A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

Filter by
Sorted by
Tagged with
1
vote
0answers
32 views

How large a product out of 3 close-by factors need to be to avoid factorization?

For encryption a prime $P = 2 \cdot Q \cdot R \cdot S +1$ was used. An adversary want to solve the discrete log problem $m \equiv g^i \bmod P$. For this he want to use the Pholig-Hellmann algorithm. ...
1
vote
1answer
86 views

Given generator $g$ with prime order $k$ in $\bmod P$. Does increasing $P = 2 \cdot c \cdot k +1$ decrease security? Increasing $g$ increase security?

An adversary wants to find $a$ in $$m \equiv g^a \bmod P$$ He knows prime $P = 2 \cdot c \cdot k +1$ with it's primes $c,k$, value $m$ and $g$. And he also knows that $g$ only has an order of $k$, ...
1
vote
1answer
51 views

Attack on envelop mac

As I am reading the Paper: MDx-MAC and building fast MACs from hash functions I am having trouble understanding the Attack on the Envelope Method (4.3). In particular, I am not sure what chaining ...
3
votes
2answers
681 views

Is direct RSA encryption of AES keys secure?

I am wondering: If we take this scheme/procedure and each of it seems very secure (to me at least), is it truly secure or is there a vulnerability hidden in the process? This is the scheme: Bob has ...
1
vote
0answers
17 views

attacks and defenses on multi party Diffie-Hellman protocol

I tried to create a 4 partied Diffie-Hellman implementation for 4 people using its cyclic group property. However, I am not sure regarding those 2 issues, and would appreciate if you could elaborate ...
4
votes
1answer
140 views

Is double encryption really a bad idea? Are meet-in-the-middle attacks practical at all?

Meet-in-the-middle attacks are used to justify that attacks on ECC and double encryption will have complexity of $O(\sqrt{n})$ for ECC and $O(2^{n+1})$ for double encryption complexity instead of $O(n)...
2
votes
1answer
32 views

Security implications of not concatenating a 1 to the IV when using GCM

When using GCM, The padding string $0^{31}||1$ is appended to the IV. I know that this is done to avoid the repetition of $E_K(0^n)$ which is used as key for the GHash. But what would be the security ...
1
vote
0answers
43 views

Why is this attack complexity equal that exact number of bit operations?

in the this paper,section 3,autors attack hamsi-256. Im trying to make a parametrized version, so i need to understand how do they estimate the complexity of attack in bit operations,that reads as ...
2
votes
1answer
362 views

ECDSA with common nonce?

I'm new to cryptography, and I've searching about ECDSA because I'm trying to solve a CTF. I've already check this site and Google, and I think I'm in the right path, but probably I am missing ...
4
votes
1answer
198 views

Any speed up methods for finding the index of a random value produced by the Inversive congruential generator?

The Inversive congruential generator produces random values with: $$x_{n+1} = a\cdot x_{n}^{-1} + b \mod P$$ (special case if $x_n=0$ -> $x_{n+1}=b$) starting with an initial value $x_0$ With well ...
-2
votes
2answers
864 views

side channel attack on RSA [duplicate]

A side-channel attack is any attack based on information gained from the implementation of Encryption protocol and by monitoring security-critical operations. Almost every encryption had a side-...
1
vote
2answers
408 views

What is a multi-target attack?

What exactly is a multi-target attack? How does the attack work on different cryptographic schemes (block ciphers, hash functions, elliptic curves)? How can it be avoided?
1
vote
1answer
67 views

Attacking Double DES (OFB Mode) given the initialization vector and not much else? [closed]

I'm given a Plaintext/Ciphertext pair, a Ciphertext to break, and the IV. One thing of note is that the same IV is used for both DES Encryptions, so $$C = E_{K_2}(E_{K_1}(P, IV), IV)$$ I have limited ...
3
votes
1answer
117 views

Attacking any one in many public keys

The problem of finding private key from public key is typically studied in the one-key setup: what's the expected cost of breaking one key (e.g. by factoring a public modulus, or solving a discrete ...
1
vote
0answers
45 views

Is the 51% attack the only technical reason no country will ever adopt Bitcoin as a state currency? [closed]

Is the 51% attack the only technical reason no country will adopt Bitcoin as a state currency? Let's suppose a country with a GDP size less than 300 Billion USD adopt the Bitcoin as an official ...
1
vote
0answers
44 views

What if an AES Whitebox 1024-bit (or larger key) is created? Does it increase complexity consistently?

Following the Chow et al paper and Muir's tutorial, I was able to implement the AES algorithm using tables embedding keys of 128, 192 and 256-bit sizes, later extended to 1024, 2048 and 4096-bit sizes....
0
votes
1answer
125 views

How you find the unpadded short plaintext using RSA?

