Recently Active 'attack' Questions

1

vote

0answers

32 views

How large a product out of 3 close-by factors need to be to avoid factorization?

For encryption a prime $P = 2 \cdot Q \cdot R \cdot S +1$ was used. An adversary want to solve the discrete log problem $m \equiv g^i \bmod P$. For this he want to use the Pholig-Hellmann algorithm. ...

modified yesterday

J. Doe

3911 silver badge12 bronze badges

1

vote

1answer

86 views

Given generator $g$ with prime order $k$ in $\bmod P$. Does increasing $P = 2 \cdot c \cdot k +1$ decrease security? Increasing $g$ increase security?

An adversary wants to find $a$ in $$m \equiv g^a \bmod P$$ He knows prime $P = 2 \cdot c \cdot k +1$ with it's primes $c,k$, value $m$ and $g$. And he also knows that $g$ only has an order of $k$, ...

discrete-logarithm modular-arithmetic attack

modified Jan 16 at 22:16

J. Doe

3911 silver badge12 bronze badges

1

vote

1answer

51 views

Attack on envelop mac

As I am reading the Paper: MDx-MAC and building fast MACs from hash functions I am having trouble understanding the Attack on the Envelope Method (4.3). In particular, I am not sure what chaining ...

hash mac attack

modified Jan 8 at 9:16

fgrieu

95.4k8 gold badges200 silver badges401 bronze badges

3

votes

2answers

681 views

Is direct RSA encryption of AES keys secure?

I am wondering: If we take this scheme/procedure and each of it seems very secure (to me at least), is it truly secure or is there a vulnerability hidden in the process? This is the scheme: Bob has ...

encryption rsa aes attack decryption

modified Jan 6 at 19:57

SEJPM♦

36.5k6 gold badges65 silver badges155 bronze badges

1

vote

0answers

17 views

attacks and defenses on multi party Diffie-Hellman protocol

I tried to create a 4 partied Diffie-Hellman implementation for 4 people using its cyclic group property. However, I am not sure regarding those 2 issues, and would appreciate if you could elaborate ...

encryption diffie-hellman attack man-in-the-middle

asked Jan 5 at 17:28

Crypto123

111 bronze badge

4

votes

1answer

140 views

Is double encryption really a bad idea? Are meet-in-the-middle attacks practical at all?

Meet-in-the-middle attacks are used to justify that attacks on ECC and double encryption will have complexity of $O(\sqrt{n})$ for ECC and $O(2^{n+1})$ for double encryption complexity instead of $O(n)...

aes elliptic-curves brute-force-attack attack meet-in-the-middle-attack

modified Dec 27 '19 at 23:32

fgrieu

95.4k8 gold badges200 silver badges401 bronze badges

2

votes

1answer

32 views

Security implications of not concatenating a 1 to the IV when using GCM

When using GCM, The padding string $0^{31}||1$ is appended to the IV. I know that this is done to avoid the repetition of $E_K(0^n)$ which is used as key for the GHash. But what would be the security ...

initialization-vector attack gcm

modified Dec 11 '19 at 11:51

SEJPM♦

36.5k6 gold badges65 silver badges155 bronze badges

1

vote

0answers

43 views

Why is this attack complexity equal that exact number of bit operations?

in the this paper,section 3,autors attack hamsi-256. Im trying to make a parametrized version, so i need to understand how do they estimate the complexity of attack in bit operations,that reads as ...

hash cryptanalysis attack complexity 2nd-preimage-resistance

modified Dec 6 '19 at 6:21

Kirill

133 bronze badges

2

votes

1answer

362 views

ECDSA with common nonce?

I'm new to cryptography, and I've searching about ECDSA because I'm trying to solve a CTF. I've already check this site and Google, and I think I'm in the right path, but probably I am missing ...

implementation dsa attack

modified Nov 27 '19 at 0:18

Squeamish Ossifrage

39.8k3 gold badges76 silver badges164 bronze badges

4

votes

1answer

198 views

Any speed up methods for finding the index of a random value produced by the Inversive congruential generator?

The Inversive congruential generator produces random values with: $$x_{n+1} = a\cdot x_{n}^{-1} + b \mod P$$ (special case if $x_n=0$ -> $x_{n+1}=b$) starting with an initial value $x_0$ With well ...

cryptanalysis random-number-generator pseudo-random-function attack pseudo-random-permutation

answered Nov 25 '19 at 15:16

j.p.

1,31713 silver badges11 bronze badges

-2

votes

2answers

864 views

side channel attack on RSA [duplicate]

A side-channel attack is any attack based on information gained from the implementation of Encryption protocol and by monitoring security-critical operations. Almost every encryption had a side-...

rsa attack side-channel-attack

modified Nov 24 '19 at 0:23

R1w

1,4122 gold badges7 silver badges31 bronze badges

1

vote

2answers

408 views

What is a multi-target attack?

What exactly is a multi-target attack? How does the attack work on different cryptographic schemes (block ciphers, hash functions, elliptic curves)? How can it be avoided?

attack

modified Nov 21 '19 at 14:25

Squeamish Ossifrage

39.8k3 gold badges76 silver badges164 bronze badges

1

vote

1answer

67 views

Attacking Double DES (OFB Mode) given the initialization vector and not much else? [closed]

I'm given a Plaintext/Ciphertext pair, a Ciphertext to break, and the IV. One thing of note is that the same IV is used for both DES Encryptions, so $$C = E_{K_2}(E_{K_1}(P, IV), IV)$$ I have limited ...

block-cipher des initialization-vector attack meet-in-the-middle-attack

modified Oct 14 '19 at 6:01

Community♦

1

3

votes

1answer

117 views

Attacking any one in many public keys

The problem of finding private key from public key is typically studied in the one-key setup: what's the expected cost of breaking one key (e.g. by factoring a public modulus, or solving a discrete ...

public-key discrete-logarithm attack factoring

modified Oct 10 '19 at 9:45

fgrieu

95.4k8 gold badges200 silver badges401 bronze badges

1

vote

0answers

45 views

Is the 51% attack the only technical reason no country will ever adopt Bitcoin as a state currency? [closed]

Is the 51% attack the only technical reason no country will adopt Bitcoin as a state currency? Let's suppose a country with a GDP size less than 300 Billion USD adopt the Bitcoin as an official ...

attack cryptocurrency

modified Oct 6 '19 at 11:04

kelalaka

15.8k4 gold badges39 silver badges73 bronze badges

1

vote

0answers

44 views

What if an AES Whitebox 1024-bit (or larger key) is created? Does it increase complexity consistently?

Following the Chow et al paper and Muir's tutorial, I was able to implement the AES algorithm using tables embedding keys of 128, 192 and 256-bit sizes, later extended to 1024, 2048 and 4096-bit sizes....

encryption aes attack complexity white-box

modified Oct 2 '19 at 22:34

Guilherme Balena Versiani

212 bronze badges

0

votes

1answer

125 views

How you find the unpadded short plaintext using RSA?

I am currently trying to understand how you find the unpadded short plaintext when you are using RSA. Please help with explaining the process and so I can understand this topic more.

rsa attack

modified Sep 29 '19 at 4:06

Community♦

1

4

votes

1answer

344 views

What are the current known weaknesses/attacks on quantum key distribution?

I am writing a paper on the implementation of QKD in the future. I want to know if there are any viable attacks on the BB84 protocol or QKD in general? I know of the Photon Number Splitting attack or ...

cryptanalysis attack quantum-cryptography key-distribution

modified Sep 28 '19 at 21:01

Community♦

1

0

votes

2answers

166 views

What is the strength and attack vectors of this simple scheme?

Let's say that Alice wants to communicate some secret value $S$ to Bob through a public channel in a way that other people don't know what the value was. To do this, Alice publishes that secret value ...

algorithm-design attack

modified Sep 28 '19 at 20:06

Ella Rose

18.2k5 gold badges46 silver badges87 bronze badges

1

vote

0answers

101 views

Correlation attack on Lagged Fibonacci Generator

Say that one uses a known LFG (2 known lags $a$ & $b$, known inner state length $N$, known modulo $m$) to hide some text with a basic à la Vigenère cipher: $C_i=(P_i + {PRNG}_i) \bmod 26$. Say ...

attack vigenere ciphertext-only-attack

modified Sep 28 '19 at 19:53

Squeamish Ossifrage

39.8k3 gold badges76 silver badges164 bronze badges

2

votes

1answer

388 views

Is there really any way to nullify or avoid MITM attacks?

