Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

Filter by
Sorted by
Tagged with
-1
votes
1answer
84 views

What will happen to existing cyphertext when today's encryption is broken? [closed]

Even optimistically, I think we can all agree that many encryption algorithms that are widely used in production today will be "broken" sometime in the next decades. With "broken", I mean that (...
0
votes
2answers
60 views

Self signed certificate for mobile app and backend from same company

My company's product is Android and iOS mobile app which connects to our own backend. All interactions of the mobile app are with backend developed by our own company. In such a situation, can the ...
0
votes
1answer
227 views

ElGamal with weak public key

Assuming this setup: A prime $p$, a generator $\alpha$ in $\mathbb{Z}_p^\ast$. Alice chooses her private exponent $d$ from $[2, p-2]$ and calculates her public key $\beta$ = $\alpha^d$. Bob then ...
8
votes
0answers
194 views

Bleichenbacher RSA1024 signature forgery, closed-form solution

Hal Finney's writeup (Bleichenbacher's RSA signature forgery based on implementation error) shows a formula for RSA3072. I tried to replicate the attack for RSA1024 and failed, since the first term of ...
3
votes
1answer
98 views

Statistical attacks on a list of MD5/SHA-1 hashes?

I have a list of MD5 and SHA-1 hashes where the input string is of the form secret1000 secret1001 … all the way up to ...
3
votes
1answer
103 views

Birthday problem applied to hash function with partition of the input set

I am not able to understand why if we consider a regular hash function, it is possible to say that we are partitioning the starting set and then apply the the birthday paradox/problem. Can anyone ...
0
votes
0answers
43 views

(Side channel) attack on a PIC18 micro controller

I'm trying to get some practical experience on (side channel) attacks. First I want to note all possible vulnerabilities. I thought about: Preset I have physical access and I own/wrote the software, ...
2
votes
2answers
112 views

Bellovin ESP Attack on UDP Packets

In Bellovin's ESP Attack, it is stated that: If $L_A$, $L_B$ are using UDP, attack is easier: Wait till session ends Allocate $L_B$'s UDP port to $X_B$ Replay all packets So, how ...
0
votes
1answer
762 views

Decryption of a file encrypted by pseudo-random number generator (The Linear Congruence rand()

How to decrypt this file: https://drive.google.com/open?id=1gZCujDYmEL-FZ5o_xBUS-Ng5979HSsZ7 Given that the only information available about it are: It has been created ‎on 21/3/‎2018, ‏‎9:05:15 AM ...
1
vote
0answers
44 views

Difference between fault measurement and fault model

In the context of fault attacks. What is the difference between fault measurement and fault model? I am reading a lecture and I can not understand for what measurement is used? Could you help me ...
6
votes
1answer
821 views

RSA attack with continued fractions (Wieners attack)

I found an article on the internet about an RSA attack with continued fractions. Given are the following numbers: $n = 205320043521075746592613$ $e = 70760135995620281241019$ $\frac{e}{n}=[0;2,1,...
2
votes
0answers
300 views

RSA signatures that allow hash to move around in block

I'm looking at a broken RSA signature padding implementation in a real device. It's a very-badly implemented version of PKCS #1-like encoding, but before PKCS added the DER-encoded hash identifier. ...
1
vote
1answer
667 views

Is there any ECDSA Attack if I have millions of signatures?

I have been given the task to test the security of our company software. Our company software generates ecdsa signed supply order files. One can generate as many files as he wants. so my question is ...
4
votes
1answer
140 views

What is the reasoning behind the PRESENT key schedule?

It seems there are few books on PRESENT and even fewer that give any reasoning behind the mechanics of the key schedule. I understand how it works to the extent that I made a simple Excel program of ...
2
votes
1answer
916 views

If a key is used to encrypt that same key, is the computational cost to brute force it decreased?

If a key d is used to encrypt a message m that is identical to the key d, resulting in a cipher c c = encrypt(m, d) = encrypt(d, d) is the computational cost to brute force d lower than if the key d ...
1
vote
2answers
8k views

Is it possible to break SHA-512?

Is it possible to break the SHA-512 hash algorithm? Are there any successful attacks out there?
6
votes
1answer
421 views

Does blinding work against side channel on RSA?

