Questions tagged [attack]
A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.
465
questions
4
votes
1
answer
264
views
Attacks exploiting decryption failures in KYBER
I am going through the portion mentioned under the heading Original KYBER analysis inside Section 5.5 titled Attacks exploiting decryption failures.
$${\sf Pr}[\|v\|> k\sigma \sqrt{m}]< k^m e^{\...
- 25.5k
9
votes
3
answers
18k
views
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.
Can I recover that key?
If, how big does the list of plaintext ...
0
votes
1
answer
80
views
Vulnerabilities of a word-level substitution cipher
What kind of attacks would be possible against this kind of substitution cipher?
Every word in the plaintext is to be replaced with a random string of the same length
The encryption of any given word ...
CommunityBot
- 1
1
vote
1
answer
100
views
What's the difference between these two attacks?(Lim Lee and Sub group) I am a beginner can someone explain in detail?
I am reading collin boyd textbook to learn MTI key agreement and various attacks on them . I encountered two such attacks called Small sub group attack and Lim-Lee attack where in
Small sub group ...
CommunityBot
- 1
2
votes
1
answer
56
views
Is EC_POINT_is_on_curve a necessary check when using EC_POINT_mul in openssl?
I'm using EC_POINT_mul in OpenSSL, and I would like to avoid an invalid curve attack. I can see that there is a check for ...
- 11
2
votes
1
answer
114
views
How to find N and e knowing that e = p and N = p*q?
I've been stuck in this problem for a while, this is a challenge about Symmetric RSA:
We know that
$N = p*q$
$e = p$
$ct = pt^p \bmod N$ (1)
We are given $ct$ (which is the flag encrypted) and 4 ...
- 43
2
votes
0
answers
55
views
3
votes
1
answer
183
views
If KCI allows MitM attacks, how are ephemeral exchanges an effective mitigation?
Key Compromise Impersonation (KCI)(0,1) is a failure mode in Authenticated Key Exchanges (AKE) where a client $A$ has their static Diffie-Hellman (DH) identity key pair $(K_{priv}^{A_{ID}}, \space K_{...
- 14.1k
0
votes
1
answer
105
views
Is MOV attack against ECDLP fundamentally impossible?
The main idea of the MOV attack is to map EC additive group of order $n$ to multiplicative group in the finite field extension $p^k$. For this, the groups must have the same order, what fully relies ...
- 1
0
votes
0
answers
29
views
Is it possible to execute a plaintext attack on a slidefair cipher
there.
Ive got the cipher text: GKFJMNMJLRHLJKSMPFLMYCS
And an answer: EEADIHHHJFEFHENGLZGKWQP
The person that encrypted this ...
0
votes
0
answers
32
views
How to break a Vigenère cipher with a partial plaintext and key?
I have an question regarding Vigenère decryption. Is it possible to break a Vigenère with a partial answer key?
Ive got the cipher text: GKFJMNMJLRHLJKSMPFLMYCS
And ...
2
votes
0
answers
59
views
Trying to understand length recovery attack on EAP-MD5
I'm failing to understand how length recovery attack works in EAP-MD5 described in this paper on page 6: https://inria.hal.science/hal-01534313/document
I setup ...
- 71
0
votes
0
answers
35
views
Is the CFB mode of Encryption related-key secure
I am going through the paper https://www.iacr.org/archive/fse2013/84240283/84240283.pdf where the related key security of CBC mode of encryption is well analyzed. I am concerned about whether the CFB ...
0
votes
1
answer
92
views
Asymmetric encryption of the AES key made available along with the ciphertext
I know there are much more sophisticated encryption schemes than this one that achieve the same goal but I would like to understand any weaknesses in this basic, and probably typical, process:
...
CommunityBot
- 1
1
vote
1
answer
65
views
Necessity of all three MD-Compliant padding conditions
For Merkle-Damgård hashing, MD-compliant padding is defined as any padding scheme satisfying:
$M$ is a prefix of $\text{Pad}(M)$
$|M_1|=|M_2|\Rightarrow |\text{Pad}(M_1)|=|\text{Pad}(M_2)|$
$|M_1|\...
- 49.3k
1
vote
1
answer
101
views
Is it possible to break a DSA with k that increases statically?
I am currently studying cryptography. I came across this problem:
I had an exercise that as a vulnerability had that k is generated every 10 seconds:
...
- 9,682
9
votes
2
answers
689
views
Is NTRU broken?
Today a new paper appeared on ePrint, "Improved Provable Reduction of NTRU and Hypercubic Lattices". It claims that:
this is the first provable result showing that breaking NTRU lattices ...
