Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

Filter by
Sorted by
Tagged with
3
votes
3answers
189 views

Why are processes requiring (almost) as much work as brute force considered an “attack” on a hash function?

In the literature on attacks against hash functions, I frequently come across algorithms requiring $2^n$ work described as being preimage or collision "attacks" on a hash function with only marginally ...
1
vote
1answer
93 views

Is it Possible to Generate a Duplicate DH Session Key from 2 Pairs of DH Keys?

This might sound pointless at first, but I want to know if it's computationally feasible to generate the same resulting session key in 2 different DH key exchanges. The purpose would be for a man-in-...
1
vote
0answers
285 views

what is scyther code for this protocol? [closed]

I wrote the following protocol. I wrote the code. I do not know how to write the rest of the code. please guide me. usertype SessionKey; usertype TimeStamp; hashfunction H1; macro sessionkey = H();...
0
votes
1answer
105 views

Are “deterrent” algorithms like NFS and Coppersmith's algorithm actually used in practice?

It seems like there are a lot of algorithms in number theory which I would classify as "deterrent" algorithms -- for example the various number field sieves for factoring, Coppersmith's algorithm for ...
-2
votes
2answers
513 views

Relationship between a key stream having a high entropy and whether it is cryptically secure in a stream cipher

Hi i am trying to build a key stream generator for my homemade stream cipher.The key stream output has a close to maximum entropy value and a large periodicity. What does it take for this generator to ...
4
votes
1answer
2k views

How to attack Merkle-Hellman cryptosystem if the first element in the superincreasing series is too small?

In An Introduction to Mathematical Cryptography Jeffrey Hoffstein et al. claim that "It turns out that if $r_1$ is too small, then there are easy attacks, so we must insist that $r_1>2^n$." Here $...
5
votes
3answers
1k views

What are the dangers of using CPU clock drift for generating random data?

From what I understand, a physical source of true randomness could be achieved with a multi-core processor, by using clock drift between two or more cores. However, a processor is easier to ...
11
votes
4answers
2k views

What is the malicious potential of a key-substitution-attack?

What is the idea behind a key-substitution-attack? We start from a given pair of message $m$ and signature $s(m)$. The signature can be verified by anybody in possess of the public key $y$: $v(m, s, ...
3
votes
0answers
155 views

Is the “Pico” alternative to passwords vulnerable to man-in-the-middle?

Maybe someone has already heard about "Pico" by Frank Stajano. In short: It is a model for an alternative for using passwords for authentication and seems to be very interesting. Regarding the paper, ...
-1
votes
1answer
97 views

Preventing predictable modifications to AES encrypted data

I'm fairly new to cryptography and am trying to find out best practice for this situation. Let's say I have some code which is going to be used to pass around an encrypted e-mail address. I encrypt it ...
7
votes
1answer
534 views

How does the sponge construction avoid the weaknesses present in Merkle–Damgård hash function?

How are the weaknesses of the Merkle–Damgård construction (i.e. the Herding attack, multicollisions, length extension, expandable messages) avoided in the sponge construction?
3
votes
1answer
402 views

4th Root of RSA Modulus Attack algorithm

I am trying to solve here a task but I have no clue on how to approach it. The last few days I tried to find a way but I have no clue :( Maybe someone of you could give me a hint on how to do it. The ...
1
vote
1answer
4k views

Can you help me understand the RSA Broadcast Attack?

I am currently working on a broadcast attack on RSA. This is what I have: 17 ciphertexts $C_i$ and corresponding moduli $N_i$ for a single common message $m$. Public key $e = 17$ The first part (of ...
0
votes
2answers
674 views

Recover key given partial key, IV and cipher text using CBC mode

Given a known IV and a small part of the key (not enough to use brute force) is there are any way to break CBC encryption with only one cipher text?
3
votes
1answer
154 views

BEAST Attack: from guessing to decoding

I understood the XOR trick that allows an attacker to guess a block of a previously sent message from the client to the server: the attacker forces the client to send the message $\tilde{m} = c_n \...
2
votes
3answers
2k views

Can someone randomly guess the key to AES 256 bit encryption?

Is it possible that someone can randomly input a key to AES 256 bit encryption and it is correct? What are the chances of this happening? Is it even possible or not?
18
votes
2answers
3k views

How is encryption broken today?

