Questions tagged [attack]
A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.
435
questions
2
votes
1
answer
59
views
4
votes
1
answer
149
views
Is this new bound for Wiener Attack well accepted?
I found this recent paper The Wiener Attack on RSA Revisited:
A Quest for the Exact Bound, which reported a new bound $d\le \frac 1 {\sqrt[4]{18}} N^\frac 1 4$. Is this well accepted in the ...
- 138k
1
vote
1
answer
205
views
Decentralized identity, how to prevent duplicate uses of the same identity
In a system that relies on decentralized identity, is it possible to prevent duplicate uses of the same real-life identity, i.e. same real-life person creates more than one user entity (each is ...
CommunityBot
- 1
0
votes
1
answer
75
views
Primal attack On Kyber algorithm specifications
In the Kyber Algorithm specifications document, chapter 5.1.2 primal attack, it says that:
Given the matrix LWE instance $(A,b=As+e)$, one builds the lattice $\Lambda = \{x\in \mathbb{Z}^{m+kn+1}:(A\...
- 3
0
votes
1
answer
56
views
Nonce reuse in GMAC without ciphertext (only AAD)
As we all know, nonce reuse in AES/GCM can easily be catastrophic.
However, I'm wondering if the same risks are present if an adversary has access to:
Ciphertext and corresponding MAC of one message
...
- 145k
0
votes
1
answer
177
views
RSA - Twin Primes across two messages
This was a CTF challenge I was unable to solve, but I thought I may had come close.
We were given two $N$'s $N_1$ and $N_2$ each calculated with $P_1 \times Q_1$ and $P_2 \times Q_2$; however, $P_1 = ...
2
votes
1
answer
464
views
CTF - AES Padding Oracle [closed]
I am trying to solve another CTF challenge. The challenge consists in trying to exploit an oracle that decrypts any hex text we send (see code below). I am kind of stuck on this one as this is not a ...
- 11
1
vote
0
answers
408
views
Need tips on how to break Fiat-Shamir sigma-protocol (programming challenge)
I'm completely stuck on an university programming challenge and I need some tips to get me out of the valley I'm in, you don't need to give the full answer if you do not wish to.
What we have:
Fiat ...
- 12k
11
votes
2
answers
3k
views
In textbook RSA with low public exponent, how big does a random message needs to be?
Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
- 138k
2
votes
2
answers
166
views
A question about "attacks on MAC key space"
At page 336 in "Handbook of Applied Cryptography - Menezes", I see the sentence
For $n$-bit MAC with $t$-bit key space this requires $2^t$ MAC operations, after which one expects $1+2^{(t-n)...
- 11
1
vote
1
answer
235
views
A RSA crypto CTF chanllenge with known private key ,cipher text and modules factor n
Here is a CTF chanllege about RSA(The competition has ended for serval hours),and here is the critical encryption code:
...
- 145k
0
votes
0
answers
34
views
How by changing ciphertext can the attacker know the length of the padding in POODLE attack
I try to understand the POODLE attack. I read that the attacker try to change one byte of the last block of the ciphertext. Becasue the last block is only have padding and the last byte is the padding ...
- 31
1
vote
0
answers
22
views
Can an attacker impersonate any party in a modified Needham-Schroeder protocol?
We are doing symmetric Needham-Schroeder protocol in university. We were provided a modified protocol and needed to answer the following questions.
Original protocol:
Modified protocol:
Task
a) An ...
- 63
3
votes
1
answer
56
views
how 0/n split prevent BEAST attack against TLS?
I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way?
...
- 145k
0
votes
1
answer
264
views
RSA Oracle - CTF
I am trying to solve a challenge regarding a RSA oracle which allows me to encrypt/decrypt any plaintext/ciphertext I want, but there are a few checks that I have to bypass, and my goal is to decrypt ...
- 227
2
votes
1
answer
399
views
CTF - DES Challenge
I am trying to solve a CTF challenge based on DES. I attached the code of the challenge to the question. So far I have noticed that the otp used for the encryption is the same for the entire session, ...
- 240
0
votes
0
answers
500
views
AES CBC - Find IV (CTF)
I am currently trying to solve a training challenge based on AES with CBC.
This is the infos I'm given:
...
- 145
0
votes
0
answers
36
views
The specific nature of a 51% attack - in relation to a multiple choice question that I was marked as incorrect on
In a course I'm taking the following question came up:
...
1
vote
1
answer
87
views
Use of PRNG's vulnerability for attacking a cryptographic system
I am investigating a PRNG which fails some of NIST tests (FFT, ApproximateEntropy and Serial). If such a generator is used in cryptography for any purpose, what consequences can it has? How this ...
