Questions tagged [attack]
A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.
302
questions
0
votes
0answers
40 views
Blockwise-adaptive RoR-CPA Attack against CBC
I know that the security from CBC stems from the fact that since each message block is randomized by xoring it with a block cipher output, each new call to $E_{K}$ is independent from the previous ...
0
votes
1answer
55 views
Security of a custom AES-based attack model
Provided that:
$AES(plaintext, key)$ is the standard AES block cipher for a 128 bits block.
$\oplus$ is the standard XOR operation.
$K$ is a constant 128 bits pseudorandom value, which is used as the ...
0
votes
0answers
38 views
2
votes
1answer
130 views
Short padding + known prefix RSA attack
Suppose I have a message in the form of:
$m = \text{prefix} \mathbin\| \text{secret} \mathbin\| \text{padding}$
We have:
$e=3$
$n$
$n_\text{padding}$ (length of the random padding, <$1/4$ of $m$)...
0
votes
1answer
64 views
May an adversary be fooled by a random-looking input that in reality is fixed?
I want to prove the EUF-CMA-security of a signature scheme. It is a variation on an established scheme, therefore I would ideally like to reduce the new-scheme-security to the old-scheme-security.
the ...
1
vote
1answer
54 views
When attacking keyed algorithms, how is it known when the output is correct?
I've been reading a little bit about cryptanalysis, and I'm wondering how attacking algorithms that work on keys is performed.
It's obvious how algorithms like MD5 are attacked, in pseudocode:
...
13
votes
0answers
148 views
The aftermath and considerations of the new record of 30750-Bit Binary Field Discrete Logarithm - 2020
Granger et al. recently published a paper about breaking a record for discrete logarithm on the Binary field
Computation of a 30 750-Bit Binary Field Discrete Logarithm, Robert Granger and Thorsten ...
2
votes
1answer
82 views
Is there a term for cryptographic attacks where you can verify decryption without assuming any known structure on the plaintext?
The questions https://security.stackexchange.com/questions/1696/if-someone-breaks-encryption-how-do-they-know-theyre-successful and https://security.stackexchange.com/questions/119887/how-to-know-if-a-...
1
vote
1answer
92 views
Cracking RSA with small plaintext
I read a CTF writeup about cracking 4 primes RSA numbers from here:
Given $p, q, r,$ and $p+q+r$ are prime numbers.
The challenge encrypts the flag with a modulus $N=(pāqār)ā(p+q+r)$
and gives the ...
6
votes
1answer
191 views
Iterations of pollards kangaroo attack on elliptic curves
I want to understand the Pollard kangaroo attack on elliptic curves. I found this Pollard's kangaroo attack on Elliptic Curve Groups Q/A pretty helpful, but not complete. The posts provides a pretty ...
1
vote
0answers
43 views
Code implementation of NTRU lattice attack
As mentioned here, BKZ is one way to break the NTRU lattice What is the most efficient attack on NTRU?
I was wondering if there are any source codes which actually implemented this on the weaker NTRU ...
2
votes
1answer
201 views
What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI
What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI (Crypt32.dll)
Could someone provide details?
0
votes
0answers
39 views
Understanding birthday attacks on 256 bit hashing and 512 bit hashing [duplicate]
Does it make a difference against birthday attacks if the algorithm that I am using is 512 bit hashing?
0
votes
0answers
19 views
Check linear and differential cryptanalysis of a new block cipher [duplicate]
I am developing a new block cipher primitive. I would like to test its robustness against attacks of linear and differential cryptanalysis. Is there a tool to evaluate this using only plaintext and ...
2
votes
0answers
80 views
MOV-attack on ecc: Time complexity and example
There already is this pretty big post about the MOV-attack. It states, that the discrete logarithm problem on elliptic curves can be transformed to a discrete logarithm problem over a finite field. ...
2
votes
0answers
81 views
Pollard Rho Optimization
One of the most important attacks on Elliptic Curve cryptography is Pollard's Rho method. The effect on security can be seen on SafeCurves.
This attack is pretty old and there has been a bunch of ...
2
votes
0answers
92 views
Curve25519 Attacks and Security
Curve25519 is a pretty secure way to exchange a key. In the original Paper and on SafeCurves a lot of attacks and security aspects are mentioned:
Attacks:
Brute force: This one is theoretically ...
