# Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

388 questions
Filter by
Sorted by
Tagged with
37 views

### How to break RSA when $c = (secret * e) \pmod n$? [closed]

In a challenge I participated recently, I was given: $n = p * q$ $e = 463671$ $c = (secret * e) \pmod n$ The $e$ has a comment attatched that said "fermat" and nothing more. Maybe it could ...
54 views

### How to break RSA when $q = e^{-1} \bmod p$?

This problem was posed during a recently ended contest. I am given a value for n and e. e = 65537. n is a 2048-bit number. p is a 1024-bit prime number. q is the modular inverse of e mod p. That's ...
• 103
48 views

### Encrypting two messages with the same content with different keys/IVs still secure if attacker knows they are the same?

I want to store two ciphertexts inside the same file. The data stored in each ciphertext is the same (except for padding), but the data was encrypted with different keys and IVs. Both ciphertexts were ...
99 views

### Key Committing AES-GCM

There is a handful of attacks against AEAD, and GCM in particular, which demonstrates that it is feasible for an attacker $\mathcal{A}$ to obtain a ciphertext $C$ which encrypts to multiple key/...
33 views

### An adversary does know the block cipher key and some bits of the message and the cipher (same length as key). Does this help him to find pairs? (ECB)

Given a $N$-bit AES or similar block cipher with his $N$-bit key $k$. We can encrypt a $N$-bit message $m$ to a $N$-bit cipher $c$ and decrypt it again. $$E(m,k) = c$$ $$D(c,k) = m$$ An adversary does ...
• 475
104 views

### About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?

Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$ with $$p=(p_1, p_2)$$ $$q=(q_1,q_2)$$ $$p_1,q_1 \in [0,s)$$ $$p_2,q_2 \in [0,s^2)$$ We want to find a path in between ...
• 475
55 views

### How to solve LWE/RLWE under partial information about $s$

For LWE/RLWE, it's difficult to find $s$ from $\left(A, b = As + e\right)$. But if the partial information of $s$ is leakaged, such as partial $s$ or parity of $s$, how easy would it become to solve ...
85 views

### Proving you're from the year 2069

Just a question I thought of while playing an amazing game about time travel (13 sentinals aegis rim). What are the most bullet-proof cryptographic methods for proving you've come from beyond a ...
• 335
70 views

### Proving that RSA CCA is possible

I'm reading from William Stalling's Cryptography & Network Security - 7th Edition To me the first line suggests $$(M^e\bmod n)\times(2^e\bmod n)=((2M)^e\bmod n)$$ which means that if we want to ...
• 103
97 views

I understand the theory behind Hastad's broadcast attack. Namely if we have three encrypted messages with the exponent e=3: ...
• 143
1 vote
50 views

### What's the probability of cracking this cipher using partial information about the private key obtained from $k$ public keys?

For the following cipher, what is the probability of someone without the private key generating a valid public key, using only information from a list of $k$ public keys previously generated with the ...
121 views

### Is Ntru-Encrypt still secure in 2022

I'm going to use NTRU as post-quantum public-key encryption algo in my project. I've googled attacks on NTRU and found a lot of them but since I'm new to NTRU and don't understand the math used, and ...
• 31
611 views

### How can we prevent duplicate key attacks on digital signatures

A limitation digital signatures is that for a given signature σ of a message m corresponding to a public key pk, an adversary could generate a pk', sk' that produces a signature σ' for m, such that σ'...
1 vote
52 views

### How to find strength of a cryptographic hash function?

I am having an idea to create a cryptographic hashing algorithm. I found a mathematical function $f: x \rightarrow y$ . By using Merkle-Damgård construction wide pipe, I designed a hashing function. ...
181 views

### Help with RSA CTF question

I'm trying to solve a CTF problem relating to RSA encryption. I can run a challenge binary that will read a flag from a file, the flag will match the following RegEx: ...
104 views

### Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 vulnerable to Zombie POODLE/GOLDENDOODLE attacks?