- 1,356
1
vote
1
answer
54
views
Differential uniformity of vectorial Boolean function
What could we say about differential uniformity of (a vectorial Boolean function) $F = f+g \pmod 2$ (i.e. XOR) in terms of differential uniformity of $f$ and $g$?
- 49.3k
1
vote
0
answers
69
views
I do not understand the result of 'proposition 2' of "MDx-MAC and building fast MACs from hash functions"
I saw the difference between the proof and the statement of "proposition 2" in the paper "MDx-MAC and building fast MACs from hash functions" by Bart Preneel & Paul C. van ...
- 94k
1
vote
0
answers
281
views
Need help with Cryptohack's ProSign 3 ECDSA problem [closed]
I'm trying to solve the CTF challenge called ProSign 3 at Cryptohack platform which involves exploiting an ECDSA signing service that allows us to sign a fixed message being padded with the time ... ...
- 59
1
vote
0
answers
101
views
Security of $E(c,k) = AES(c,(k \oplus c)\cdot (2^{n} - 1 - c)) $ used multiple times with low bit keys $k$. Avoids MitmA?
More precisely the Encryption function will be $E(c_i,k_i,i)$ with a 128-bit cipher/number $c_i$, a 16-bit encryption key $k_i$ and a 8-bit index $i$ as input using a
Xor key obfuscation $k'$ with ...
- 453
0
votes
0
answers
74
views
Reaching the bound of Boneh and Durfee Attack
According to the paper, theoretically,we can get $\delta=0.292 \lt 1-\frac{1}{\sqrt{2}}$,but how to set the lattice and implement it in sagemath? I generated some data
by
...
- 25.5k
0
votes
0
answers
667
views
RSA decrypt using Openssl error : Public Key operation error
Hello im got stuck at ctf crypto challenge, so at the challenge is given 3 file which is
flag.enc pub.key priv.key
,
so i tried to decrypt using openssl here is ...
- 1
2
votes
1
answer
93
views
Small subgroup attack when using a Schnorr group for DHKE
One uses a Schnorr group both for Schnorr signature (or DSA), and for Diffie-Hellman Key Exchange. They target 128-bit security, and choose prime $q$ that's 256-bit, prime $p=q\,r+1$ that's 3072-bit, ...
- 144k
1
vote
0
answers
247
views
Help with HMAC Known plaintext / mac puzzle
Finally caving and asking for help...I'm not in the field, just doing random CTF challenges to learn more and I've really been enjoying it in general. However, I'm totally stuck on this puzzle at the ...
- 13
1
vote
1
answer
262
views
Decentralized identity, how to prevent duplicate uses of the same identity
In a system that relies on decentralized identity, is it possible to prevent duplicate uses of the same real-life identity, i.e. same real-life person creates more than one user entity (each is ...
CommunityBot
- 1
0
votes
1
answer
54
views
What does it mean the "Distinguisher" in LWE decision version?
As we know in block ciphers, the distinguisher means that despite thousands ciphertexts (and plaintexts), allows an attacker to distinguish the encrypted data from random data. This attack is ...
- 13.8k
1
vote
0
answers
145
views
Different public keys $(e_i,N_i)$ but same decryption exponent $d$
We are given a number of distinct RSA public keys $(e_i,N_i)$ sharing the same unknown decryption exponent $d$. The $e_i$ were computed from $d$ drawn first, so we have different public keys. Can we ...
- 144k
3
votes
2
answers
105
views
Breaking a 'Many' - Time Pad [closed]
I'm working on a problem, where given 12 ciphertexts, I'm trying to decode the 12th and find out the key. I've implemented a crib dragging attack, where the crib is a purely guessed word (not known/...
- 94k
0
votes
0
answers
103
views
Algorithm attack on an hash attack (Python)
Here is an attempt at a Python implementation of what is described in the paper I attached as an image.
The algorithm is too slow or there is something wrong with the code. Any ideas!
...
- 1
1
vote
0
answers
156
views
How to achieve $d-$privacy considering some secrets?
We have a set of secrets $S = \{x_1, x_2, \dots, x_n\}$ known to an adversary. Each $x_i \in S$ belongs to user $u_i$ who needs to obfuscate his secret using the notion of $d-$privacy defined in the ...
1
vote
0
answers
94
views
Time-memory tradeoffs in RSA Meet-in-the-Middle attack
We assume a standard secure RSA public key $(n,e)$, e.g. 3072-bit $n$ and $e=65537$.