1
vote
1answer
94 views
Pohlig Hellman and small subgroup attacks
While studying Curve25519 I read about the small subgroup attack in chapter 3. So far i know, that you need a point with a small subgroup to do such an attack. Curve25519 has a basepoint with prime ...
1
vote
1answer
66 views
Adversary for attack on one variant of ElGamal
I came by the following question:
Consider the following variant of ElGamal encryption. Let $p= 2q+ 1$,
let $G$ be the group of squares modulo $p$ so $G$ is a subgroup of
$Z_p^*$ of order $q$, and ...
0
votes
0answers
42 views
Proof by reduction for for digital signature scheme $S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$
Let $(Gen,S,V)$ be a secure signature scheme (existentially unforgeable under a chosen message attack) with message space${\{0,1\}}^n$. Generate two signing/verification key ...
0
votes
0answers
59 views
Which cryptographic attacks can AES 128-bit withstand?
Most of the articles and forums are stating that the Brute Force attack can test the strength of an encryption algorithm. However, I am looking for those attacks that AES can withstand for the testing ...
0
votes
1answer
32 views
How to solve high exponent attack for same message in RSA
I know HĆ„stad's broadcast attack when e = 3, but what if e = getPrime(randint(350))?
3
votes
2answers
182 views
XOR cipher with fixed key and known relation among plaintexts
I have three messages, each known to be XOR-encoded, with the same key used for each message of this XOR cipher.
Encoded message 1: $e_1\,=\,00100111010$
Encoded message 2: $e_2\,=\,01001110110$
...
0
votes
0answers
95 views
Can we defends against RSA Timing attack when we use java.math.BigInteger.modPow?
I think that Montgomery and sliding window techniques are applied within java.math.BigInteger.modPow (and more specifically ...
1
vote
1answer
82 views
Attack against $\operatorname{DESA}_{k,k_1} (x) \underset{\text{def}}= \operatorname{DES}_k(x)āk_1$
Problem 5.16 in this pdf, from the book: Christof Paar, Jan Pelzl, Understanding Cryptography
5.16. This is your chance to break a cryptosystem. As we know by now, cryptography is a tricky business. ...
8
votes
2answers
435 views
Which attacks are possible against raw/textbook NTRU encryption?
In the same fashion that these questions about attacks to textbook RSA and ECC, I was wondering what are the immediate drawbacks of applying NTRU Encryption directly, without any padding scheme, such ...
4
votes
1answer
41 views
Why are the indicator drums of a Bombe machine labelled from A to Z clockwise?
I am researching the Bombe Machine, having just completed a project on the Enigma Machine. I visited The Rutherford Journal - The Turing Bombe, and it claimed that
The scales on the three ...
6
votes
1answer
468 views
Why does the Bombe not consider the Ringstellung when determining stecker pairs?
I am doing research on the Bombe Machine, and I read that when the Bombe tries to find the stecker (plugboard) partners of letters, it only needs to use the rotor types and arrangement and also the "...
6
votes
1answer
722 views
Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password?
A malicious actor wants to decrypt ciphertext that was encrypted with a password. He also possesses the hash (bcrypt/PBKDF2) of that password. Does he have any significant practical advantage in ...
0
votes
0answers
29 views
Is Joux's multicollision attack applicable for truncated SHA256?
Joux presents an elegant way to generate k-way multi-collisions with about as much effort as generating a single collision: https://www.iacr.org/archive/crypto2004/31520306/multicollisions.pdf
...
1
vote
2answers
123 views
Secret sharing scheme WITHOUT Shamir Secrete Sharing
I am planning to use the following XOR scheme to divide a secret into only 2 shares (I do not want to use Shamir Secret Sharing for different reasons that are beyond the scope of this post).
Here's ...
1
vote
1answer
32 views
Can MFA codes be predicted if you know what their values were at a previous time?
I use an app on my phone that, after scanning a QR code on a website, gives me 6-digit codes which change every 30 seconds. These codes can be used for Multi-Factor Authentication (MFA) on some ...
0
votes
0answers
60 views
Can someone explain the timing attack on RSA with Montgomery multiplication?
I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle.
I understood that there is a additional ...
3
votes
1answer
135 views
Breaking ciphertext using a quantum computer when the public key is not available
As we know about Shor's algorithm on quantum computers it is possible to crack RSA / ECC easily if we have enough qubits.