In the so called "blinding" technique for RSA, prior to decryption, the ciphertext is multiplied by random $r$ raised to the power of $e$; e.g., $C$ is replaced with $C\cdot r^e$; and then after ...
0
votes
1answer
70 views

Is rekeying attack the same as related-key attack?

I've been searching about rekeying attack, but what I found is always using the term "rekeying/related-key attack". Is rekeying attack the same as related-key attack?
1
vote
1answer
48 views

What is the procedure to proceed towards breaking a cipher text when the process of encryption is not known?

I mean , if one is provided with a cipher text and the process of encryption through which text has has been encrypted has not been provided , then how is the cipher text broken ? Is frequency ...
-1
votes
1answer
84 views

Question about key establishment protocol and key exchange attack

If an adversary $M$ observes a session of the protocol between $A$ and $B$ and learns the session key $k_{AB}$.How Can the adversary mount a successful impersonation attack and communicate with $B$ on ...
1
vote
1answer
169 views

Using round constants to thwart slide attacks

I'm partly unclear as to how the use of round constants in an iterated cipher makes it immune to slide attacks. I mean, I can see how it does from one perspective, but if the solution to slide attacks ...
7
votes
1answer
814 views

How does the ROCA attack work?

I have been trying to understand the ROCA attack described here as the "First Attack" and I cannot follow the explaination. I have been trying to generate a 512-bits key and crack it. As far as I can ...
2
votes
1answer
134 views

Risks of full length KCV (components and full keys)?

We have to comply with third-party security requirements for the loading of 3DES keys. I'm a little confused about the reason behind why Key Check Values (KCVs) can't be full length. As KCV are hashes,...
2
votes
0answers
75 views

*feasible* pre-image attacks against reduced SHA-1

(tldr: see last paragraph) Although SHA-1 is vulnerable to collision attacks, it is still resistant to pre-image attacks. SHA-1 was designed to be resistant until a brute-force attack of $2^{160}$ is ...
0
votes
1answer
420 views

Can you help me understand Pollard's rho example?

I'm studying the Pollard's rho algorithm to solve discrete logaritms on the Handbook of applied cryptografy but I didn't understand one part of the theory and looking at the example gets me more ...
1
vote
0answers
127 views

Boneh and Durfee attack on RSA

I am a maths teacher and I'm trying to understand the Boneh and Durfee attack on RSA. I am not very familiar with cryptography. I found a dutch scripting about it. I know that: $ e*d\equiv1+k*\phi(...
2
votes
4answers
2k views

Would possessing a string with the SHA-256 hash of all zeros lead to an attack on SHA-256?

Would possessing a string with the SHA-256 hash of all zero bits lead to an attack on SHA-256? I could easily imagine that a specialized attack leaked knowledge of how to do it, but I could equally ...
0
votes
1answer
55 views

The differences between the attackers in the definitions of IND-ATK and NM-ATK

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
1
vote
1answer
937 views

Algorithm for factoring knowing RSA private key

According to this and this paper from Alexander May is possible to factor given the knowledge of the RSA private key. This is possible via Coppersmith and LLL reduction. Now I am trying to implement ...
3
votes
1answer
196 views

How is the DUHK attack specific to the ANSI X9.31 RNG?

Recently, the DUHK attack on bad RNG implementations of hardware devices has been published. The attack is based on a (known or reverse engineerable) hardcoded key, which is used for a ANSI X9.31 ...
1
vote
1answer
234 views

Is the same message with repeated AES-GCM leaking plain text over time?

The same message results in different cipher text every time AES-GCM is applied. If an attacker collects repeated messages over time, will he be able to extract the plain text if enough cipher text is ...
8
votes
1answer
486 views

What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...
2
votes
1answer
152 views

Krack WPA2 decrypt only some small pieces of packets

I have gone through the paper (PDF) available at krackattacks.com. However, from what I understood you force a key reinstallation causing you a nonce reuse over 2 blob of data. As it is a keystream, ...
1
vote
0answers
17 views

Can we protect PRESENT from the Statistical Saturation Attack if we change the permutation layer to a random permutation layer?

This is continuation-question based on: If PRESENT had different permutations s would that protect it against Statistical Saturation Attack? Can we protect PRESENT from Statistical Saturation Attacks ...
16
votes
4answers
7k views

How can C rand() be exploited if a secure seed is used?