The question pretty much sums it up. Is there any way to make an attacker who is successfully performing an MITM attack to actually not be able to read or change the messages? Assuming there is no ...

attack man-in-the-middle

modified Sep 28 '19 at 18:05

Squeamish Ossifrage

39.8k3 gold badges76 silver badges164 bronze badges

3

votes

1answer

129 views

Why is the Domingo-Ferrer cryptosystem not used in practice?

The Domingo-Ferrer cryptosystem is a fully homomorphic cryptosystem. It works fast enough. I have only seen known-plaintext attacks. Is this a reason not to use it in practice? Or are there more ...

homomorphic-encryption attack known-plaintext-attack

modified Sep 26 '19 at 15:47

Squeamish Ossifrage

39.8k3 gold badges76 silver badges164 bronze badges

7

votes

3answers

4k views

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? If, how big does the list of plaintext ...

aes attack known-plaintext-attack ecb

modified Sep 20 '19 at 8:50

kelalaka

15.8k4 gold badges39 silver badges73 bronze badges

3

votes

1answer

945 views

If a key is used to encrypt that same key, is the computational cost to brute force it decreased?

If a key $d$ is used to encrypt a message $m$ that is identical to the key $d$, resulting in a cipher $c$ $c = \text{Encrypt}(m, d) = \text{Encrypt}(d, d)$ is the computational cost to brute force $...

symmetric brute-force-attack attack

modified Sep 18 '19 at 13:08

AleksanderRas

5,2752 gold badges14 silver badges45 bronze badges

3

votes

1answer

191 views

Anonymity problem after voting with blind signatures

In a distributed voting system (all the messages are public, but signed and maybe encrypted/blinded), having: $d$, $e$, $N$ — registrar key params $m$ — msg $r$ — random blinding factor $m'$ — ...

modified Sep 16 '19 at 11:37

Patriot

1,6932 gold badges7 silver badges31 bronze badges

2

votes

0answers

49 views

Complexity of AES key reconstruction from state 1 output and plaintext

Assuming that I am able to read the plaintext as well as the output of round 1 of an AES-128 encryption: Is it possible (if yes: how?) to obtain the RoundKey with a lower complexity than brute-force ...

aes attack

modified Sep 10 '19 at 21:47

Maarten Bodewes♦

66.4k9 gold badges98 silver badges229 bronze badges

1

vote

0answers

57 views

How to solve a simple case of a RLWE problem

I've been reading up on the Ring Learning with Errors problem and the proposed attacks, in relation to homomorphic encryption. Some of the literature has been quite difficult to understand - what I ...

homomorphic-encryption attack lwe ring-lwe rlwe

modified Sep 3 '19 at 16:25

dashybrown

112 bronze badges

0

votes

1answer

84 views

Is rekeying attack the same as related-key attack?

I've been searching about rekeying attack, but what I found is always using the term "rekeying/related-key attack". Is rekeying attack the same as related-key attack?

modified Sep 3 '19 at 1:26

forest

10.3k1 gold badge31 silver badges62 bronze badges

2

votes

1answer

71 views

How “Resending Message Attack” works?

In the second chapter of Bruce Schneier's book Applied Cryptography, 2nd Edition, 1996, we find this in section 2.7.1 Resending the Message as a Receipt: ...

signature attack

modified Aug 27 '19 at 15:06

Maarten Bodewes♦

66.4k9 gold badges98 silver badges229 bronze badges

3

votes

1answer

138 views

Does knowing that the exponent is in a certain range help solving discrete log?

given: $c=g^i \bmod P$ $g$ generator for group with group size $\varphi(P)$ $g,P,\varphi(P)$,c is known by the attacker He wants to know $i$. Now the attacker also knows $j,k$ with $j<i<k$ $k-j$...

diffie-hellman discrete-logarithm attack

modified Aug 17 '19 at 21:05

yyyyyyy

10.3k3 gold badges37 silver badges55 bronze badges

-1

votes

1answer

76 views

How do discrete logarithm with modulo a prime and a non-prime compare?

