Skip to main content

Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

Filter by
Sorted by
Tagged with
11 votes
2 answers
4k views

What is a multi-target attack?

What exactly is a multi-target attack? How does the attack work on different cryptographic schemes (block ciphers, hash functions, elliptic curves)? How can it be avoided?
Conrado's user avatar
  • 6,494
7 votes
1 answer
1k views

Is the RSA signature attack from Desmedt and Odlyzko practical?

I would like to understand how the attack from the Desmedt and Odlyzko on RSA signatures (and subsequents works) can be made practical. This attack describes a way to forge the signature on a new ...
Dingo13's user avatar
  • 2,867
11 votes
2 answers
3k views

In textbook RSA with low public exponent, how big does a random message needs to be?

Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
fgrieu's user avatar
  • 142k
9 votes
3 answers
18k views

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? If, how big does the list of plaintext ...
Richard Jones's user avatar
4 votes
2 answers
2k views

Is direct RSA encryption of AES keys secure?

I am wondering: If we take this scheme/procedure and each of it seems very secure (to me at least), is it truly secure or is there a vulnerability hidden in the process? This is the scheme: Bob has ...
alberto123's user avatar
17 votes
1 answer
20k views

The difference between these 4 breaking Cipher techniques?

I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ...
Scarl's user avatar
  • 445
18 votes
1 answer
2k views

What does a "real" quantum computer need for cryptanalysis and/or cryptographic attack purposes?

The cryptographic world has been buzzing the word "quantum" for a while now (even the NSA is currently preparing itself for a post-quantum crypto world) and quantum-related hardware engineering is ...
e-sushi's user avatar
  • 18k
11 votes
1 answer
2k views

Relation between attack and attack model for signatures

What is the relationship between an attack and an attack model? For example, let $\Pi$ be the Lamport signature scheme. This signature has its security based on any one-way function. The Grover ...
juaninf's user avatar
  • 2,721
18 votes
0 answers
519 views

The aftermath and considerations of the new record of 30750-Bit Binary Field Discrete Logarithm - 2020

Granger et al. recently published a paper about breaking a record for discrete logarithm on the Binary field Computation of a 30 750-Bit Binary Field Discrete Logarithm, Robert Granger and Thorsten ...
kelalaka's user avatar
  • 49.1k
-2 votes
2 answers
962 views

Relationship between a key stream having a high entropy and whether it is cryptically secure in a stream cipher

Hi i am trying to build a key stream generator for my homemade stream cipher.The key stream output has a close to maximum entropy value and a large periodicity. What does it take for this generator to ...
Christian Shelton's user avatar
9 votes
1 answer
3k views

Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
Ruggero's user avatar
  • 7,104
7 votes
1 answer
431 views

How safe is a prime with $P=2 \cdot Q \cdot R \cdot S \cdot t+1$ for discrete logarithm? How to enhance/compare?

To get some certain properties for my use case I need a prime $P$ which has the form: $P=2\cdot Q \cdot R \cdot S \cdot t+1$ with $Q,R,S,t$ primes as well. Why that form - Use case Together with ...
J. Doe's user avatar
  • 453
6 votes
1 answer
618 views

What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI

What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI (Crypt32.dll) Could someone provide details?
kelalaka's user avatar
  • 49.1k
3 votes
1 answer
2k views

May and Coron's algorithm for factoring knowing RSA private key

According to this and this paper from Alexander May is possible to factor given the knowledge of the RSA private key. This is possible via Coppersmith and LLL reduction. Now I am trying to implement ...
Antonio Sanso's user avatar
2 votes
1 answer
778 views

Crack RSA with $e$ and $d$?

Is it possible to decipher a ciphertext, in RSA with small primes (two 128-bit factors) when we only have ciphertext $c$, private exponent $d$ and public exponent $e=65537$ to crack it? I try hard on ...
Siyanew's user avatar
  • 121
9 votes
1 answer
599 views

Are there any long term RC4 bias based exploits?

The RC4 cipher possibly exhibits low level bias in it's long run PRNG keystream. I'm specifically excluding short term bias attacks which I'm defining as outputs < 1024 bytes. Are there any real ...
Paul Uszak's user avatar
  • 15.6k
4 votes
1 answer
494 views

If PRESENT had different permutations, would that protect it against Statistical Saturation Attack?

The block cipher PRESENT is vulnerable to the Statistical Saturation Attack for up to 15 rounds (PDF) and a simple example is here. My questions are if some (or all) of the permutations were changed: ...
Red Book 1's user avatar
  • 1,025
3 votes
3 answers
4k views

When is a cipher considered broken?