- 138k
1
vote
1
answer
132
views
Is there any attack from a malicious adversary against semi-honest MPC protocol?
For semi honest MPC protocols, adding some errors can easily make the output wrong.
I wonder beyond that, can malicious adversaries make some attacks against semi-honest protocols to obtain private ...
CommunityBot
- 1
1
vote
1
answer
85
views
How does the security of AES change if we allow multiple uses in a row? How does it change if we limit the key space? And introduce a filter function?
$$f_0 = A$$
$$f_{n+1}=AES(f_n,k_n)$$
$$f_i = B$$
For given 128-bit values $A, B$ we want to find a chain of suitable 128-bit keys $k_1$ to $k_i$.
The total length $i$ is undetermined. Every valid key ...
CommunityBot
- 1
2
votes
1
answer
71
views
Bit flipping attack in hash function for message authentication
In this picture we have a use of a hash function for message authentication.
M is plaintext message. H is hash function. E is encryption block with K symmetric key. || is concatenation of plaintext M ...
2
votes
1
answer
185
views
Best practices on implementing a password manager
I'm a dev new to security and cryptography.
I'm writing a password manager and Time-based OTP combo in dart/flutter to use in multiple devices and platform for fun and use it personally for real. I ...
CommunityBot
- 1
5
votes
1
answer
426
views
Leaking key when adding small order point
I was (trying to) read the following paper: https://eprint.iacr.org/2015/673.pdf
Page 2 says:
A related attack is to replace a point P with P + T, where T lies in a small
subgroup. If the user ...
- 1,701
1
vote
0
answers
87
views
Are Veracrypt, XTS and flash memory attacks feasible?
Some time ago I had a question here about WinRAR security and probably the most common recommendation I came across was to use Veracrypt.
Veracrypt uses XTS, but according to others, XTS encryption is ...
- 452
1
vote
1
answer
254
views
Solve congruent equation likes N = p*q c1 = (2*p + 3*q)**e1 mod N c2 = (5*p + 7*q)**e2 mod N
Here is a CTF crypto challenge likes(its write up is public on https://ctftime.org/writeup/15438):
$$N = p*q\\
c1 = (2*p + 3*q)^{e_{1}} mod N\\
c2 = (5*p + 7*q)^{e_{2}} mod N$$
After i transform these:...
- 138k
1
vote
0
answers
74
views
Predicting compromised OpenSSL 3.0 DRBG
The OpenSSL 3.0 rand function's DRBG uses the getrandom() system call to get 48 bytes of secure entropy from the kernel. It also ...
- 91.7k
2
votes
1
answer
74
views
The second moment and fourth moment of $\mathcal{P}(V)$?
Backgroud: I am reading the paper "Learning a Parallelepiped: Cryptanalysis of GGH and NTRU Signatures". (here is the link). And I got stuck in understanding the computation of moment.
...
- 21.2k
2
votes
1
answer
124
views
Double Ratchet Algorithm: Active Man in the Middle Attack without Root-Key or Ratchet-Key
I am currently studying the Double Ratchet Algorithm from Signal (link to the documentation). I stepped over a security issue which I was not able to find that it was mentioned anywhere.
I assume that ...
- 1,701
0
votes
2
answers
856
views
Is it possible to break SHA-256 with hash tables?
If x is the value you're hashing, $t(x)$ is the hash of that value, and $t(x+s)$ is that value with salt, then hashed. You could create a hash table where the key is $t(x+s)$, the value is $x+s$, and ...
- 91.7k
2
votes
0
answers
103
views
How can I extend the RSA LSB Oracle attack, to n-LSBs?
Suppose we have an RSA-Oracle that can encrypt and decrypt our input. The the decryption output is equal to: $ (C^d \mod N) \mod 2^n $.
How can I extend the LSB oracle attack, using the using ...
- 33
9
votes
1
answer
696
views
Bleichenbacher RSA1024 signature forgery, closed-form solution
Hal Finney's writeup (Bleichenbacher's RSA signature forgery based on implementation error) shows a formula for RSA3072. I tried to replicate the attack for RSA1024 and failed, since the first term of ...
CommunityBot
- 1
3
votes
1
answer
49
views
Cost of attacking textbook RSA signature of $b$-bit hash of the message
A signature system applies textbook RSA to a $b$-bit hash of the message. What's the cost (preferably, as CPU time on common hardware) of existential forgery assuming known signature of $r$ random ...
- 21.9k
2
votes
1
answer
610
views
Crack RSA with $e$ and $d$?
Is it possible to decipher a ciphertext, in RSA with small primes (two 128-bit factors) when we only have ciphertext $c$, private exponent $d$ and public exponent $e=65537$ to crack it? I try hard on ...