There are often articles in the news that state that a certain country or hacker has been able to decrypt/hack highly protected systems: Some examples are the Lockheed Martin RQ-170 Sentinel that was ...
1
vote
1answer
121 views

What is definition of adversary ? And what they do?

Currently I am writing my last assignment about secret sharing. But I don't get clearly about adversary. I know this seems so basic understanding in secret sharing. But I couldn't get references that ...
0
votes
1answer
122 views

Password-Managers: what is the IND-CDBA attack logic?

In the work of Paolo Gasti and Kasper B. Rasmussen On The Security of Password Manager Database Formats, they describe two attack forms: IND-CDBA and MAL-CDBA. While I understand the MAL-CDBA attack ...
4
votes
2answers
179 views

How to find collisions in a secret-prefix Merkle–Damgård given an adversary that can choose the IV?

I am given the following Merkle–Damgård construction: Let $f \colon (\{0,1\}^n \times \{0,1\}^b) \to \{0,1\}^n$ be a compression function. Fix a string $\mathrm{IV}\in\{0,1\}^n$, and for $M \in (\{0,...
2
votes
0answers
61 views

Simultaneous collision for MD5 and SHA1? [duplicate]

I know that both MD5 and SHA1 are considered cryptographically broken now that collisions can reasonably be computed. The question I have is: What is the likelihood that a collision could be found for ...
1
vote
1answer
84 views

TLS-conformant ciphertexts and SSLv2-conformant ciphertexts for Blechenbacher attack for DROWN attack

This is regarding the published paper on the DROWN attack (https://drownattack.com/drown-attack-original-report.pdf) It was mentioned in the paper that for TLS, RSA PKCS#1 v1.5 is used to encapsulate ...
9
votes
2answers
2k views

Is there a downside to encrypting too much data with the same key?

Is there a downside to encrypting too much data? If so, what? I'm guessing things like too much data encrypted with the same key, possibly leaking information due to a collision encrypting non-...
1
vote
1answer
199 views

What is the prp-advantage of a $2^{80}$-time adversary attacking AES-256?

I am somewhat confused with something I read in Dan Boneh's slides discussing the advantage of a $2^{80}$-time adversary attacking AES-256; according to Boneh, the assumption is that this advantage is ...
3
votes
1answer
78 views

Deriving user keys from ID

The "normal idea" is to generate a key per user, send them to the users (securely, of course), and store them in a database. But what if I use a keyed hash (like Blake2b) with a server key and then ...
3
votes
1answer
838 views

Attacking a blackbox PRNG

Every single PRNG attack I could find during my research depends on knowing the PRNG algorithm(s) as well as having definite output. Suppose you have the following scenario: nothing is known about ...
5
votes
1answer
432 views

Slide attack: creating an actual attack on the Simon Cipher

I have been reading the Simon Cipher paper. It has the line: "The SIMON key schedules employ a sequence of 1-bit round constants specifically for the purpose of eliminating slide properties and ...
1
vote
1answer
502 views

RSA factorization challenge

I'm in a teacher-like position and would like my students to practice certain classes of RSA attacks. However I don't really know how to go about it and how to sensibly choose the parameters such that ...
12
votes
1answer
273 views

Why doesn't Wang's attack work on SHA-1?

Wang's (et al) differential attack works on MD5, MD4, RIPEMD and HAVAL. Why doesn't it work on SHA-1?
9
votes
1answer
1k views

How can I attack a Triple-Block cipher with 2 keys (like 3DES) with a cost of ≤ 2⁵⁶

I am trying to solve something and I have but I have no idea anymore. Maybe anyone of you has an idea/solution/hint. Given is a block cipher $F$ with key length $n$. It looks like this: $$c = ENC_{k1}...
0
votes
1answer
222 views

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good?

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good? For example, let's take the hash: 79b7cdc3 to calculate the first byte you ...
1
vote
2answers
3k views

Is it possible to break AES-128 ECB if you are given a ciphertext and a small portion of the key?

If you are given the ciphertext and the first half bytes (8 bytes) of the encryption key (key is 16 bytes in total), can you use this to break AES-128 ECB encryption and determine the last 8 bytes of ...
1
vote
2answers
176 views

Preventing attack in RSA modified version

I have the following modified version of RSA apparently proposed by Shamir. To check the original version of RSA check the first scheme in this other question. The modified version goes as follows:...
0
votes
1answer
1k views

Are block ciphers vulnerable to “key reuse” and/or “bit-flipping” attacks?