I've just started doing a research project on CSPRNGs and I would like to know what kind of vulnerabilities a regular PRNG has with a secure seed. For example, if I generate a random number using ...
4
votes
1answer
419 views

If PRESENT had different permutations s would that protect it against Statistical Saturation Attack?

The block cipher PRESENT is vulnerable to the Statistical Saturation Attack for up to 15 rounds (PDF) and a simple example is here. So my questions are, if some (or all) of the permutations were ...
5
votes
1answer
288 views

Is the RSA signature attack from Desmedt and Odlyzko practical?

I would like to understand how the attack from the Desmedt and Odlyzko on RSA signatures (and subsequents works) can be made practical. This attack describes a way to forge the signature on a new ...
4
votes
1answer
1k views

Bleichenbacher's Attack on high public exponent RSA keys?

Why can't Bleichenbacher's Attack work for RSA public exponents with values equal to 65537 and above? Does the fact that 65337 is a prime number have any relevance to it?
3
votes
3answers
182 views

Why are processes requiring (almost) as much work as brute force considered an “attack” on a hash function?

In the literature on attacks against hash functions, I frequently come across algorithms requiring $2^n$ work described as being preimage or collision "attacks" on a hash function with only marginally ...
1
vote
1answer
90 views

Is it Possible to Generate a Duplicate DH Session Key from 2 Pairs of DH Keys?

This might sound pointless at first, but I want to know if it's computationally feasible to generate the same resulting session key in 2 different DH key exchanges. The purpose would be for a man-in-...
1
vote
0answers
265 views

what is scyther code for this protocol? [closed]

I wrote the following protocol. I wrote the code. I do not know how to write the rest of the code. please guide me. usertype SessionKey; usertype TimeStamp; hashfunction H1; macro sessionkey = H();...
0
votes
1answer
99 views

Are “deterrent” algorithms like NFS and Coppersmith's algorithm actually used in practice?

It seems like there are a lot of algorithms in number theory which I would classify as "deterrent" algorithms -- for example the various number field sieves for factoring, Coppersmith's algorithm for ...
-2
votes
2answers
474 views

Relationship between a key stream having a high entropy and whether it is cryptically secure in a stream cipher

Hi i am trying to build a key stream generator for my homemade stream cipher.The key stream output has a close to maximum entropy value and a large periodicity. What does it take for this generator to ...
4
votes
1answer
1k views

How to attack Merkle-Hellman cryptosystem if the first element in the superincreasing series is too small?

In An Introduction to Mathematical Cryptography Jeffrey Hoffstein et al. claim that "It turns out that if $r_1$ is too small, then there are easy attacks, so we must insist that $r_1>2^n$." Here $...
5
votes
3answers
881 views

What are the dangers of using CPU clock drift for generating random data?

From what I understand, a physical source of true randomness could be achieved with a multi-core processor, by using clock drift between two or more cores. However, a processor is easier to ...
11
votes
4answers
2k views

What is the malicious potential of a key-substitution-attack?

What is the idea behind a key-substitution-attack? We start from a given pair of message $m$ and signature $s(m)$. The signature can be verified by anybody in possess of the public key $y$: $v(m, s, ...
3
votes
0answers
154 views

Is the “Pico” alternative to passwords vulnerable to man-in-the-middle?

Maybe someone has already heard about "Pico" by Frank Stajano. In short: It is a model for an alternative for using passwords for authentication and seems to be very interesting. Regarding the paper, ...
-1
votes
1answer
92 views

Preventing predictable modifications to AES encrypted data

I'm fairly new to cryptography and am trying to find out best practice for this situation. Let's say I have some code which is going to be used to pass around an encrypted e-mail address. I encrypt it ...
6
votes
1answer
505 views

How does the sponge construction avoid the weaknesses present in Merkle–Damgård hash function?

How are the weaknesses of the Merkle–Damgård construction (i.e. the Herding attack, multicollisions, length extension, expandable messages) avoided in the sponge construction?
3
votes
1answer
383 views

4th Root of RSA Modulus Attack algorithm

I am trying to solve here a task but I have no clue on how to approach it. The last few days I tried to find a way but I have no clue :( Maybe someone of you could give me a hint on how to do it. The ...