Let $c_N = g^i \mod N$ and $N=p \cdot q$ and $c_P = f^j \mod P$ and $P$ a prime We assume $N,P$ has the same bit-length. $P$ is the best type of prime you can choose (e.g. safe prime). $N$ is a ...

cryptanalysis discrete-logarithm attack

answered Aug 16 '19 at 4:18

mephisto

2,61214 silver badges26 bronze badges

-2

votes

1answer

99 views

On the security definitions [duplicate]

What are the differences between: perfect security information-theoretic security semantic security indistinguishability Are there any other definitions which are closely related? Do these security ...

provable-security attack security-definition

modified Jul 24 '19 at 6:25

Patriot

1,6932 gold badges7 silver badges31 bronze badges

1

vote

0answers

31 views

Why, in general, are proofs of possession (POPs) “clearly” not sufficient for substantiating the knowledge of secret key (KOSK) assumption?

In Ristenpart, Yilek - The Power of Proofs-of-Possession: Securing Multiparty Signatures against Rogue-Key Attacks they have the statement: In general, such proofs of possession (POPs) are clearly ...

signature zero-knowledge-proofs attack

asked Jul 21 '19 at 19:52

user40176

655 bronze badges

7

votes

1answer

332 views

How safe is a prime with $P=2 \cdot Q \cdot R \cdot S \cdot t+1$ for discrete logarithm? How to enhance/compare?

To get some certain properties for my use case I need a prime $P$ which has the form: $P=2\cdot Q \cdot R \cdot S \cdot t+1$ with $Q,R,S,t$ primes as well. Why that form - Use case Together with ...

cryptanalysis discrete-logarithm attack

modified Jul 20 '19 at 21:01

J. Doe

3911 silver badge12 bronze badges

0

votes

2answers

35 views

The opponent possesses a string of ciphertext and has access to the encryption machinery as black box. What is the name of this attack?

a quick example: The encryption function: y = E(x) = (13x + 9)(mod 27), when the letters A–Z are taken to be the numbers 0–25 and the Space (punctuation) is the number 26. The opponent has the ...

attack

answered Jul 5 '19 at 15:43

poncho

103k3 gold badges165 silver badges269 bronze badges

1

vote

1answer

31 views

Randomization attack in voting protocols

I'm looking into coercion-resistant voting schemes and one of the key elements of coercion-resistance is resistance to randomization attacks. Juels et al. define a randomization attack as one where ...

attack voting

answered Jun 15 '19 at 13:02

Atte Juvonen

5994 silver badges10 bronze badges

1

vote

1answer

160 views

How does the CBC Padding Oracle Attack work in General?

Right now we don't have a single generalized question asking how the CBC padding oracle attack works. We have e.g. this one and this one but the former is distracted by the concrete values being ...

cbc attack padding-oracle

modified Jun 14 '19 at 21:01

Community♦

1

vote

1answer

210 views

Cipher Block Chaining - How do you change the plaintext of all blocks?

I've just read about CBC encryption and decryption and was wondering how you can change every plaintext block? Let's say you have an initialization vector, 3 ciphertext blocks, know each block-cipher-...

encryption aes cbc attack

modified May 25 '19 at 22:34

kelalaka

15.8k4 gold badges39 silver badges73 bronze badges

16

votes

4answers

9k views

How can C rand() be exploited if a secure seed is used?

I've just started doing a research project on CSPRNGs and I would like to know what kind of vulnerabilities a regular PRNG has with a secure seed. For example, if I generate a random number using ...

randomness pseudo-random-generator attack

answered May 15 '19 at 15:39

Gabriele Avosani

1

vote

1answer

68 views

Probabilistic padding to avoid Håstad’s Broadcast Attack

Can someone explain why probabilistic padding like OAEP is particularly useful for avoiding Håstad’s Broadcast Attack? I don't really get the reason why.

rsa attack oaep

answered May 15 '19 at 15:02

Squeamish Ossifrage

39.8k3 gold badges76 silver badges164 bronze badges

-1

votes

2answers

686 views

Can Shamir’s Trick crack the cryptographic strength of ECDSA?