We've all read how some people claim AES is broken because there was supposedly a way to get the plain text from a cipher text faster than brute-force. But is this the definition? Is a cipher broken ...
Vincent's user avatar
  • 966
2 votes
1 answer
7k views

Can you help me understand the RSA Broadcast Attack?

I am currently working on a broadcast attack on RSA. This is what I have: 17 ciphertexts $C_i$ and corresponding moduli $N_i$ for a single common message $m$. Public key $e = 17$ The first part (of ...
Donut's user avatar
  • 395
12 votes
5 answers
2k views

What is the malicious potential of a key-substitution-attack?

What is the idea behind a key-substitution-attack? We start from a given pair of message $m$ and signature $s(m)$. The signature can be verified by anybody in possess of the public key $y$: $v(m, s, ...
MichaelW's user avatar
  • 1,497
11 votes
1 answer
4k views

Is MD5 second-preimage resistant when used only on FIXED length messages?

I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient. I have read a lot about MD5 security for this ...
jcea's user avatar
  • 343
10 votes
2 answers
838 views

Which attacks are possible against raw/textbook NTRU encryption?

In the same fashion that these questions about attacks to textbook RSA and ECC, I was wondering what are the immediate drawbacks of applying NTRU Encryption directly, without any padding scheme, such ...
cygnusv's user avatar
  • 5,002
9 votes
1 answer
3k views

How can I attack a Triple-Block cipher with 2 keys (like 3DES) with a cost of ≤ 2⁵⁶

I am trying to solve something and I have but I have no idea anymore. Maybe anyone of you has an idea/solution/hint. Given is a block cipher $F$ with key length $n$. It looks like this: $$c = ENC_{k1}...
Donut's user avatar
  • 395
9 votes
3 answers
3k views

SHA-1 collisions - what about practical attacks?

I understand the theoretical problem with hash collision but when it comes to practice, I get very confused. Suppose a attacker would like to forge a certificate (or any kind of structured piece of ...
crypto-learner's user avatar
8 votes
1 answer
2k views

How does the ROCA attack work?

I have been trying to understand the ROCA attack described here as the "First Attack" and I cannot follow the explaination. I have been trying to generate a 512-bits key and crack it. As far as I can ...
John's user avatar
  • 81
6 votes
0 answers
137 views

About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?

Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$ with $$p=(p_1, p_2)$$ $$q=(q_1,q_2)$$ $$p_1,q_1 \in [0,s)$$ $$p_2,q_2 \in [0,s^2)$$ We want to find a path in between ...
J. Doe's user avatar
  • 453
6 votes
0 answers
582 views

How hard is a known prefix hash preimage attack on SHA-2?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...
SDL's user avatar
  • 1,887
6 votes
0 answers
345 views

Statistical saturation attack on block ciphers

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack against the Block Cipher ...
Slavi's user avatar
  • 81
5 votes
1 answer
203 views

Could a strong round function be immune to slide attacks

An excerpt from the wikipedia article on slide attacks states: ...The only requirements for a slide attack to work on a cipher is that it can be broken down into multiple rounds of an identical F ...
Ella Rose's user avatar
  • 19.7k
4 votes
1 answer
5k views

SHA-256 Partial Collision of initial 36 bits and more

I was lucky enough to, by brute force, have found two different messages, whose SHA-256 hashes collide in the first 9 hexadecimal characters, which are 36 bits, let'...
nvbach91's user avatar
4 votes
3 answers
2k views

How much processing power should you assume an attacker has?

The answer to this question says that you should assume an attacker can do one billion operations per second: Key Size for Symmetric Homomorphic Encryption Over the Integers Is that a single attacker ...
Alan Wolfe's user avatar
3 votes
2 answers
1k views

XOR cipher with fixed key and known relation among plaintexts

I have three messages, each known to be XOR-encoded, with the same key used for each message of this XOR cipher. Encoded message 1: $e_1\,=\,00100111010$ Encoded message 2: $e_2\,=\,01001110110$ ...
XOR_Help's user avatar
3 votes
1 answer
654 views

Attacks on schemes based on elliptic curves when the transmitted points are not on the curve

Some elliptic curve schemes require to send a curve point during the normal execution of the protocol. For example, ElGamal encryption and ElGamal signature require this. On the other hand, ECDSA does ...
Artjom B.'s user avatar
  • 2,065
30 votes
1 answer
5k views

How was this 2048 bit number factored so fast?

I'm working on a CTF. The challenge is to get the contents of an encrypted message given the ciphertext and the 2048-bit RSA public key. I did finally get the flag after a few hours, but I'm still not ...
rainbowkitty227's user avatar
19 votes
2 answers
5k views

How is encryption broken today?

