Questions tagged [attack]
A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.
323
questions
0
votes
1answer
15 views
Why is $\phi(N) = (p^2 -1) (q^2 - 1)$ here?
I was reading a paper on attacks on RSA variants, and the paper equates $\phi(N) = (p^2-1)(q^2-1)$. Before, I have always seen $\phi(N) = (p-1)(q-1)$ and don't understand why it is different here.
I ...
1
vote
2answers
172 views
Is it possible to unscramble a scrambled ed25519 SSH key?
Let's say I generate an ed25519 SSH key with ssh-keygen -t ed25519. Then I take the private key file and randomly scramble the order of base64 encoded characters. ...
3
votes
1answer
71 views
What is the largest parameter broken for NTRU?
The original secure parameters for NTRU shown below are from the original HPS98 paper. This is vastly different from the current secure suggested parameters in the NIST PQC round 3 submission.
...
4
votes
1answer
105 views
Is there any correlation in between two AES with a key differ only by one bit? (ECB mode)
Given two AES (128bit, ECB mode) with almost equal keys $k_1,k_2$: 127 of the 128 key bits are equal. Is there any correlation in between the ciphers they build?
$$AES_1(m_i) = c_i$$
$$AES_2(m_i) = ...
2
votes
1answer
64 views
basic question regarding two-time pad attack
Dan Boneh's Crypto 1 Course includes a lesson on stream ciphers with the following slide:
He asks the question:
And the answer he gives is $m \oplus p$, which is why this is insecure.
But I don't ...
2
votes
2answers
94 views
In which case number field sieve/index calculus is faster for solving discrete logarithm?
Given the normal discrete logarithm problem:
$$a = b^c \mod{P}$$
with prime $P$ and numbers $a,b,c$
For which kind of $P,b$ the NFS/IC algorithm is faster than Baby-Step/Giant-Step+ Pollard's Rho ($\...
5
votes
1answer
750 views
Is there a feasible preimage attack for any hash function (no matter how deprecated) today?
Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack?
All hashes that are nowadays considered 'broken' (...
1
vote
2answers
112 views
Who provides prime numbers for cryptographic protocols?
I am currently writing a thesis about different cryptographic protocols like DH-Key exchange, TLS or IKE.
Most of them rely on a prime number earlier or later, so for security reasons I wondered if ...
7
votes
1answer
151 views
How complex must round constants be to resist slide attacks?
A key schedule that generates round keys by XORing a round constant with the key is linear and can be vulnerable to related key attacks, but let's ignore that for now. Constants are necessary to avoid ...
9
votes
1answer
737 views
Does blinding work against side channel on RSA?
In the so called "blinding" technique for RSA, prior to decryption, the ciphertext is multiplied by random $r$ raised to the power of $e$; e.g., $C$ is replaced with $C\cdot r^e$; and then after ...
1
vote
2answers
1k views
Difference between eavesdropping and traffic analysis
I was wondering what is the conceptual difference between these two passive attacks on a network. I was reading about them on Wikipedia and they seem quite similar to me. Is there a difference?
11
votes
1answer
2k views
Relation between attack and attack model for signatures
What is the relationship between an attack and an attack model?
For example, let $\Pi$ be the Lamport signature scheme. This signature has its security based on any one-way function. The Grover ...
2
votes
1answer
52 views
Does Hinek and Lam's Paper prove that Common Modulus Attacks is possible with non-coprime public exponents?
We know that Common Modulus Attacks work with coprime public exponents $(e',s)$ such that $${e_1}s+{e_2}t=\gcd(e_1,e_2)=1$$
I am reading Hinek and Lam's Paper: Common Modulus Attacks on Small Private ...
0
votes
2answers
90 views
How is asymmetric cryptography safe if one of the keys is public?
Let's suppose $A$ is sending a message $m$ to $B$ using asymmetric cryptography.
To guarantee the authenticity of a message, $A$ encrypts $m$ with $A$'s private key: $E(m, k_A) = m_A$.
Then, $A$ ...
1
vote
1answer
221 views
What is definition of “adversary”? And what do they do?
Currently I am writing my last assignment about secret sharing. But I don't clearly understand adversary. I know this is a fundamental concept in secret sharing. But I couldn't find references that ...
1
vote
1answer
63 views
Inside attack (attack from participants) in secret sharing
I have considered a $(t,n)$ secret sharing scheme with $n$ secret, say $a1,a2....an$. It's third party secure, but it has inside adversaries. While reconstructing secrets, a group of $t$ qualified ...