- 138k
1
vote
2
answers
471
views
Stuck on a cryptanalytical research project [closed]
This is not a technical question, but rather it seeks advice on what to do if cryptanalytical research goes wrong.
I've discovered a new attack that works great in theory, but in practice, it fails.
I ...
- 11
5
votes
1
answer
965
views
Is it insecure to sign the value 0 with ElGamal?
Is it insecure to sign the plaintext 0 with ElGamal signature algorithm? Can this leak the private key, give the possibility to forge other signatures or does provide any other attack vector?
- 145k
3
votes
1
answer
236
views
Breaking Ed25519 Discrete Logarithm with Degenerate Curve Attack
Following this question ed25519 attacks and also this paper on degenerate curve attacks https://eprint.iacr.org/2015/1233.pdf, I tried to implement my own attack: Given a point (0, y) and a scalar (k),...
- 12.4k
2
votes
0
answers
110
views
The Primal and Dual attack security estimates in Kyber round 3 specification
In Kyber round 3 specification, the table 4 gave the security estimates of Primal and Dual attack with respect to Kyber 512, 768 and 1024 (see the figure below). However, using the python script given ...
- 15.1k
2
votes
1
answer
78
views
Significance of theoretical weaknesses?
What is the significance of theoretical weaknesses?
Any real life incident where a theoretical weakness was ignored and later it compromised the system? Whats the dividing line between theoretical and ...
- 91.7k
1
vote
0
answers
32
views
Does privacy-preserving linear (logistic ) regression necessary?
The linear regression is simply $y=Wx+b$, where the server holds $W$ and $b$ and the client holds $x$. The private linear regression means the client sends encrypted $x$ to the server, and receives ...
- 35
1
vote
0
answers
68
views
Non-uniform plaintext distribution -- AES attack
Are their any attacks on AES (any mode) in which before the attack is mounted, the adversary is aware that the input distribution is non-uniform?
Most of the work assume that the plaintext is ...
- 31
3
votes
1
answer
179
views
Can the BB'06 attack to PKCS padding be generalized?
As Bleichenbacher states, a wrong implementation of the parsing function of the padding could lead to a signature forgery attack when using a low exponent.
In the provided example he assumes the ...
- 138k
2
votes
1
answer
178
views
Trying to understand the 2nd subgroup in the Weil Pairing used for the MOV attack
EDIT: The bounty is actually to draw more attention. I accidentally chose the wrong reason.
$E$ – Elliptic Curve over finite field $\mathbb F_p$.
Let $k$ be the embedding degree of the Curve with ...
- 21.9k
1
vote
1
answer
8k
views
Hash Collision Probabilities
Please give help! how can I calculate the probability of collision? I need a mathematical equation for my studying.
Assume, I am using SHA256 to hash 100-bits. Thus:
SHA256 {100} = 256-bits (hash ...
- 47.5k
2
votes
1
answer
214
views
Generic attack on Hmac sha256
Is there any generic attack on HMAC SHA 256 ?
I am currently reading up on attacks on Hmac sha-256. However most of the papers I've found are about side channel attacks such as Differential power ...
- 5,786
1
vote
0
answers
76
views
How to solve a system of modular equations with exponential difference
I`m solving one crypto problem on rsa.
p^e - q^e = C1 (mod n)
(p-q)^e = C2 (mod n)
n = p*q*r; p,q,r are prime numbers
e = 2 * 65537
We have e, n, C1, C2.
It's ...
- 2,565
3
votes
2
answers
22k
views
Is it possible to break SHA-512?
Is it possible to break the SHA-512 hash algorithm?
Are there any successful attacks out there?
- 1
0
votes
1
answer
113
views
Various attacks on cipher-images & tools, especially stream-cipher?
What kind of attack of image encryption that exist out there, especially if the cipherimage was created using secure stream-cipher like Salsa20 (256 key) or ChaCha20 (256 key)?
From https://cr.yp.to/...
- 87
2
votes
1
answer
237
views
Do we always choose a generator of prime order for ECDH? If yes, then why?
I am looking at the description of Weil MOV Attack from the Vanstone, Menezes Book (Guide to Elliptic Curve Cryptograpy)
Suppose now that the prime order $n$ of $P \in E(F_q)$ satisfies
$gcd(n,q) = 1$...
- 21.9k
1
vote
0
answers
753
views
CTF AES attack (ECB, CBC, CFB, OFB, CTR) [closed]
Hi I'm trying to understand the logic behind a CTF challenge basically we are given a program which encrypt some data, we have the following options:
Select encryption mode (EBC, CBC, CTR, OFB, CFB)
...