I am currently trying to understand how you find the unpadded short plaintext when you are using RSA. Please help with explaining the process and so I can understand this topic more.
4
votes
1answer
344 views

What are the current known weaknesses/attacks on quantum key distribution?

I am writing a paper on the implementation of QKD in the future. I want to know if there are any viable attacks on the BB84 protocol or QKD in general? I know of the Photon Number Splitting attack or ...
0
votes
2answers
166 views

What is the strength and attack vectors of this simple scheme?

Let's say that Alice wants to communicate some secret value $S$ to Bob through a public channel in a way that other people don't know what the value was. To do this, Alice publishes that secret value ...
1
vote
0answers
101 views

Correlation attack on Lagged Fibonacci Generator

Say that one uses a known LFG (2 known lags $a$ & $b$, known inner state length $N$, known modulo $m$) to hide some text with a basic à la Vigenère cipher: $C_i=(P_i + {PRNG}_i) \bmod 26$. Say ...
2
votes
1answer
388 views

Is there really any way to nullify or avoid MITM attacks?

The question pretty much sums it up. Is there any way to make an attacker who is successfully performing an MITM attack to actually not be able to read or change the messages? Assuming there is no ...
3
votes
1answer
129 views

Why is the Domingo-Ferrer cryptosystem not used in practice?

The Domingo-Ferrer cryptosystem is a fully homomorphic cryptosystem. It works fast enough. I have only seen known-plaintext attacks. Is this a reason not to use it in practice? Or are there more ...
7
votes
3answers
4k views

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? If, how big does the list of plaintext ...
3
votes
1answer
945 views

If a key is used to encrypt that same key, is the computational cost to brute force it decreased?

If a key $d$ is used to encrypt a message $m$ that is identical to the key $d$, resulting in a cipher $c$ $c = \text{Encrypt}(m, d) = \text{Encrypt}(d, d)$ is the computational cost to brute force $...
3
votes
1answer
191 views

Anonymity problem after voting with blind signatures

In a distributed voting system (all the messages are public, but signed and maybe encrypted/blinded), having: $d$, $e$, $N$ — registrar key params $m$ — msg $r$ — random blinding factor $m'$ — ...
2
votes
0answers
49 views

Complexity of AES key reconstruction from state 1 output and plaintext

Assuming that I am able to read the plaintext as well as the output of round 1 of an AES-128 encryption: Is it possible (if yes: how?) to obtain the RoundKey with a lower complexity than brute-force ...
1
vote
0answers
57 views

How to solve a simple case of a RLWE problem

I've been reading up on the Ring Learning with Errors problem and the proposed attacks, in relation to homomorphic encryption. Some of the literature has been quite difficult to understand - what I ...
0
votes
1answer
84 views

Is rekeying attack the same as related-key attack?

I've been searching about rekeying attack, but what I found is always using the term "rekeying/related-key attack". Is rekeying attack the same as related-key attack?
2
votes
1answer
71 views

How “Resending Message Attack” works?

In the second chapter of Bruce Schneier's book Applied Cryptography, 2nd Edition, 1996, we find this in section 2.7.1 Resending the Message as a Receipt: ...
3
votes
1answer
138 views

Does knowing that the exponent is in a certain range help solving discrete log?

given: $c=g^i \bmod P$ $g$ generator for group with group size $\varphi(P)$ $g,P,\varphi(P)$,c is known by the attacker He wants to know $i$. Now the attacker also knows $j,k$ with $j<i<k$ $k-j$...
-1
votes
1answer
76 views

How do discrete logarithm with modulo a prime and a non-prime compare?

Let $c_N = g^i \mod N$ and $N=p \cdot q$ and $c_P = f^j \mod P$ and $P$ a prime We assume $N,P$ has the same bit-length. $P$ is the best type of prime you can choose (e.g. safe prime). $N$ is a ...
-2
votes
1answer
99 views

On the security definitions [duplicate]

What are the differences between: perfect security information-theoretic security semantic security indistinguishability Are there any other definitions which are closely related? Do these security ...
1
vote
0answers
31 views

Why, in general, are proofs of possession (POPs) “clearly” not sufficient for substantiating the knowledge of secret key (KOSK) assumption?

In Ristenpart, Yilek - The Power of Proofs-of-Possession: Securing Multiparty Signatures against Rogue-Key Attacks they have the statement: In general, such proofs of possession (POPs) are clearly ...
7
votes
1answer
332 views

How safe is a prime with $P=2 \cdot Q \cdot R \cdot S \cdot t+1$ for discrete logarithm? How to enhance/compare?