There are often articles in the news that state that a certain country or hacker has been able to decrypt/hack highly protected systems: Some examples are the Lockheed Martin RQ-170 Sentinel that was ...
Quasar's user avatar
  • 301
12 votes
2 answers
4k views

How can I implement the elliptic curve MOV attack myself?

I understand and have implemented elliptic curve signatures in Python without the use of libraries like Sage, and would like to implement the MOV attack against certain weak types of elliptic curves. ...
Myria's user avatar
  • 121
7 votes
2 answers
1k views

What are the implications of a birthday attack on a HMAC?

After collecting approximately $2^{n/2}$ message-tag pairs a collision can be observed. So two different messages (m1 and m2) will have the same tag. This paper states: Then, for any string x, (...
Logan's user avatar
  • 161
6 votes
1 answer
1k views

Iterations of pollards kangaroo attack on elliptic curves

I want to understand the Pollard kangaroo attack on elliptic curves. I found this Pollard's kangaroo attack on Elliptic Curve Groups Q/A pretty helpful, but not complete. The posts provides a pretty ...
Titanlord's user avatar
  • 2,327
6 votes
1 answer
699 views

Can iterated hashing be used to mitigate collision and preimage weaknesses?

How much security does double hashing add regarding collisions and preimages? Is it helpful to iterate a hash function even more times than two? For example, can MD5 be fixed (in practice) by ...
boot4life's user avatar
  • 163
5 votes
1 answer
2k views

Can a series of triangle reflections be used for cryptography?

(I guess no but why is this the case? Any way to make it possible?) Out of a given equilateral triangle T1 (with his 3 vertices A,B,C lying in a finite Field $\mathbb F_N^D $) another equilateral ...
J. Doe's user avatar
  • 453
5 votes
4 answers
7k views

Would possessing a string with the SHA-256 hash of all zeros lead to an attack on SHA-256?

Would possessing a string with the SHA-256 hash of all zero bits lead to an attack on SHA-256? I could easily imagine that a specialized attack leaked knowledge of how to do it, but I could equally ...
Joshua's user avatar
  • 451
5 votes
1 answer
1k views

Generate 64 bit HMAC

Given $plaintext$ and its respective authentication $tag$ which is generated from HMAC-MD5 so that $|tag| = 128$ bits. If the application is constrained and can send only $64$ bits. Is it ok, if we ...
sashank's user avatar
  • 6,204
4 votes
1 answer
535 views

What is the largest parameter broken for NTRU?

The original secure parameters for NTRU shown below are from the original HPS98 paper. This is vastly different from the current secure suggested parameters in the NIST PQC round 3 submission. ...
evernal's user avatar
  • 237
4 votes
3 answers
898 views

One Time Pads and reuse of the decrypted message?

How is it insecure when Alice encrypts a message with a One-Time-Pad to Bob, and Bob then uses the decrypted message from Alice as the next One-Time-Pad? For example: Alice sends Bob a message ...
cryptodragon's user avatar
4 votes
1 answer
1k views

Why is Diffie-Hellman Insecure If Order of the Generator Has Only Small Prime Factors?

In this post from security SE, Tom Leek mentioned that, for Diffie-Hellman to be secure order of the group $g$ should have a prime factor at least $2k$ bits long, where $k$ is the security parameter. ...
satya's user avatar
  • 1,414
4 votes
1 answer
3k views

Is there a generic attack on encrypted CRC32 when used as a MAC?

I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break. The ...
Antikithira's user avatar
4 votes
1 answer
936 views

RSA 1024 bit forge a new matching signature from a chosen message

I have an RSA signature scheme with 1024-bit key where I know the following: Public modulus $N$ Public exponent $e=3$ A lot of signatures Summary: To compute a signature, an MD5 hash is calculated ...
itseeder's user avatar
  • 271
3 votes
3 answers
784 views

How can we prevent duplicate key attacks on digital signatures

A limitation digital signatures is that for a given signature σ of a message m corresponding to a public key pk, an adversary could generate a pk', sk' that produces a signature σ' for m, such that σ'...
Abrar Mahi's user avatar
3 votes
0 answers
738 views

Curve25519 Attacks and Security

Curve25519 is a pretty secure way to exchange a key. In the original Paper and on SafeCurves a lot of attacks and security aspects are mentioned: Attacks: Brute force: This one is theoretically ...
Titanlord's user avatar
  • 2,327
3 votes
1 answer
3k views

Pohlig Hellman and small subgroup attacks

While studying Curve25519 I read about the small subgroup attack in chapter 3. So far i know, that you need a point with a small subgroup to do such an attack. Curve25519 has a basepoint with prime ...
Titanlord's user avatar
  • 2,327