I'm getting mixed reports on this one. I have a web host and multiple SSL scanning tools (including the one run by Qualsys SSL Labs), saying that the cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ...
• 121
1 vote
85 views

### Invalid point attack yields wrong results for low order points

I've recently tried to replicate the results of the question Ruggero asked and which Samuel Neves answered here: Understanding Twist Security with respect to short Weierstrass curves In my attempt to ...
124 views

### Invalid point attack on quadratic twist of Elliptic Curve when -1 is a quadratic residue

I'm replicating an invalid point attack on ECC using Short Weierstrass curves. For this I have written a "dumb" implementation that does not validate points are on the curve before going ...
5k views

### Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?

Are there moderns (post World War II) and famous protocols that were proven secure (in any model: game-based, UC...) but whose proof was wrong and could have led to real-world attacks? Note that: I'm ...
• 936
41 views

### How difficult is finding $i$ for sequence $s_{i} = g^{s_{i-1}} \mod P$ with $s_0 = g$ for given value $v\in [1,P-1]$

Assuming we found a constant $g$ and a prime $P$ which is able to produce all values from $1$ to $P-1$ with it's sequence $$s_{i} = g^{s_{i-1}} \mod P$$ $$s_0 = g$$ How many steps are needed to ...
• 475
68 views

### How difficult is finding $i$ in tetration $^{i}g = g\uparrow \uparrow i = \underbrace{g^{g^{\cdot\cdot\cdot^{g}}}}_i\equiv v \mod P$ for $v\in[1,P-1]$

EDIT: I messed up something (see comments at answer). This question contains some false statements EditEnd. For tetration modulo prime $P$ ^{i}g = g\uparrow \uparrow i = \underbrace{g^{g^{\cdot\cdot\...
• 475
1 vote
182 views

### Is it possible to find an AES key given part of the key, the ciphertext, initialization vector and mode of encryption?

The following details are given: Partial Key: ...
1 vote
97 views

### RSA blind signature attack but without public exponents

I been trying to solve a particular challenge where we have to sign an admin message. At first it seems a classic RSA blind signature attack but eventually they didnt give out the public exponents(e,n)...
• 13
302 views

### How can I decrypt an RC4 encrypted text when knowing the first 8 characters of the plain text secret?

I'm having difficulty decrypting a secret message as a part of a CTF and I was wondering how could I decrypt an encrypted text that has been encrypted with pycrypto RC4 and when the first 8 characters ...
129 views

### What attacks exist on ECDSA if there are more than 10 million signatures?

I am aware that there are weaknesses in ECDSA when reusing NONCE and I am aware that there is a lattice attack on ECDSA. Are ...
• 3
1 vote
123 views

### Is there a benefit to "double encryption" when it comes to attacks analyzing attempted decryption results?

This is a beginner's question related to general security, but it fits cryptography exchange because it's more specific to the action of cryptographic attacks and how they work. Assume the following ...
• 169
1 vote
55 views

### How does an attacker decrypt a hash function by looking for linearity?

Reading the selected answer to Designing a hash function from first principles rather than depending on heuristics is very insightful. The section on "nonlinearity" suggests that making ...
• 161
1 vote
105 views

### SHA-256 Hash Crack

Suppose, If a SHA-2 hash does get broken completely with hardly any power, where would it get reported and is there currently a bounty on it?
1 vote
94 views

### What is a differential attack on a hash function? How would one attack a SHA algorithm and what would achieve?

Currently, I have been assigned to attack a reduced version of SHA-1. What are we trying to achieve? How do we attack it?
1 vote
153 views

### Using Shor's algorithm to access RSA messages without factoring

Most of the time people forgot that the real aim of the adversary against encryption is accessing the message. For example, in the RSA case, we talk about the factoring of the modulus to reach the ...
• 43.4k
5k views

### Why "1" in 51% attack on Blockchain network

In many sources, included Wikipedia, we read: Any pool that achieves 51% hashing power can effectively overturn network transactions, resulting in double-spending. My question is: Why do we talk ...
• 243
1 vote
58 views

### Revealing original message length having random padding

If I have a message that has a fixed unknown length $L$, and we add to it's TLS encryption a random sized padding $0\leq n \leq N$ so the sent message if $L+n$. I'm also able to make the target re-...
• 143
1 vote
132 views

