Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

Filter by
Sorted by
Tagged with
30 votes
1 answer
5k views

How was this 2048 bit number factored so fast?

I'm working on a CTF. The challenge is to get the contents of an encrypted message given the ciphertext and the 2048-bit RSA public key. I did finally get the flag after a few hours, but I'm still not ...
rainbowkitty227's user avatar
26 votes
6 answers
4k views

Did a certain cryptography method get abandoned due to security flaws in the past?

I am researching how quantum computers affect current encryption methods (RSA and more). However, I remember learning in a course that there used to be a particular encryption method which was ...
Kevin Van Ryckegem's user avatar
26 votes
7 answers
5k views

Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?

Are there moderns (post World War II) and famous protocols that were proven secure (in any model: game-based, UC...) but whose proof was wrong and could have led to real-world attacks? Note that: I'm ...
Léo Colisson's user avatar
19 votes
2 answers
5k views

How is encryption broken today?

There are often articles in the news that state that a certain country or hacker has been able to decrypt/hack highly protected systems: Some examples are the Lockheed Martin RQ-170 Sentinel that was ...
Quasar's user avatar
  • 301
18 votes
1 answer
2k views

What does a "real" quantum computer need for cryptanalysis and/or cryptographic attack purposes?

The cryptographic world has been buzzing the word "quantum" for a while now (even the NSA is currently preparing itself for a post-quantum crypto world) and quantum-related hardware engineering is ...
e-sushi's user avatar
  • 17.9k
18 votes
0 answers
495 views

The aftermath and considerations of the new record of 30750-Bit Binary Field Discrete Logarithm - 2020

Granger et al. recently published a paper about breaking a record for discrete logarithm on the Binary field Computation of a 30 750-Bit Binary Field Discrete Logarithm, Robert Granger and Thorsten ...
kelalaka's user avatar
  • 48.3k
17 votes
4 answers
14k views

How can C rand() be exploited if a secure seed is used?

I've just started doing a research project on CSPRNGs and I would like to know what kind of vulnerabilities a regular PRNG has with a secure seed. For example, if I generate a random number using ...
Jacob H's user avatar
  • 364
17 votes
1 answer
19k views

The difference between these 4 breaking Cipher techniques?

I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ...
Scarl's user avatar
  • 445
14 votes
1 answer
5k views

Why "1" in 51% attack on Blockchain network

In many sources, included Wikipedia, we read: Any pool that achieves 51% hashing power can effectively overturn network transactions, resulting in double-spending. My question is: Why do we talk ...
Manu NALEPA's user avatar
13 votes
1 answer
3k views

Cracking a PRNG by observing ranks within groups of its output

Suppose that I am generating random numbers with Python's random module, so that there is a known random number generator (Mersenne Twister in this case). I've ...
dcc310's user avatar
  • 273
12 votes
5 answers
2k views

What is the malicious potential of a key-substitution-attack?

What is the idea behind a key-substitution-attack? We start from a given pair of message $m$ and signature $s(m)$. The signature can be verified by anybody in possess of the public key $y$: $v(m, s, ...
MichaelW's user avatar
  • 1,497
12 votes
2 answers
3k views

How can I implement the elliptic curve MOV attack myself?

I understand and have implemented elliptic curve signatures in Python without the use of libraries like Sage, and would like to implement the MOV attack against certain weak types of elliptic curves. ...
Myria's user avatar
  • 121
12 votes
1 answer
349 views

Why doesn't Wang's attack work on SHA-1?

Wang's (et al) differential attack works on MD5, MD4, RIPEMD and HAVAL. Why doesn't it work on SHA-1?
Peppina's user avatar
  • 121
11 votes
1 answer
4k views

Is MD5 second-preimage resistant when used only on FIXED length messages?

I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient. I have read a lot about MD5 security for this ...
jcea's user avatar
  • 343
11 votes
1 answer
2k views

Relation between attack and attack model for signatures

What is the relationship between an attack and an attack model? For example, let $\Pi$ be the Lamport signature scheme. This signature has its security based on any one-way function. The Grover ...
juaninf's user avatar
  • 2,671
11 votes
2 answers
3k views

In textbook RSA with low public exponent, how big does a random message needs to be?

Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
fgrieu's user avatar
  • 140k
11 votes
1 answer
335 views

What informal indicators exist for estimating the computational infeasibility of cryptographic problems?

When assuming a block cipher primitive is secure, or a number theoretic problem is hard, this assumption is usually based on how far we are from breaking the primitive or solving the problem using ...
Henrick Hellström's user avatar
11 votes
1 answer
1k views

Are there any practical attacks that create a printable chosen prefix MD5 collision?

I would like to create two ASCII text messages with the same MD5. Is this possible? If not, is there a similar but less strict attack that could work? Or to rephrase my last question: what are the ...
user25418's user avatar
  • 111
10 votes
2 answers
814 views

Which attacks are possible against raw/textbook NTRU encryption?

In the same fashion that these questions about attacks to textbook RSA and ECC, I was wondering what are the immediate drawbacks of applying NTRU Encryption directly, without any padding scheme, such ...
cygnusv's user avatar
  • 4,952
9 votes
3 answers
17k views

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? If, how big does the list of plaintext ...
Richard Jones's user avatar
9 votes
2 answers
3k views

What is a multi-target attack?

What exactly is a multi-target attack? How does the attack work on different cryptographic schemes (block ciphers, hash functions, elliptic curves)? How can it be avoided?
Conrado's user avatar
  • 6,414
9 votes
2 answers
3k views

Is there a downside to encrypting too much data with the same key?

Is there a downside to encrypting too much data? If so, what? I'm guessing things like too much data encrypted with the same key, possibly leaking information due to a collision encrypting non-...
Filip Haglund's user avatar
9 votes
3 answers
3k views

SHA-1 collisions - what about practical attacks?

I understand the theoretical problem with hash collision but when it comes to practice, I get very confused. Suppose a attacker would like to forge a certificate (or any kind of structured piece of ...
crypto-learner's user avatar
9 votes
1 answer
1k views

Does blinding work against side channel on RSA?

In the so called "blinding" technique for RSA, prior to decryption, the ciphertext is multiplied by random $r$ raised to the power of $e$; e.g., $C$ is replaced with $C\cdot r^e$; and then after ...
Evgeni Vaknin's user avatar
9 votes
1 answer
3k views

How can I attack a Triple-Block cipher with 2 keys (like 3DES) with a cost of ≤ 2⁵⁶

I am trying to solve something and I have but I have no idea anymore. Maybe anyone of you has an idea/solution/hint. Given is a block cipher $F$ with key length $n$. It looks like this: $$c = ENC_{k1}...
Donut's user avatar
  • 395
9 votes
1 answer
585 views

Are there any long term RC4 bias based exploits?

The RC4 cipher possibly exhibits low level bias in it's long run PRNG keystream. I'm specifically excluding short term bias attacks which I'm defining as outputs < 1024 bytes. Are there any real ...
Paul Uszak's user avatar
  • 15.3k
9 votes
1 answer
3k views

Algorithm for Boneh and Durfee attack on RSA

I am trying to understand various attacks on RSA and I believe that they only way to fully understand the algorithm is to implement it. I am trying to implement the code in this paper (pdf) (Private ...
Node.JS's user avatar
  • 312
9 votes
1 answer
735 views

Bleichenbacher RSA1024 signature forgery, closed-form solution

Hal Finney's writeup (Bleichenbacher's RSA signature forgery based on implementation error) shows a formula for RSA3072. I tried to replicate the attack for RSA1024 and failed, since the first term of ...
0x00's user avatar
  • 407
8 votes
1 answer
623 views

What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...
e-sushi's user avatar
  • 17.9k
8 votes
5 answers
2k views

Does frequent key change weaken encryption?

Following scenario: We are using OTR for communication between Alice and Bob which means after each successfull message exchange a re-keying happens for both parties leading to new AES-keys for the ...
Spyro's user avatar
  • 131
8 votes
1 answer
3k views

Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
Ruggero's user avatar
  • 7,014
8 votes
1 answer
958 views

How does the sponge construction avoid the weaknesses present in Merkle–Damgård hash function?

How are the weaknesses of the Merkle–Damgård construction (i.e. the Herding attack, multicollisions, length extension, expandable messages) avoided in the sponge construction?
user47987's user avatar
8 votes
1 answer
213 views

How complex must round constants be to resist slide attacks?

A key schedule that generates round keys by XORing a round constant with the key is linear and can be vulnerable to related key attacks, but let's ignore that for now. Constants are necessary to avoid ...
forest's user avatar
  • 15.2k
7 votes
2 answers
2k views

Is there a complete summarized list of attacks on Diffie-Hellman?

Is there a complete summarized list of attacks on Diffie-Hellman? For RSA, there is this paper by Boneh, so I was wondering whether there is such a list for attacks on DHKE. I have been looking ...
Michael Blane's user avatar
7 votes
1 answer
2k views

How does the ROCA attack work?

I have been trying to understand the ROCA attack described here as the "First Attack" and I cannot follow the explaination. I have been trying to generate a 512-bits key and crack it. As far as I can ...
John's user avatar
  • 71
7 votes
1 answer
1k views

Is the RSA signature attack from Desmedt and Odlyzko practical?

I would like to understand how the attack from the Desmedt and Odlyzko on RSA signatures (and subsequents works) can be made practical. This attack describes a way to forge the signature on a new ...
Dingo13's user avatar
  • 2,847
7 votes
2 answers
2k views

Is there a feasible preimage attack for any hash function (no matter how deprecated) today?

Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack? All hashes that are nowadays considered 'broken' (...
RocketNuts's user avatar
  • 1,397
7 votes
1 answer
585 views

Why does the Bombe not consider the Ringstellung when determining stecker pairs?

I am doing research on the Bombe Machine, and I read that when the Bombe tries to find the stecker (plugboard) partners of letters, it only needs to use the rotor types and arrangement and also the "...
Queso Pez's user avatar
  • 301
7 votes
2 answers
1k views

What are the implications of a birthday attack on a HMAC?

After collecting approximately $2^{n/2}$ message-tag pairs a collision can be observed. So two different messages (m1 and m2) will have the same tag. This paper states: Then, for any string x, (...
Logan's user avatar
  • 161
7 votes
1 answer
417 views

How safe is a prime with $P=2 \cdot Q \cdot R \cdot S \cdot t+1$ for discrete logarithm? How to enhance/compare?

To get some certain properties for my use case I need a prime $P$ which has the form: $P=2\cdot Q \cdot R \cdot S \cdot t+1$ with $Q,R,S,t$ primes as well. Why that form - Use case Together with ...
J. Doe's user avatar
  • 573
6 votes
3 answers
2k views

What are the dangers of using CPU clock drift for generating random data?

From what I understand, a physical source of true randomness could be achieved with a multi-core processor, by using clock drift between two or more cores. However, a processor is easier to ...
dt_slash's user avatar
  • 105
6 votes
2 answers
425 views

Examples of Weak Cryptography being exploited in the wild by cybercriminals?

As a theorist, I often motivate the need for strong cryptography via simplistic methods, such as "If this did not exist, your online bank transactions would be vulnerable". This is of course ...
Mark's user avatar
  • 12.5k
6 votes
1 answer
787 views

Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password?

A malicious actor wants to decrypt ciphertext that was encrypted with a password. He also possesses the hash (bcrypt/PBKDF2) of that password. Does he have any significant practical advantage in ...
OwenFlanders's user avatar
6 votes
1 answer
573 views

What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI

What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI (Crypt32.dll) Could someone provide details?
kelalaka's user avatar
  • 48.3k
6 votes
1 answer
3k views

RSA attack with continued fractions (Wieners attack)

I found an article on the internet about an RSA attack with continued fractions. Given are the following numbers: $n = 205320043521075746592613$ $e = 70760135995620281241019$ $\frac{e}{n}=[0;2,1,...
WinstonCherf's user avatar
6 votes
1 answer
688 views

Can iterated hashing be used to mitigate collision and preimage weaknesses?

How much security does double hashing add regarding collisions and preimages? Is it helpful to iterate a hash function even more times than two? For example, can MD5 be fixed (in practice) by ...
boot4life's user avatar
  • 163
6 votes
1 answer
178 views

Has a Two Key TDES encryption ever been successfully attacked?

Is there any known instance of a Two Key TDES ever being successfully attacked (in real life), when the key is used to encrypt less than $2^{20}$ words?
user11123's user avatar
6 votes
1 answer
1k views

Iterations of pollards kangaroo attack on elliptic curves

I want to understand the Pollard kangaroo attack on elliptic curves. I found this Pollard's kangaroo attack on Elliptic Curve Groups Q/A pretty helpful, but not complete. The posts provides a pretty ...
Titanlord's user avatar
  • 2,234
6 votes
1 answer
783 views

Difference between actual attacks and theoretical attacks on SHA cryptographic series

Could anyone tell me what the difference is between a theoretical attack (Like the one done on SHA-1) and an actual, practical attack (Like the one done on SHA-0)? Is a theoretical attack a proposed ...
Thomas Gouder's user avatar
6 votes
0 answers
130 views

About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?

Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$ with $$p=(p_1, p_2)$$ $$q=(q_1,q_2)$$ $$p_1,q_1 \in [0,s)$$ $$p_2,q_2 \in [0,s^2)$$ We want to find a path in between ...
J. Doe's user avatar
  • 573

1
2 3 4 5
9