mod P$ with $s_0 = g$ for given value $v\in [1,P-1]$

Assuming we found a constant $g$ and a prime $P$ which is able to produce all values from $1$ to $P-1$ with it's sequence $$s_{i} = g^{s_{i-1}} \mod P$$ $$s_0 = g$$ How many steps are needed to ...
user avatar
  • 475
2 votes
1 answer
68 views

How difficult is finding $i$ in tetration $^{i}g = g\uparrow \uparrow i = \underbrace{g^{g^{\cdot\cdot\cdot^{g}}}}_i\equiv v \mod P$ for $v\in[1,P-1]$

EDIT: I messed up something (see comments at answer). This question contains some false statements EditEnd. For tetration modulo prime $P$ $$^{i}g = g\uparrow \uparrow i = \underbrace{g^{g^{\cdot\cdot\...
user avatar
  • 475
1 vote
2 answers
182 views

Is it possible to find an AES key given part of the key, the ciphertext, initialization vector and mode of encryption?

The following details are given: Partial Key: ...
user avatar
1 vote
2 answers
97 views

RSA blind signature attack but without public exponents

I been trying to solve a particular challenge where we have to sign an admin message. At first it seems a classic RSA blind signature attack but eventually they didnt give out the public exponents(e,n)...
user avatar
  • 13
0 votes
2 answers
302 views

How can I decrypt an RC4 encrypted text when knowing the first 8 characters of the plain text secret?

I'm having difficulty decrypting a secret message as a part of a CTF and I was wondering how could I decrypt an encrypted text that has been encrypted with pycrypto RC4 and when the first 8 characters ...
user avatar
0 votes
0 answers
129 views

What attacks exist on ECDSA if there are more than 10 million signatures?

I am aware that there are weaknesses in ECDSA when reusing NONCE and I am aware that there is a lattice attack on ECDSA. Are ...
user avatar
  • 3
1 vote
1 answer
123 views

Is there a benefit to "double encryption" when it comes to attacks analyzing attempted decryption results?

This is a beginner's question related to general security, but it fits cryptography exchange because it's more specific to the action of cryptographic attacks and how they work. Assume the following ...
user avatar
  • 169
1 vote
0 answers
55 views

How does an attacker decrypt a hash function by looking for linearity?

Reading the selected answer to Designing a hash function from first principles rather than depending on heuristics is very insightful. The section on "nonlinearity" suggests that making ...
user avatar
  • 161
1 vote
0 answers
105 views

SHA-256 Hash Crack

Suppose, If a SHA-2 hash does get broken completely with hardly any power, where would it get reported and is there currently a bounty on it?
user avatar
1 vote
1 answer
94 views

What is a differential attack on a hash function? How would one attack a SHA algorithm and what would achieve?

Currently, I have been assigned to attack a reduced version of SHA-1. What are we trying to achieve? How do we attack it?
user avatar
1 vote
2 answers
153 views

Using Shor's algorithm to access RSA messages without factoring

Most of the time people forgot that the real aim of the adversary against encryption is accessing the message. For example, in the RSA case, we talk about the factoring of the modulus to reach the ...
user avatar
  • 43.4k
14 votes
1 answer
5k views

Why "1" in 51% attack on Blockchain network

In many sources, included Wikipedia, we read: Any pool that achieves 51% hashing power can effectively overturn network transactions, resulting in double-spending. My question is: Why do we talk ...
user avatar
1 vote
1 answer
58 views

Revealing original message length having random padding

If I have a message that has a fixed unknown length $L$, and we add to it's TLS encryption a random sized padding $0\leq n \leq N$ so the sent message if $L+n$. I'm also able to make the target re-...
user avatar
  • 143
1 vote
0 answers
132 views

Cracking secret key, n, and m by hand with the Diffie-Hellman key exchange brute force

Problem: You see Michael and Nikita agree on a secret key using the Diffie-Hellman key exchange. Michael and Nikita choose $p = 97$ and $g = 5$. Nikita chooses a random number n and tells Michael that ...
user avatar
2 votes
0 answers
113 views

Short Nonces in ECDSA signature generation

Recently I noticed that my device generates short-sized Nonces. Approximately $2 ^ {243} - 2^{244}$. Could it turn out that there will be a small leak of ...
user avatar
5 votes
1 answer
1k views

Can a series of triangle reflections be used for cryptography?