1
vote
1answer
93 views
Finding the private key for this signature scheme
Assume the signature scheme where $x$ is the private key and the public key $y = g^x \pmod{p}$. The signature works as:
Choose $h \in \{0, \dots, p-2 \}$ s.t.: $\mathcal{H}(m) + x + h \equiv 0 \pmod{...
2
votes
2answers
361 views
How to prove that a rainbow table is complete?
Passwords that are hashed but not salted can be cracked using the rainbow table. I went through this and this which explains the logic behind rainbow table very well.
But I am missing something about ...
2
votes
1answer
255 views
Short padding + known prefix RSA attack
Suppose I have a message in the form of:
$m = \text{prefix} \mathbin\| \text{secret} \mathbin\| \text{padding}$
We have:
$e=3$
$n$
$n_\text{padding}$ (length of the random padding, <$1/4$ of $m$)...
1
vote
0answers
36 views
Attacks on LWE when q is a power of 2
I am working on an LWE instance where q is a power of 2 and I'm wondering if there is any literature about attacks in this context, especially if there are any attacks which work significantly better. ...
0
votes
1answer
99 views
Is there a problem with this specific RSA protocol?
So a protocol uses two random primes $P$ and $Q$ with the equivalent bit length of around 2048 bits, multiplies to form $N$. The encryption function in detail is:
$m^e \bmod\ N$
$(\text{512-bit-random-...
2
votes
1answer
54 views
How to attack Oblivious Transfer from a malicious sender that can deviate from the protocol
I am looking at at the $1–2 \space \text{oblivious transfer}$ that is described here: https://en.wikipedia.org/wiki/Oblivious_transfer#:~:text=In%20cryptography%2C%20an%20oblivious%20transfer,Rabin.
I ...
0
votes
0answers
39 views
Complete crypto attack explanation or hierarchy including statistical attack, entropy attack, correlation attack, differential attack?
How exactly statistical attack(resistancy tested using histogram analysis), entropy attack(resistancy tested using entropy information), correlation attack(resistancy tested using correlation ...
0
votes
0answers
49 views
Known attacks against ECC in case many multiples are known?
Suppose there's a secret value x, an elliptic curve with the (public) generator G, and a sequence of secret values ...
5
votes
2answers
1k views
Can I alter encrypted data without decrypting it?
I didn't find a direct solution for it. Can I modify encrypted data without accessing it?
If there is an example, I would appreciate it.
1
vote
1answer
49 views
AES 5 and 6 round SQUARE Attack
SQUARE attack on AES128 requires a single delta set for 4-round variant, or I assume single delta set is enough since keyspace is reduced to few keys which can be easily brute-forced. However, as we ...
2
votes
2answers
119 views
Is there a term for cryptographic attacks where you can verify decryption without assuming any known structure on the plaintext?
The questions https://security.stackexchange.com/questions/1696/if-someone-breaks-encryption-how-do-they-know-theyre-successful and https://security.stackexchange.com/questions/119887/how-to-know-if-a-...
4
votes
0answers
51 views
On the current memory retain limits for the coldboot attack (2020)
ColdBoot attack is introduced by Halderman et. al in 2009
Lest we remember: cold-boot attacks on encryption keys
In their articles, they represent experimented that
We found that the dimensions of ...
5
votes
2answers
431 views
What are the current known weaknesses/attacks on quantum key distribution?
I am writing a paper on the implementation of QKD in the future. I want to know if there are any viable attacks on the BB84 protocol or QKD in general? I know of the Photon Number Splitting attack or ...
1
vote
0answers
16 views
Are there any mutual-distance bounding protocols in RFID context?
Distance-bounding algorithms are a classical solution for the Relay Attack, wherein a verifier can determine an upper bound on its distance from the prover.
However, recent literature is discussing ...
0
votes
0answers
29 views
Boomerang attack - looking for simply explanation
Can someone explain to me in a simple way how it works?
I know what differential cryptoanalysis is, but my knowledge is rather amateur. Nevertheless, reading the post on Wikipedia:Boomerang Attack I ...
1
vote
1answer
166 views
Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)
When you know the Salsa20's keystream, how do you know the next keystream?
In other words, can I infer the next keystream when I don't know the Key and IV of Salsa20, but the keystream is ...
