Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

Filter by
Sorted by
Tagged with
2
votes
2answers
222 views

Is this commutative encryption protocol secure?

My assumptions are: encryption must be commutative man-in-the-middle is not an issue I would like to implement the following scheme between 2 parties ($A$ and $B$) to exchange a key: Lets $C = P \...
11
votes
1answer
659 views

Are there any practical attacks that create a printable chosen prefix MD5 collision?

I would like to create two ASCII text messages with the same MD5. Is this possible? If not, is there a similar but less strict attack that could work? Or to rephrase my last question: what are the ...
0
votes
1answer
410 views

ElGamal scheme attack when one message is known and ciphertexts are intercepted

Let $G$ be a finite cyclic group of order $p$ and let $pk = (g, h=g^a)$ and $sk=(g,a)$ be Bob's ElGamal public/secret key pair in $G$. To encrypt a message $m$, a random number $r$ is selected and a ...
1
vote
0answers
51 views

Voting protocol - How many dishonest tallying centres can the protocol cope with?

We have the voting protocol that is described here. I am looking at the following exercise: Determine how many dishonest tallying centres the protocol can cope with before the following properties ...
1
vote
0answers
101 views

Correlation attack on Lagged Fibonacci Generator

Say that one uses a known LFG (2 known lags $a$ & $b$, known inner state length $N$, known modulo $m$) to hide some text with a basic à la Vigenère cipher: $C_i=(P_i + {PRNG}_i) \bmod 26$. Say ...
3
votes
1answer
479 views

security in format preserving encryption

In format preserving encryption an attacker knows the format and data type of the plain text. The format of the plain text and cipher text are same. usually cipher text are unreadable form. then how ...
2
votes
1answer
3k views

How multiplicative property of RSA can be exploited

It is known that RSA has the multiplicative property $E(m_1) \cdot E(m_2) = E(m_1 \cdot m_2)$ because $m_1^e \cdot m_2^e = (m_1 \cdot m_2)^e \pmod n$ But how can this property be used to break ...
0
votes
1answer
87 views

Identification by RSA

Suppose we have identification scheme as such: Bob takes random $r$, and encrypts it with Alices public RSA key $(n,e)$, sends $r^e$ to Alice. Alice decrypts $r$ and sends it back to Bob, becomes ...
1
vote
1answer
824 views

Key Confirmation Attack [Key Distribution Center (KDC)]

Okay this is how I understood it according to this: Alice $A$ establishes a connection to $KDC$ and prepares for session key Exchange $k_{ses}$ $A$ encrypts the request with her key $k_A(A, B)$ ...
5
votes
0answers
311 views

Statistical saturation attack on block ciphers

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack against the Block Cipher ...
1
vote
1answer
276 views

RSA padding confusion attacks

Server A produces signed messages on request. You can tell server A what type of RSA padding to use in the signature (either RSASSA-PKCS1v1_5 or RSASSA-PSS). Either way, the message will be signed ...
0
votes
1answer
869 views

Fault encryption attack on RSA [duplicate]

How to recover plaintext, if we know public key(RSA), correctly encrypted text and text encrypted with faulty public key, where one bit is changed?
2
votes
3answers
2k views

When is a cipher considered broken?

We've all read how some people claim AES is broken because there was supposedly a way to get the plain text from a cipher text faster than brute-force. But is this the definition? Is a cipher broken ...
4
votes
1answer
287 views

AES as Integer Program

I read that AES can be broken by solving a Linear Integer Program (IP). From a given encrypted text, how can one construct this IP? How big is the system?
2
votes
1answer
134 views

What aspect of elliptic curve encryption paradigms makes them especially susceptible to quantum based attack algorithms?

This was a statement made during a talk at today's DFN-CERT conference but unfortunately it wasn't explained further. Can anyone shed light on why elliptic curves are susceptible to quantum based ...
-1
votes
1answer
157 views

Attacking multi block MAC constructions

For variable-length messages, there are three different ways to generate the tags. $Tag = MAC_k(\Sigma_i m_i)$. $t_i = MAC_k(m_i)$ and $Tag = (t_1, ..., t_l)$. $t_i = MAC_k(i||m_i)$ where $...
0
votes
1answer
169 views

RSA: How effective is this keypair-trash attack [duplicate]

A question that could very well be part of xkcd's "what if?": Let's say Monica made a piece of software that sends all RSA keypairs to a central database after they're not used anymore. Something ...
3
votes
0answers
102 views

Pollard's Rho - Restricting the random function to the exponents

Pollard's Rho is usually constructed using a function $f:G \rightarrow G$ which behaves 'random enough' in order to detect a collision with Floyd's cycle detection trick. It is easy enough to observe, ...
1
vote
1answer
56 views

Can one deduce the symmetric key size used to encrypt a given a piece of ciphertext?

Assume an attacker captures a piece of ciphertext encrypted with a symmetric key. He knows all the details of the algorithm used to encrypt except for the size of the key used in this case. Can he ...
9
votes
3answers
2k views

SHA-1 collisions - what about practical attacks?