(I guess no but why is this the case? Any way to make it possible?) Out of a given equilateral triangle T1 (with his 3 vertices A,B,C lying in a finite Field $\mathbb F_N^D $) another equilateral ...
user avatar
  • 475
4 votes
1 answer
106 views

Would being able of factoring integers efficiently have some consequences over Elliptic Curve Cryptography?

Let's assume you can factor integers in a very efficient manner. Would that endanger the security of e.g. elliptic curve cryptography, or is there no link between the two ? You can often read that ...
user avatar
0 votes
1 answer
108 views

Eavesdropping attack on text-book RSA encryption with public nonce

Consider the following scenario: Alice has a secret key and public key pair for text-book RSA (denoted $\text{sk}$ and $\text{pk}$ respectively). Bob has an authentic copy of $\text{pk}$. The ...
user avatar
1 vote
0 answers
44 views

Can the salt be derived based on the other components of encrypted data?

I'm using python.cryptography's Fernet with PBKDF2 passphrase hashing to encrypt a piece of data (the value) that is stored, encrypted, in a database. The hashed passphrase is not stored in the ...
user avatar
  • 111
0 votes
1 answer
44 views

How does knowing the factors of the key help me decrypt?

I recently started learning about cryptography and its Quantum aspect and I came across Shor's Algorithm (which solves the following problem: "Given an integer N, find its prime factors"). I ...
user avatar
  • 3
0 votes
0 answers
29 views

What are the main attacks that can be done against a ZK Σ-protocol like Schnorr's identification scheme?

I heard about the "Chess Grandmaster Problem", Eavesdropping attacks and Man-in-the-middle. Can they be applied in any way to a ZK protocol? I'm not looking for long examples, just what are ...
user avatar
2 votes
1 answer
125 views

kleptography SETUP attack in ecdsa

I'm trying to implement kleptography SETUP attack of ecdsa with python. Just a simply script to verify the algorithm. However i can't get the right output as the paper said. Where is the problem? Can ...
user avatar
  • 31
0 votes
0 answers
50 views

MAC Security - MAC verification queries

In the applied cryptography book by Boneh and Shoup, Chapter 6 on MACs, it is stated that an adversary that is also capable of requesting the challenger for verification queries (in addition to ...
user avatar
4 votes
2 answers
158 views

What would be the requirements for a new-age cipher standard?

While nowhere near being broken, AES has known attacks like reading from the substitution table, memory-based attacks, etc. If we keep getting better at breaking ciphers and we eventually get close to ...
user avatar
0 votes
1 answer
93 views

rsa attack with plain text, cypher text , public key

starting from the fact that there are different attacks on RSA, based on the starting situation, for example there are different studies, on attacks that find the private key having the freedom of an ...
user avatar
  • 101
0 votes
1 answer
116 views

Chinese remainder theorem in ECDSA for parameters in secp256k1?

It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions. https://tls.mbed.org/public/WSchindler-...
user avatar
  • 3
2 votes
1 answer
620 views

breaking RSA with linear padding using Hastads attack with e>=11

I have been playing around with Hastad's broadcast attack on RSA with linear padding. Using the implementation and the test function from here: https://github.com/0n5/CTF-Crypto/blob/master/RSA/...
user avatar
  • 23
0 votes
0 answers
38 views

Slide Attacks and FPE

What is a slide attack? I am not able to comprehend how they are used for attacks on FPE schemes like FF3.
user avatar
0 votes
1 answer
91 views

Can I copy digital signature for malicious purpose?

I am reading Cryptography. I have multiple questions to ask. I signed my QR code with my private key so that people can verify it's mine. QR code has data which is public. I have this QR code on my ...
user avatar
0 votes
0 answers
21 views

Crypto Economic Attacks such as Nothing At Stake and Sandwich Attack from Archive Nodes on Polkadot

Could you please advise me if there are threat vectors from archive nodes such as front running attacks, sandwich attacks and nothing at stake attacks as they are quite powerful in terms of the ...
user avatar
0 votes
0 answers
23 views

Linking attacks on anonymized data

I'm working on a anonymization project and I got interested in linking attacks. For simplicity I only look at data in table format, such as xlxx or csv data. To anonymise such data the most common ...
user avatar
  • 1,492

1
2 3 4 5
8