Recently stumbled upon a discussion in the forum What is Shamir’s Trick used for? Are there any such examples?

elliptic-curves algorithm-design diffie-hellman discrete-logarithm attack

answered Apr 29 '19 at 18:19

satya

1,0524 silver badges18 bronze badges

1

vote

1answer

55 views

Does a different exponent and base but same key help to resolve discrete logarithm?

E.g.: $k = N^a \mod P$ The attacker knows the prime $P$ and $N$, which is also a prime and (1.) prime root of $P$ or (2.) has a cycle size of $s$, so $1 = N^s \mod P$, (and for $\forall s'<s$, $...

cryptanalysis discrete-logarithm attack

answered Apr 25 '19 at 21:15

poncho

103k3 gold badges165 silver badges269 bronze badges

0

votes

0answers

54 views

Unique numbers with $P^aQ^bR^c \mod N$ for each combination of $a,b,c$ possible? Would it be safer than separate form (like $T^a \mod P$ for each)?

Main question: Is the computation of $a,b,c$ in $P^aQ^bR^c \mod N$ (much) harder than in $T_p^a \mod P$, $T_q^b \mod Q$, $T_r^c \mod R$ ? (assuming the first form exists) $P^aQ^bR^c \mod N$ With $P^...

cryptanalysis algorithm-design attack known-plaintext-attack

modified Apr 21 '19 at 13:41

J. Doe

3911 silver badge12 bronze badges

0

votes

1answer

44 views

How much more secure is $c = mg_1^r + g_2(g_1(g_1^r-1)/(g_1-1)) \mod p$ compared to just $c = mg_1^r \mod p$ (dis. log), all known but $r$?

To encode a message $m$ to a cipher $c$ you can use the only hard solvable problem of computing the discrete logarithm with a generator $g$ in base over a prime $p$. $c = mg_1^r$ mod p If an ...

cryptanalysis algorithm-design elgamal-encryption attack known-plaintext-attack

answered Apr 19 '19 at 19:29

poncho

103k3 gold badges165 silver badges269 bronze badges

0

votes

1answer

173 views

Example of product cipher more secure than its components

Can anyone give me an example of a product cipher which more secure than its components. Here is how the explanation should proceed. There is cipher C1 which can be attacked with the technique A1, ...

cryptanalysis attack

modified Apr 12 '19 at 15:40

Ella Rose

18.2k5 gold badges46 silver badges87 bronze badges

1

vote

0answers

345 views

RSA encryption extremely large public exponent

I'm trying to do learn a bit about RSA by doing CTF's and now I am doing one problem probably more than 7 hours so I would really appreciate a hint here from an expert. I have an encrypted message $c$...

encryption rsa attack

modified Apr 9 '19 at 19:34

Maarten Bodewes♦

66.4k9 gold badges98 silver badges229 bronze badges

1

vote

0answers

98 views

Weak/Vulnerable AES Implementations [closed]

I'm trying to complete a cryptography CTF challenge in which I have a cipher I'm supposed to attain the original plaintext from. I have reason to believe it's been encrypted using AES, but I'm unaware ...

aes attack

modified Apr 7 '19 at 18:21

muke

433 bronze badges

2

votes

3answers

2k views

When is a cipher considered broken?

We've all read how some people claim AES is broken because there was supposedly a way to get the plain text from a cipher text faster than brute-force. But is this the definition? Is a cipher broken ...

cryptanalysis brute-force-attack encryption security-definition attack

modified Apr 3 '19 at 8:47

forest

10.3k1 gold badge31 silver badges62 bronze badges

7

votes

1answer

117 views

How complex must round constants be to resist slide attacks?

A key schedule that generates round keys by XORing a round constant with the key is linear and can be vulnerable to related key attacks, but let's ignore that for now. Constants are necessary to avoid ...

cryptanalysis keys attack key-schedule constants

modified Mar 30 '19 at 1:20

forest

10.3k1 gold badge31 silver badges62 bronze badges

0

votes

0answers

65 views

Prove that a given signature scheme is secure under random message attacks

This is a follow up to my previous question. Consider the following signature scheme: $\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $...

signature randomness attack pairings

modified Mar 22 '19 at 22:00

Squeamish Ossifrage

39.8k3 gold badges76 silver badges164 bronze badges

Questions tagged [attack]

Related Tags