I understand the theoretical problem with hash collision but when it comes to practice, I get very confused. Suppose a attacker would like to forge a certificate (or any kind of structured piece of ...
3
votes
0answers
204 views

Timing Attack on OpenSSL by Brumley

I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003). In this paper on page 4, Brumley ...
3
votes
2answers
349 views

What, cryptographically speaking, is a “long message”?

I have read about long message attacks on some cryptographic hash functions. However, I don't quite understand what is being referred to as a "long message". Also, do long message attacks only apply ...
2
votes
1answer
814 views

What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?

This page on Twist security mentions a combined attack and a twist rho attack, applicable in particular to NIST P-224 curve with cost $2^{58.4}$ something, with no mention precise definition of ...
7
votes
1answer
1k views

Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
3
votes
1answer
4k views

A simple attack on DESX in time $2^{120}$ [duplicate]

Let $\mathcal{M}$ be our message space and $\mathcal{K}$ our key space. Now, let $\mathrm{E} : \mathcal{K} \times \mathcal{M} \to \mathcal{M}$ be a block cipher. Define the block cipher $\mathrm{EX}((...
1
vote
1answer
403 views

RSA CRT modulo reduction

I am working on RSA CRT and there is a point that I don't understand : So we have $n=pq$ and $c = m^e \bmod n$ an encrypted message. To decrypt $c$ with RSA CRT, we have to compute : $d_p = d \bmod ...
0
votes
1answer
3k views

Possible Digital Signature Hack?

I am starting to learn more about cryptography and I just read more about how asymmetric keys can make a digital certificate, and I would like if someone could explain me why the following case can't ...
3
votes
0answers
125 views

Implementation Attacks on Hashes

So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc. What implementation attacks are there against hashes or hashed based functions (...
4
votes
1answer
2k views

Is there a generic attack on encrypted CRC32 when used as a MAC?

I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break. The ...
1
vote
0answers
128 views

Attacks on Full TripleDES [closed]

I have been reading about attacks and many of them work on specific rounds of TripleDES but not on full TripleDES. Is there any attack except brute force that works on full TripleDES? (theoretical)
2
votes
0answers
158 views

RSA: Common modulus attack problem [duplicate]

I understand in theory how the common modulus attack works (as described here: how to use common modulus attack?) Though, I did not understand completely how it worked with a negative $s_i$. Since $...
4
votes
2answers
298 views

Basic attacks on McEliece; finding S and P

Take a McEliece cryptosystem with public generator matrix $G' = S G P$ where $G$ is a generator of a secret code with known fast decoding (not necessarily a Goppa code over $\mathbb{F}_2$), $S$ is ...
1
vote
1answer
1k views

AES CBC MAC splicing attack

I'm trying to implement AES CBC MAC splicing attack in Python, the idea is: given a message M, its tag Tm (MAC(M) = T), a new message N and its tag Tn we build a message such as: M||N = (M1, ..., Mn, ...
5
votes
1answer
563 views

Are RSA or ECC vulnerable to an attack where the same (unknown) plaintext is encrypted with multiple public keys?

I'm not sure what this attack model is called - it's not known-plaintext and also not quite cipher-text-only. It is similar to this question except the general case (not just two keys) and using keys ...
4
votes
1answer
3k views

SHA-256 Partial Collision of initial 36 bits and more

I was lucky enough to, by brute force, have found two different messages, whose SHA-256 hashes collide in the first 9 hexadecimal characters, which are 36 bits, let'...
11
votes
1answer
251 views

What informal indicators exist for estimating the computational infeasibility of cryptographic problems?

When assuming a block cipher primitive is secure, or a number theoretic problem is hard, this assumption is usually based on how far we are from breaking the primitive or solving the problem using ...
1
vote
1answer
93 views

Necessity of changing $p$ and $q$ when your private key is exposed?

Suppose your private key $d_1$ has been exposed. Instead of changing $p$ and $q$, instead you just choose a new public and private key (say $e_2$ and $d_2$) and use these instead. What kinds of ...
9
votes
1answer
3k views

Is MD5 second-preimage resistant when used only on FIXED length messages?

I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient. I have read a lot about MD5 security for this ...
15
votes
1answer
14k views

The difference between these 4 breaking Cipher techniques?

I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ...
5
votes
1answer
164 views

Has a Two Key TDES encryption ever been successfully attacked?

Is there any known instance of a Two Key TDES ever being successfully attacked (in real life), when the key is used to encrypt less than $2^{20}$ words?
12
votes
2answers
2k views

How can I implement the elliptic curve MOV attack myself?

I understand and have implemented elliptic curve signatures in Python without the use of libraries like Sage, and would like to implement the MOV attack against certain weak types of elliptic curves. ...
2
votes
1answer
352 views

Elliptic curve cryptography attack vector

I would expect a complicated answer for what seems like a simple question about Elliptic curve cryptography. I've read several entries here such as "Elliptic curve cryptography related key attacks" ...
6
votes
1answer
628 views

Difference between actual attacks and theoretical attacks on SHA cryptographic series

Could anyone tell me what the difference is between a theoretical attack (Like the one done on SHA-1) and an actual, practical attack (Like the one done on SHA-0)? Is a theoretical attack a proposed ...
4
votes
0answers
343 views

How hard is a known prefix hash preimage attack on SHA-2?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...