The Meet-in-the-Middle attack (not to be confused with Man-in-the-Middle attack) on textbook RSA recovers $m$ from $...
- 144k
3
votes
3
answers
500
views
4
votes
1
answer
183
views
Is this new bound for Wiener Attack well accepted?
I found this recent paper The Wiener Attack on RSA Revisited:
A Quest for the Exact Bound, which reported a new bound $d\le \frac 1 {\sqrt[4]{18}} N^\frac 1 4$. Is this well accepted in the ...
- 144k
0
votes
1
answer
122
views
Primal attack On Kyber algorithm specifications
In the Kyber Algorithm specifications document, chapter 5.1.2 primal attack, it says that:
Given the matrix LWE instance $(A,b=As+e)$, one builds the lattice $\Lambda = \{x\in \mathbb{Z}^{m+kn+1}:(A\...
- 3
0
votes
1
answer
119
views
Nonce reuse in GMAC without ciphertext (only AAD)
As we all know, nonce reuse in AES/GCM can easily be catastrophic.
However, I'm wondering if the same risks are present if an adversary has access to:
Ciphertext and corresponding MAC of one message
...
- 150k
0
votes
1
answer
314
views
RSA - Twin Primes across two messages
This was a CTF challenge I was unable to solve, but I thought I may had come close.
We were given two $N$'s $N_1$ and $N_2$ each calculated with $P_1 \times Q_1$ and $P_2 \times Q_2$; however, $P_1 = ...
2
votes
1
answer
959
views
CTF - AES Padding Oracle [closed]
I am trying to solve another CTF challenge. The challenge consists in trying to exploit an oracle that decrypts any hex text we send (see code below). I am kind of stuck on this one as this is not a ...
- 11
1
vote
0
answers
424
views
Need tips on how to break Fiat-Shamir sigma-protocol (programming challenge)
I'm completely stuck on an university programming challenge and I need some tips to get me out of the valley I'm in, you don't need to give the full answer if you do not wish to.
What we have:
Fiat ...
- 14.1k
11
votes
2
answers
3k
views
In textbook RSA with low public exponent, how big does a random message needs to be?
Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
- 144k
2
votes
2
answers
187
views
A question about "attacks on MAC key space"
At page 336 in "Handbook of Applied Cryptography - Menezes", I see the sentence
For $n$-bit MAC with $t$-bit key space this requires $2^t$ MAC operations, after which one expects $1+2^{(t-n)...
- 11
1
vote
1
answer
784
views
A RSA crypto CTF chanllenge with known private key ,cipher text and modules factor n
Here is a CTF chanllege about RSA(The competition has ended for serval hours),and here is the critical encryption code:
...
- 150k
0
votes
0
answers
36
views
How by changing ciphertext can the attacker know the length of the padding in POODLE attack
I try to understand the POODLE attack. I read that the attacker try to change one byte of the last block of the ciphertext. Becasue the last block is only have padding and the last byte is the padding ...
- 31
1
vote
0
answers
33
views
Can an attacker impersonate any party in a modified Needham-Schroeder protocol?
We are doing symmetric Needham-Schroeder protocol in university. We were provided a modified protocol and needed to answer the following questions.
Original protocol:
Modified protocol:
Task
a) An ...
- 63
3
votes
1
answer
79
views
how 0/n split prevent BEAST attack against TLS?
I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way?
...
- 150k
0
votes
1
answer
2k
views
RSA Oracle - CTF
I am trying to solve a challenge regarding a RSA oracle which allows me to encrypt/decrypt any plaintext/ciphertext I want, but there are a few checks that I have to bypass, and my goal is to decrypt ...
- 253
2
votes
1
answer
1k
views
CTF - DES Challenge
I am trying to solve a CTF challenge based on DES. I attached the code of the challenge to the question. So far I have noticed that the otp used for the encryption is the same for the entire session, ...
- 276
0
votes
0
answers
2k
views
AES CBC - Find IV (CTF)
I am currently trying to solve a training challenge based on AES with CBC.
This is the infos I'm given:
...
- 145
0
votes
0
answers
40
views
The specific nature of a 51% attack - in relation to a multiple choice question that I was marked as incorrect on
In a course I'm taking the following question came up:
...
1
vote
1
answer
138
views
Use of PRNG's vulnerability for attacking a cryptographic system
I am investigating a PRNG which fails some of NIST tests (FFT, ApproximateEntropy and Serial). If such a generator is used in cryptography for any purpose, what consequences can it has? How this ...
- 144k