I know that almost all stream ciphers are vulnerable to “key reuse” and “bit-flipping” attacks. Because AES also uses $XOR$ in its algorithm, is it possible for block ciphers – like AES – to be ...
17
votes
1answer
2k views

What does a “real” quantum computer need for cryptanalysis and/or cryptographic attack purposes?

The cryptographic world has been buzzing the word "quantum" for a while now (even the NSA is currently preparing itself for a post-quantum crypto world) and quantum-related hardware engineering is ...
1
vote
0answers
50 views

How can I match each encrypted message with the public key used to encrypt them for a common encryption attack RSA

I have five encryption mods ($n_1$ through $n_5$) with the same encryption exponent ($e$) and the same message encrypted using the five public keys giving $E_1$ through $E_5$ that were not given in a ...
2
votes
1answer
97 views

How any attack on a cipher carried out? Are these practical or only theoretical?

I have been reading about successful attacks on AES and other ciphers. One such mention is here (see excerpt below): AES was published under the name Rijndael in 1998. Refereed cryptanalytic ...
1
vote
1answer
820 views

how does a time-memory trade off attack work?

I'm a student who learning cryptography, refer to this book "Applied Cryptanalysis - Breaking Ciphers in the Real World" (page 133). It helped me know about time-...
1
vote
1answer
126 views

What's the name of this cipher? And how can it be broken?

Assuming that: SHA-256 and SHA-512 are random and irreversible the output appended to some random and long enough secret is just as random as any other data and will produce values that are just as ...
5
votes
1answer
706 views

Generate 64 bit HMAC

Given $plaintext$ and its respective authentication $tag$ which is generated from HMAC-MD5 so that $|tag| = 128$ bits. If the application is constrained and can send only $64$ bits. Is it ok, if we ...
1
vote
1answer
448 views

Is it safe to send HMAC and plaintext in the same message?

If a certain protocol sends $plaintext$ and its corresponding HMAC then is such a protocol prone to key extraction attacks ? Intuitively , HMAC is $ciphertext$ generated from $plaintext$, (although ...
11
votes
0answers
2k views

Cracking a PRNG by observing ranks within groups of its output

Suppose that I am generating random numbers with Python's random module, so that there is a known random number generator (Mersenne Twister in this case). I've ...
4
votes
2answers
945 views

Key recovery when AES ECB is used for short but repeated messages

My question is based on the specification of the protocol LoRaWAN and especially on the part 6.2.5 Join-accept message. It is said that the join-accept message is encrypted using AES ECB. This is (...
2
votes
1answer
45 views

Attacks from releasing decrypted CCM payload before verifying tag

CCM specifies (Section 1.7) that no plaintext data should be released before the MAC is verified. Why is this recommendation given and what attacks are possible against CCM if data is treated like a ...
-4
votes
1answer
1k views

bruteforce on aes 256 cbc mode [closed]

i have a series of encrypted text , they encrypted by aes 256 bit cbc mode for every encrypted text there is an iv that i have them also and i know its algorithm is aes 256 bit cbc mode i can ...
0
votes
0answers
95 views

Why can't current quantum computers break RSA? [duplicate]

We have quantum computers and we also have Shor's algorithm. So: Why isn't RSA cracked yet? What are the current quantum computers lacking?
25
votes
6answers
4k views

Did a certain cryptography method get abandoned due to security flaws in the past?

I am researching how quantum computers affect current encryption methods (RSA and more). However, I remember learning in a course that there used to be a particular encryption method which was ...
1
vote
1answer
2k views

ECDSA non random k - Retrieve private key [closed]

At the moment I'm playing around with ECDSA. I know that I can retrieve the private key if the same K is used to sign two messages. I tried to use this script: Ruby Script to crack the private key. ...
5
votes
1answer
526 views

ECDSA key recovery - floating point values

I'm currently attempting to recover an ECDSA key. I have $m$, $m'$ and signatures $(r, s)$, $(r', s')$, and I know that $k$ is constant, the curve is NIST P-192 and the hash function of the. As such,...
1
vote
0answers
181 views

How to generate an El Gamal signature without knowing the private key x?

Let $x$ be the private key. Let $k$ be a random generated number $< p-1$, with $p$ the large prime. Let $g$ be the generator of $p$ the large prime. Let $r$ be the equality $r=g^k$ Let $m_e$ be an ...