### Cracking secret key, n, and m by hand with the Diffie-Hellman key exchange brute force

Problem: You see Michael and Nikita agree on a secret key using the Diffie-Hellman key exchange. Michael and Nikita choose $p = 97$ and $g = 5$. Nikita chooses a random number n and tells Michael that ...
• 103
113 views

### Short Nonces in ECDSA signature generation

Recently I noticed that my device generates short-sized Nonces. Approximately $2 ^ {243} - 2^{244}$. Could it turn out that there will be a small leak of ...
1k views

### Can a series of triangle reflections be used for cryptography?

(I guess no but why is this the case? Any way to make it possible?) Out of a given equilateral triangle T1 (with his 3 vertices A,B,C lying in a finite Field $\mathbb F_N^D$) another equilateral ...
• 475
106 views

### Would being able of factoring integers efficiently have some consequences over Elliptic Curve Cryptography?

Let's assume you can factor integers in a very efficient manner. Would that endanger the security of e.g. elliptic curve cryptography, or is there no link between the two ? You can often read that ...
108 views

### Eavesdropping attack on text-book RSA encryption with public nonce

Consider the following scenario: Alice has a secret key and public key pair for text-book RSA (denoted $\text{sk}$ and $\text{pk}$ respectively). Bob has an authentic copy of $\text{pk}$. The ...
1 vote
44 views

### Can the salt be derived based on the other components of encrypted data?

I'm using python.cryptography's Fernet with PBKDF2 passphrase hashing to encrypt a piece of data (the value) that is stored, encrypted, in a database. The hashed passphrase is not stored in the ...
• 111
44 views

### How does knowing the factors of the key help me decrypt?

I recently started learning about cryptography and its Quantum aspect and I came across Shor's Algorithm (which solves the following problem: "Given an integer N, find its prime factors"). I ...
29 views

### What are the main attacks that can be done against a ZK Σ-protocol like Schnorr's identification scheme?

I heard about the "Chess Grandmaster Problem", Eavesdropping attacks and Man-in-the-middle. Can they be applied in any way to a ZK protocol? I'm not looking for long examples, just what are ...
125 views

### kleptography SETUP attack in ecdsa

I'm trying to implement kleptography SETUP attack of ecdsa with python. Just a simply script to verify the algorithm. However i can't get the right output as the paper said. Where is the problem? Can ...
• 31
50 views

### MAC Security - MAC verification queries

In the applied cryptography book by Boneh and Shoup, Chapter 6 on MACs, it is stated that an adversary that is also capable of requesting the challenger for verification queries (in addition to ...
158 views

### What would be the requirements for a new-age cipher standard?

While nowhere near being broken, AES has known attacks like reading from the substitution table, memory-based attacks, etc. If we keep getting better at breaking ciphers and we eventually get close to ...
93 views

### rsa attack with plain text, cypher text , public key

starting from the fact that there are different attacks on RSA, based on the starting situation, for example there are different studies, on attacks that find the private key having the freedom of an ...
• 101
116 views

### Chinese remainder theorem in ECDSA for parameters in secp256k1?

It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions. https://tls.mbed.org/public/WSchindler-...
• 3
620 views

I have been playing around with Hastad's broadcast attack on RSA with linear padding. Using the implementation and the test function from here: https://github.com/0n5/CTF-Crypto/blob/master/RSA/...
• 23
38 views

### Slide Attacks and FPE

What is a slide attack? I am not able to comprehend how they are used for attacks on FPE schemes like FF3.
91 views

### Can I copy digital signature for malicious purpose?

I am reading Cryptography. I have multiple questions to ask. I signed my QR code with my private key so that people can verify it's mine. QR code has data which is public. I have this QR code on my ...
21 views

### Crypto Economic Attacks such as Nothing At Stake and Sandwich Attack from Archive Nodes on Polkadot

Could you please advise me if there are threat vectors from archive nodes such as front running attacks, sandwich attacks and nothing at stake attacks as they are quite powerful in terms of the ...
• 285