Is it possible to crack RSA / ECC on a quantum computer if we only have ...
4
votes
1answer
157 views
Find prime $p$ such that $a^x\equiv b\pmod p$ for many $x\in[1,p)$
Given haphazard large integers $a$ and $b$ (like few thousand bits), can we efficiently find (and how) some integer triplet $(p,x,k)$ with
$p$ a large prime (like a thousand bits)
$a^x\equiv b\pmod p$...
1
vote
0answers
33 views
is there an effective attack against rsa by knowing the coefficient $u$ of the private key? [duplicate]
consider that an attacker has the public key $(n, e)$, where $n$ is $1024$ bits long, the $32$ largest bits of $p$ (where $n = p \cdot q$), as well as $u = p^{-1} \pmod q$. Is there an attack that ...
3
votes
2answers
326 views
Things already known to adversary before planning an attack
This is a very basic and practical question. Since I started reading cryptography recently, these things keep bugging me.
What are the things that an adversary is usually aware of before planning an ...
0
votes
0answers
54 views
An insecure signature with message recovery, Dan Boneh
Someone can help me to resolve this questions from the book of Dan Boneh (University of Standford)
0
votes
1answer
67 views
KRACK - Is all-zero key installed by the acces point?
I don't really understand (and I think it's not described in the official paper) how the encryption can work when the encryption key is set to 0 by a KRACK attack on a device using wpa_supplicant 2.4 ...
0
votes
1answer
57 views
AES 5-round Square attack, how to choose plaintexts?
I know that we need to generate a delta-set (with 256 plaintexts).
During the attack, we guess 4 bytes of round 5 key and 1 bytes of round 4 key, which allows us the byte at one position of the state ...
1
vote
0answers
39 views
Can Trivium ciphertext be decrypted by an adversary if the key is known, but the IV is not?
Suppose that the adversary is able to recover the key of Trivium cipher. But the associated IV is unknown to him. Will he be able to decrypt the ciphertexts without any complexity?
1
vote
1answer
76 views
RSA CTF Guidance
There's a great cryptography based ctf site that I've been going through. There's this one question around RSA that has been puzzling me for over a week now.
Please don't tell me the answer, I'm only ...
13
votes
1answer
2k views
Cracking a PRNG by observing ranks within groups of its output
Suppose that I am generating random numbers with Python's random module, so that there is a known random number generator (Mersenne Twister in this case). I've ...
3
votes
0answers
82 views
RSA calculate $d$ using Chinese Remainder Theorem with $d_p$, $d_q$ and $e$
Suppose for a RSA system I have the following variables given:
modulus $n$, expononent $e$, $d_p$ and $d_q$Where, $d_p = d\bmod(p-1)$ and $d_q = d\bmod(q-1)$,
Is it possible to find the private ...
1
vote
1answer
65 views
Key at start or end of HMAC
In the book Information Security Principles and Practice, the author explains why HMAC should be used for integrity with a symmetric key with the message, to prevent a MiTM to replace both the message ...
3
votes
1answer
71 views
If I allow arbitrary initial hash values for SHA-256, what would be the weaknesses?
The initial hash values (IV) of SHA256 are fixed. However, let's say I modify the SHA256 hash function to allow the attacker to use arbitrary IVs rather than fixed IVs. What kind of weaknesses would ...
0
votes
2answers
72 views
How is asymmetric cryptography safe if one of the keys is public?
Let's suppose $A$ is sending a message $m$ to $B$ using asymmetric cryptography.
To guarantee the authenticity of a message, $A$ encrypts $m$ with $A$'s private key: $E(m, k_A) = m_A$.
Then, $A$ ...
1
vote
0answers
136 views
How to find/determine the Polybius Square Key and Additive Key, if only the Cipher Text is known, in Nihilist Cipher?
I was solving a Crypto Challenge in a CTF, and I got a Nihilist Cipher Encoded String. Luckily the additive key was given as a hint, and for the polybius Square key, I kinda bruteforced or I just got ...
1
vote
1answer
3k views
Possible Digital Signature Hack?
I am starting to learn more about cryptography and I just read more about how asymmetric keys can make a digital certificate, and I would like if someone could explain me why the following case can't ...
1
vote
1answer
71 views
averaging attack at Google's RAPPOR
I am reading the paper - "RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response".
I don't understand how the averaging attack works.
I searched for "average attack" but couldn't find a ...