1
vote
2answers
233 views
Adversary for attack on one variant of ElGamal
I came by the following question:
Consider the following variant of ElGamal encryption. Let $p= 2q+ 1$,
let $G$ be the group of squares modulo $p$ so $G$ is a subgroup of
$Z_p^*$ of order $q$, and ...
0
votes
1answer
67 views
Proof by reduction for for digital signature scheme $S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$
Let $(Gen,S,V)$ be a secure signature scheme (existentially unforgeable under a chosen message attack) with message space${\{0,1\}}^n$. Generate two signing/verification key ...
1
vote
1answer
73 views
Which RSA keys are actually attacked In practice?
I understand that it is important to check how hard it is to attack RSA keys, but I assume at some key size attackers would not even try. Real attacks are carried out by exploiting mistakes in the ...
Gilles 'SO- stop being evil'
14k3 gold badges38 silver badges73 bronze badges
0
votes
1answer
62 views
Security of a custom AES-based attack model
Provided that:
$AES(plaintext, key)$ is the standard AES block cipher for a 128 bits block.
$\oplus$ is the standard XOR operation.
$K$ is a constant 128 bits pseudorandom value, which is used as the ...
1
vote
0answers
71 views
0
votes
1answer
70 views
May an adversary be fooled by a random-looking input that in reality is fixed?
I want to prove the EUF-CMA-security of a signature scheme. It is a variation on an established scheme, therefore I would ideally like to reduce the new-scheme-security to the old-scheme-security.
the ...
1
vote
1answer
64 views
When attacking keyed algorithms, how is it known when the output is correct?
I've been reading a little bit about cryptanalysis, and I'm wondering how attacking algorithms that work on keys is performed.
It's obvious how algorithms like MD5 are attacked, in pseudocode:
...
14
votes
0answers
201 views
The aftermath and considerations of the new record of 30750-Bit Binary Field Discrete Logarithm - 2020
Granger et al. recently published a paper about breaking a record for discrete logarithm on the Binary field
Computation of a 30 750-Bit Binary Field Discrete Logarithm, Robert Granger and Thorsten ...
1
vote
1answer
142 views
Cracking RSA with small plaintext
I read a CTF writeup about cracking 4 primes RSA numbers from here:
Given $p, q, r,$ and $p+q+r$ are prime numbers.
The challenge encrypts the flag with a modulus $N=(p∗q∗r)∗(p+q+r)$
and gives the ...
6
votes
1answer
397 views
Iterations of pollards kangaroo attack on elliptic curves
I want to understand the Pollard kangaroo attack on elliptic curves. I found this Pollard's kangaroo attack on Elliptic Curve Groups Q/A pretty helpful, but not complete. The posts provides a pretty ...
3
votes
1answer
263 views
What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI
What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI (Crypt32.dll)
Could someone provide details?
0
votes
0answers
62 views
Understanding birthday attacks on 256 bit hashing and 512 bit hashing [duplicate]
Does it make a difference against birthday attacks if the algorithm that I am using is 512 bit hashing?
0
votes
0answers
20 views
Check linear and differential cryptanalysis of a new block cipher [duplicate]
I am developing a new block cipher primitive. I would like to test its robustness against attacks of linear and differential cryptanalysis. Is there a tool to evaluate this using only plaintext and ...
2
votes
0answers
157 views
MOV-attack on ecc: Time complexity and example
There already is this pretty big post about the MOV-attack. It states, that the discrete logarithm problem on elliptic curves can be transformed to a discrete logarithm problem over a finite field. ...
2
votes
0answers
99 views
Pollard Rho Optimization
One of the most important attacks on Elliptic Curve cryptography is Pollard's Rho method. The effect on security can be seen on SafeCurves.
This attack is pretty old and there has been a bunch of ...
2
votes
0answers
164 views
Curve25519 Attacks and Security
Curve25519 is a pretty secure way to exchange a key. In the original Paper and on SafeCurves a lot of attacks and security aspects are mentioned:
Attacks:
Brute force: This one is theoretically ...
1
vote
1answer
435 views
Pohlig Hellman and small subgroup attacks
While studying Curve25519 I read about the small subgroup attack in chapter 3. So far i know, that you need a point with a small subgroup to do such an attack. Curve25519 has a basepoint with prime ...
0
votes
0answers
81 views
Which cryptographic attacks can AES 128-bit withstand?
Most of the articles and forums are stating that the Brute Force attack can test the strength of an encryption algorithm. However, I am looking for those attacks that AES can withstand for the testing ...
