# Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

234 questions
Filter by
Sorted by
Tagged with
1answer
118 views

### Does knowing that the exponent is in a certain range help solving discrete log?

given: $c=g^i \bmod P$ $g$ generator for group with group size $\varphi(P)$ $g,P,\varphi(P)$,c is known by the attacker He wants to know $i$. Now the attacker also knows $j,k$ with $j<i<k$ $k-j$...
1answer
63 views

### How do discrete logarithm with modulo a prime and a non-prime compare?

Let $c_N = g^i \mod N$ and $N=p \cdot q$ and $c_P = f^j \mod P$ and $P$ a prime We assume $N,P$ has the same bit-length. $P$ is the best type of prime you can choose (e.g. safe prime). $N$ is a ...
1answer
83 views

### On the security definitions

What are the differences between: perfect security information-theoretic security semantic security indistinguishability Are there any other definitions which are closely related? Do these security ...
0answers
21 views

### Why, in general, are proofs of possession (POPs) “clearly” not sufficient for substantiating the knowledge of secret key (KOSK) assumption?

In Ristenpart, Yilek - The Power of Proofs-of-Possession: Securing Multiparty Signatures against Rogue-Key Attacks they have the statement: In general, such proofs of possession (POPs) are clearly ...
1answer
264 views

### How safe is a prime with $P=2 \cdot Q \cdot R \cdot S \cdot t+1$ for discrete logarithm? How to enhance/compare?

To get some certain properties for my use case I need a prime $P$ which has the form: $P=2\cdot Q \cdot R \cdot S \cdot t+1$ with $Q,R,S,t$ primes as well. Why that form - Use case Together with ...
2answers
28 views

### The opponent possesses a string of ciphertext and has access to the encryption machinery as black box. What is the name of this attack?

a quick example: The encryption function: y = E(x) = (13x + 9)(mod 27), when the letters A–Z are taken to be the numbers 0–25 and the Space (punctuation) is the number 26. The opponent has the ...
1answer
29 views

### Randomization attack in voting protocols

I'm looking into coercion-resistant voting schemes and one of the key elements of coercion-resistance is resistance to randomization attacks. Juels et al. define a randomization attack as one where ...
1answer
110 views

### How does the CBC Padding Oracle Attack work in General?

Right now we don't have a single generalized question asking how the CBC padding oracle attack works. We have e.g. this one and this one but the former is distracted by the concrete values being ...
1answer
73 views

### How you find the unpadded short plaintext using RSA?

I am currently trying to understand how you find the unpadded short plaintext when you are using RSA. Please help with explaining the process and so I can understand this topic more.
1answer
301 views

### What are the current known weaknesses/attacks on quantum key distribution?

I am writing a paper on the implementation of QKD in the future. I want to know if there are any viable attacks on the BB84 protocol or QKD in general? I know of the Photon Number Splitting attack or ...
0answers
36 views

### How “Resending Message Attack” works?

In the second chapter of Bruce Schneier's book Applied Cryptography, 2nd Edition, 1996, we find this in section 2.7.1 Resending the Message as a Receipt: ...
1answer
156 views

### Cipher Block Chaining - How do you change the plaintext of all blocks?

I've just read about CBC encryption and decryption and was wondering how you can change every plaintext block? Let's say you have an initialization vector, 3 ciphertext blocks, know each block-cipher-...
4answers
8k views

### How can C rand() be exploited if a secure seed is used?

I've just started doing a research project on CSPRNGs and I would like to know what kind of vulnerabilities a regular PRNG has with a secure seed. For example, if I generate a random number using ...
1answer
48 views

### Probabilistic padding to avoid Håstad’s Broadcast Attack

Can someone explain why probabilistic padding like OAEP is particularly useful for avoiding Håstad’s Broadcast Attack? I don't really get the reason why.
2answers
395 views

### Can Shamir’s Trick crack the cryptographic strength of ECDSA?

Recently stumbled upon a discussion in the forum What is Shamir’s Trick used for? Are there any such examples?
1answer
55 views

1answer
43 views

### How much more secure is $c = mg_1^r + g_2(g_1(g_1^r-1)/(g_1-1)) \mod p$ compared to just $c = mg_1^r \mod p$ (dis. log), all known but $r$?

To encode a message $m$ to a cipher $c$ you can use the only hard solvable problem of computing the discrete logarithm with a generator $g$ in base over a prime $p$. $c = mg_1^r$ mod p If an ...
1answer
56 views

### Example of product cipher more secure than its components

Can anyone give me an example of a product cipher which more secure than its components. Here is how the explanation should proceed. There is cipher C1 which can be attacked with the technique A1, ...
0answers
162 views

### RSA encryption extremely large public exponent

I'm trying to do learn a bit about RSA by doing CTF's and now I am doing one problem probably more than 7 hours so I would really appreciate a hint here from an expert. I have an encrypted message $c$...
0answers
71 views

### Weak/Vulnerable AES Implementations [closed]

I'm trying to complete a cryptography CTF challenge in which I have a cipher I'm supposed to attain the original plaintext from. I have reason to believe it's been encrypted using AES, but I'm unaware ...
3answers
2k views

### When is a cipher considered broken?

We've all read how some people claim AES is broken because there was supposedly a way to get the plain text from a cipher text faster than brute-force. But is this the definition? Is a cipher broken ...
1answer
108 views

### How complex must round constants be to resist slide attacks?

A key schedule that generates round keys by XORing a round constant with the key is linear and can be vulnerable to related key attacks, but let's ignore that for now. Constants are necessary to avoid ...
0answers
45 views