To get some certain properties for my use case I need a prime $P$ which has the form: $P=2\cdot Q \cdot R \cdot S \cdot t+1$ with $Q,R,S,t$ primes as well. Why that form - Use case Together with ...
0
votes
2answers
35 views

The opponent possesses a string of ciphertext and has access to the encryption machinery as black box. What is the name of this attack?

a quick example: The encryption function: y = E(x) = (13x + 9)(mod 27), when the letters A–Z are taken to be the numbers 0–25 and the Space (punctuation) is the number 26. The opponent has the ...
1
vote
1answer
31 views

Randomization attack in voting protocols

I'm looking into coercion-resistant voting schemes and one of the key elements of coercion-resistance is resistance to randomization attacks. Juels et al. define a randomization attack as one where ...
1
vote
1answer
160 views

How does the CBC Padding Oracle Attack work in General?

Right now we don't have a single generalized question asking how the CBC padding oracle attack works. We have e.g. this one and this one but the former is distracted by the concrete values being ...
1
vote
1answer
210 views

Cipher Block Chaining - How do you change the plaintext of all blocks?

I've just read about CBC encryption and decryption and was wondering how you can change every plaintext block? Let's say you have an initialization vector, 3 ciphertext blocks, know each block-cipher-...
16
votes
4answers
9k views

How can C rand() be exploited if a secure seed is used?

I've just started doing a research project on CSPRNGs and I would like to know what kind of vulnerabilities a regular PRNG has with a secure seed. For example, if I generate a random number using ...
1
vote
1answer
68 views

Probabilistic padding to avoid Håstad’s Broadcast Attack

Can someone explain why probabilistic padding like OAEP is particularly useful for avoiding Håstad’s Broadcast Attack? I don't really get the reason why.
-1
votes
2answers
686 views

Can Shamir’s Trick crack the cryptographic strength of ECDSA?

Recently stumbled upon a discussion in the forum What is Shamir’s Trick used for? Are there any such examples?
1
vote
1answer
55 views

Does a different exponent and base but same key help to resolve discrete logarithm?

E.g.: $k = N^a \mod P$ The attacker knows the prime $P$ and $N$, which is also a prime and (1.) prime root of $P$ or (2.) has a cycle size of $s$, so $1 = N^s \mod P$, (and for $\forall s'<s$, $...
0
votes
0answers
54 views

Unique numbers with $P^aQ^bR^c \mod N$ for each combination of $a,b,c$ possible? Would it be safer than separate form (like $T^a \mod P$ for each)?

Main question: Is the computation of $a,b,c$ in $P^aQ^bR^c \mod N$ (much) harder than in $T_p^a \mod P$, $T_q^b \mod Q$, $T_r^c \mod R$ ? (assuming the first form exists) $P^aQ^bR^c \mod N$ With $P^...
0
votes
1answer
44 views

How much more secure is $c = mg_1^r + g_2(g_1(g_1^r-1)/(g_1-1)) \mod p$ compared to just $c = mg_1^r \mod p$ (dis. log), all known but $r$?

To encode a message $m$ to a cipher $c$ you can use the only hard solvable problem of computing the discrete logarithm with a generator $g$ in base over a prime $p$. $c = mg_1^r$ mod p If an ...
0
votes
1answer
173 views

Example of product cipher more secure than its components

Can anyone give me an example of a product cipher which more secure than its components. Here is how the explanation should proceed. There is cipher C1 which can be attacked with the technique A1, ...
1
vote
0answers
345 views

RSA encryption extremely large public exponent

I'm trying to do learn a bit about RSA by doing CTF's and now I am doing one problem probably more than 7 hours so I would really appreciate a hint here from an expert. I have an encrypted message $c$...
1
vote
0answers
98 views

Weak/Vulnerable AES Implementations [closed]

I'm trying to complete a cryptography CTF challenge in which I have a cipher I'm supposed to attain the original plaintext from. I have reason to believe it's been encrypted using AES, but I'm unaware ...
2
votes
3answers
2k views

When is a cipher considered broken?

We've all read how some people claim AES is broken because there was supposedly a way to get the plain text from a cipher text faster than brute-force. But is this the definition? Is a cipher broken ...
7
votes
1answer
117 views

How complex must round constants be to resist slide attacks?

A key schedule that generates round keys by XORing a round constant with the key is linear and can be vulnerable to related key attacks, but let's ignore that for now. Constants are necessary to avoid ...
0
votes
0answers
65 views

Prove that a given signature scheme is secure under random message attacks

This is a follow up to my previous question. Consider the following signature scheme: $\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $...