# Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

465 questions
Filter by
Sorted by
Tagged with
264 views

### Attacks exploiting decryption failures in KYBER

I am going through the portion mentioned under the heading Original KYBER analysis inside Section 5.5 titled Attacks exploiting decryption failures. {\sf Pr}[\|v\|> k\sigma \sqrt{m}]< k^m e^{\...
18k views

### Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? If, how big does the list of plaintext ...
80 views

### Vulnerabilities of a word-level substitution cipher

What kind of attacks would be possible against this kind of substitution cipher? Every word in the plaintext is to be replaced with a random string of the same length The encryption of any given word ...
1 vote
100 views

### What's the difference between these two attacks?(Lim Lee and Sub group) I am a beginner can someone explain in detail?

I am reading collin boyd textbook to learn MTI key agreement and various attacks on them . I encountered two such attacks called Small sub group attack and Lim-Lee attack where in Small sub group ...
56 views

### Is EC_POINT_is_on_curve a necessary check when using EC_POINT_mul in openssl?

I'm using EC_POINT_mul in OpenSSL, and I would like to avoid an invalid curve attack. I can see that there is a check for ...
114 views

### How to find N and e knowing that e = p and N = p*q?

I've been stuck in this problem for a while, this is a challenge about Symmetric RSA: We know that $N = p*q$ $e = p$ $ct = pt^p \bmod N$ (1) We are given $ct$ (which is the flag encrypted) and 4 ...
55 views

...
183 views

1 vote
101 views

### Is it possible to break a DSA with k that increases statically?

I am currently studying cryptography. I came across this problem: I had an exercise that as a vulnerability had that k is generated every 10 seconds: ...
689 views

### Is NTRU broken?

Today a new paper appeared on ePrint, "Improved Provable Reduction of NTRU and Hypercubic Lattices". It claims that: this is the first provable result showing that breaking NTRU lattices ...
1 vote
54 views

### Differential uniformity of vectorial Boolean function

What could we say about differential uniformity of (a vectorial Boolean function) $F = f+g \pmod 2$ (i.e. XOR) in terms of differential uniformity of $f$ and $g$?
1 vote
69 views

### I do not understand the result of 'proposition 2' of "MDx-MAC and building fast MACs from hash functions"

I saw the difference between the proof and the statement of "proposition 2" in the paper "MDx-MAC and building fast MACs from hash functions" by Bart Preneel & Paul C. van ...
1 vote
281 views

### Need help with Cryptohack's ProSign 3 ECDSA problem [closed]

I'm trying to solve the CTF challenge called ProSign 3 at Cryptohack platform which involves exploiting an ECDSA signing service that allows us to sign a fixed message being padded with the time ... ...
1 vote
101 views

### Security of $E(c,k) = AES(c,(k \oplus c)\cdot (2^{n} - 1 - c))$ used multiple times with low bit keys $k$. Avoids MitmA?

More precisely the Encryption function will be $E(c_i,k_i,i)$ with a 128-bit cipher/number $c_i$, a 16-bit encryption key $k_i$ and a 8-bit index $i$ as input using a Xor key obfuscation $k'$ with ...
74 views

### Reaching the bound of Boneh and Durfee Attack

According to the paper, theoretically,we can get $\delta=0.292 \lt 1-\frac{1}{\sqrt{2}}$,but how to set the lattice and implement it in sagemath? I generated some data by ...
667 views

### RSA decrypt using Openssl error : Public Key operation error

Hello im got stuck at ctf crypto challenge, so at the challenge is given 3 file which is flag.enc pub.key priv.key , so i tried to decrypt using openssl here is ...
93 views

### Small subgroup attack when using a Schnorr group for DHKE

One uses a Schnorr group both for Schnorr signature (or DSA), and for Diffie-Hellman Key Exchange. They target 128-bit security, and choose prime $q$ that's 256-bit, prime $p=q\,r+1$ that's 3072-bit, ...
1 vote
247 views

### Help with HMAC Known plaintext / mac puzzle

Finally caving and asking for help...I'm not in the field, just doing random CTF challenges to learn more and I've really been enjoying it in general. However, I'm totally stuck on this puzzle at the ...
1 vote
262 views

### Decentralized identity, how to prevent duplicate uses of the same identity

In a system that relies on decentralized identity, is it possible to prevent duplicate uses of the same real-life identity, i.e. same real-life person creates more than one user entity (each is ...
54 views

### What does it mean the "Distinguisher" in LWE decision version?

As we know in block ciphers, the distinguisher means that despite thousands ciphertexts (and plaintexts), allows an attacker to distinguish the encrypted data from random data. This attack is ...
1 vote
145 views

### Different public keys $(e_i,N_i)$ but same decryption exponent $d$

We are given a number of distinct RSA public keys $(e_i,N_i)$ sharing the same unknown decryption exponent $d$. The $e_i$ were computed from $d$ drawn first, so we have different public keys. Can we ...
105 views

### Breaking a 'Many' - Time Pad [closed]

I'm working on a problem, where given 12 ciphertexts, I'm trying to decode the 12th and find out the key. I've implemented a crib dragging attack, where the crib is a purely guessed word (not known/...
103 views

### Algorithm attack on an hash attack (Python)

Here is an attempt at a Python implementation of what is described in the paper I attached as an image. The algorithm is too slow or there is something wrong with the code. Any ideas! ...
1 vote
156 views

### How to achieve $d-$privacy considering some secrets?

We have a set of secrets $S = \{x_1, x_2, \dots, x_n\}$ known to an adversary. Each $x_i \in S$ belongs to user $u_i$ who needs to obfuscate his secret using the notion of $d-$privacy defined in the ...
1 vote
94 views

119 views

### Nonce reuse in GMAC without ciphertext (only AAD)

As we all know, nonce reuse in AES/GCM can easily be catastrophic. However, I'm wondering if the same risks are present if an adversary has access to: Ciphertext and corresponding MAC of one message ...
314 views

187 views

### A question about "attacks on MAC key space"

At page 336 in "Handbook of Applied Cryptography - Menezes", I see the sentence For $n$-bit MAC with $t$-bit key space this requires $2^t$ MAC operations, after which one expects \$1+2^{(t-n)...
1 vote
784 views

### A RSA crypto CTF chanllenge with known private key ,cipher text and modules factor n

Here is a CTF chanllege about RSA(The competition has ended for serval hours),and here is the critical encryption code: ...
36 views

### How by changing ciphertext can the attacker know the length of the padding in POODLE attack

I try to understand the POODLE attack. I read that the attacker try to change one byte of the last block of the ciphertext. Becasue the last block is only have padding and the last byte is the padding ...
1 vote
33 views

### Can an attacker impersonate any party in a modified Needham-Schroeder protocol?

We are doing symmetric Needham-Schroeder protocol in university. We were provided a modified protocol and needed to answer the following questions. Original protocol: Modified protocol: Task a) An ...
79 views

### how 0/n split prevent BEAST attack against TLS?

I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way? ...
2k views

### RSA Oracle - CTF

I am trying to solve a challenge regarding a RSA oracle which allows me to encrypt/decrypt any plaintext/ciphertext I want, but there are a few checks that I have to bypass, and my goal is to decrypt ...
1k views

### CTF - DES Challenge

I am trying to solve a CTF challenge based on DES. I attached the code of the challenge to the question. So far I have noticed that the otp used for the encryption is the same for the entire session, ...
2k views

### AES CBC - Find IV (CTF)

I am currently trying to solve a training challenge based on AES with CBC. This is the infos I'm given: ...