1answer
61 views

### Is chosen ciphertext attack used to obtain a key? [duplicate]

I don't understand what the goals are of a Chosen Ciphertext Attack. What I've read from Wikipedia is that it is an attack one can use to obtain the key that the crypto algorithm uses. However, I ...
1answer
357 views

### Fault attack on RSA-CRT

I am trying to understand fault attack on RSA-CRT, and I found some example, which I don't know how to solve it. I know public modulus $N$, public exponent $e$, a value of faulty signature (where ...
1answer
116 views

### Caculating Correlation for CPA attack on AES

I am having some trouble understanding how to calculate the correlation coefficient for CPA attack on AES. In the article Study of Deep Learning Techniques for Side-Channel Analysis and Introduction ...
1answer
500 views

### Is there a feasible preimage attack for any hash function (no matter how deprecated) today?

Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack? All hashes that are nowadays considered 'broken' (...
0answers
144 views

### show that G' is not a secure PRG even if G is

Hello I'm trying to show that the function G'(s) = G(s) || G(G(s)) is not a secure PRG even if G is. My first question is that in this case, how do I know what G ...
1answer
36 views

### Associative Multivariate Permutation

Popular multivariate schemes are constructed by having a several easy-to-invert functions/maps as parivate key, and their composition as the public key. When signing, the hash, or a padded form of ...
0answers
57 views

### Need tips on how to break Fiat-Shamir sigma-protocol (programming challenge)

I'm completely stuck on an university programming challenge and I need some tips to get me out of the valley I'm in, you don't need to give the full answer if you do not wish to. What we have: Fiat ...
1answer
413 views

### Slide attack: creating an actual attack on the Simon Cipher

I have been reading the Simon Cipher paper. It has the line: "The SIMON key schedules employ a sequence of 1-bit round constants specifically for the purpose of eliminating slide properties and ...
1answer
152 views

### Interlock Protocol for Preventing Man-in-the-Middle (MitM) Attack

Trying to turn bookish knowledge to practical: Alice sends half of the encrypted data to eve, eve eavesdrop and tries to decrypt the data and fails as eve has only half of the encrypted block. So, ...
1answer
182 views

### One-round feistel network (DES) attack

I can't find out how to break 1 round of feistel network (obtaining the key). I understand why this equation takes place: $R_1 \oplus L_0 = f(R_0, k_1)$ EDIT: The function f looks like this: But ...
1answer
109 views

### To find nonlinear invariant of S box

I read a paper about a nonlinear invariant attack that is Y.Todo et. al's "Nonlinear Invariant Attack: Practical Attack on Full SCREAM, iSCREAM, and Midori64" In this paper's Appendix A., they said ...
1answer
172 views

### Why is Diffie-Hellman Insecure If Order of the Generator Has Only Small Prime Factors?

In this post from security SE, Tom Leek mentioned that, for Diffie-Hellman to be secure order of the group $g$ should have a prime factor at least $2k$ bits long, where $k$ is the security parameter. ...
0answers
89 views

### Non-exact substitution cyphers

Picture a simple substitution cypher of text with length $N$(spaces optional): Plain : ATTACK AT DAWN Encrypted: ELLETI EL HEPG Another way to represent the encrypted text is with an $N \times N$ ...
1answer
151 views

### Determine RSA modulus from encryption oracle

Suppose we have an RSA encryption oracle $E(m)$ which basically just calculates $m^e \mod n$ for a given message $m$. Here $e=65537$ is known but $n$ is not. Can we determine the value of $n$ without ...
1answer
1k views

### Hash Collision Probabilities

Please give help! how can I calculate the probability of collision? I need a mathematical equation for my studying. Assume, I am using SHA256 to hash 100-bits. Thus: SHA256 {100} = 256-bits (hash ...
1answer
121 views

### Can perfect forward secrecy introduce vulnerabilities?

Is it always a win or could PFS algorithms introduce new attack vectors or weaken the level of secrecy vs not being used?
1answer
213 views

### ECDSA with common nounce?

I'm new to cryptography, and I've searching about ECDSA because I'm trying to solve a CTF. I've already check this site and Google, and I think I'm in the right path, but probably I am missing ...
1answer
157 views

### Recovering plaintext from AES-128 given round key 10 and ciphertext

I'm working on an old CTF challenge where AES-128 was used on a 16 byte block. I have the round 10 key and the ciphertext. What techniques exist for obtaining the plaintext?
3answers
3k views

### Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? If, how big does the list of plaintext ...
1answer
187 views

### Are the Common modulus attack, Common Factor Attack, and Wiener's attack different?

Is there a difference between: Common modulus attack Common Factor attack Wiener's attack or are these just a different name for the same attack?
1answer
406 views

### Difference between eavesdropping and traffic analysis

I was wondering what is the conceptual difference between these two passive attacks on a network. I was reading about them on Wikipedia and they seem quite similar to me. Is there a difference?
1answer
501 views

### Attack on RSA when I know $e$, ciphertexts $c_1, c_2$ of the same message $m$ with 2 coprime modules?

I know that the same message $m$ was sent to two people resulting in ciphertexts $c_1, c_2$. The public keys are $n_1$ and $n_2$, $gcd(n_1, n_2) = 1$. And $e=3$ in both cases. How can I retrieve the ...
2answers
102 views

### RSA: Should the generation of random data used for primes include zero

When generating random data that is later tested for primality, should the random data include the value 0x0? I would have thought that primes that do not include zero's are a subset of the set of ...
1answer
787 views

### Attacking a blackbox PRNG

Every single PRNG attack I could find during my research depends on knowing the PRNG algorithm(s) as well as having definite output. Suppose you have the following scenario: nothing is known about ...