Questions tagged [attack]
A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.
71
questions
9
votes
2
answers
3k
views
What is a multi-target attack?
What exactly is a multi-target attack? How does the attack work on different cryptographic schemes (block ciphers, hash functions, elliptic curves)? How can it be avoided?
- 6,404
7
votes
1
answer
1k
views
Is the RSA signature attack from Desmedt and Odlyzko practical?
I would like to understand how the attack from the Desmedt and Odlyzko on RSA signatures (and subsequents works) can be made practical. This attack describes a way to forge the signature on a new ...
- 2,837
11
votes
2
answers
3k
views
In textbook RSA with low public exponent, how big does a random message needs to be?
Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
- 138k
9
votes
3
answers
16k
views
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.
Can I recover that key?
If, how big does the list of plaintext ...
- 201
4
votes
2
answers
2k
views
Is direct RSA encryption of AES keys secure?
I am wondering: If we take this scheme/procedure and each of it seems very secure (to me at least), is it truly secure or is there a vulnerability hidden in the process?
This is the scheme:
Bob has ...
- 87
17
votes
1
answer
19k
views
The difference between these 4 breaking Cipher techniques?
I'm trying to understand the difference between the following and what they actually mean :
Known plaintext attack
Known ciphertext attack
Chosen ciphertext attack
Chosen plaintext attack
Any ...
- 445
18
votes
1
answer
2k
views
What does a "real" quantum computer need for cryptanalysis and/or cryptographic attack purposes?
The cryptographic world has been buzzing the word "quantum" for a while now (even the NSA is currently preparing itself for a post-quantum crypto world) and quantum-related hardware engineering is ...
- 17.8k
18
votes
0
answers
481
views
The aftermath and considerations of the new record of 30750-Bit Binary Field Discrete Logarithm - 2020
Granger et al. recently published a paper about breaking a record for discrete logarithm on the Binary field
Computation of a 30 750-Bit Binary Field Discrete Logarithm, Robert Granger and Thorsten ...
- 47.5k
11
votes
1
answer
2k
views
Relation between attack and attack model for signatures
What is the relationship between an attack and an attack model?
For example, let $\Pi$ be the Lamport signature scheme. This signature has its security based on any one-way function. The Grover ...
- 2,661
-2
votes
2
answers
899
views
Relationship between a key stream having a high entropy and whether it is cryptically secure in a stream cipher
Hi i am trying to build a key stream generator for my homemade stream cipher.The key stream output has a close to maximum entropy value and a large periodicity. What does it take for this generator to ...
7
votes
1
answer
405
views
How safe is a prime with $P=2 \cdot Q \cdot R \cdot S \cdot t+1$ for discrete logarithm? How to enhance/compare?
To get some certain properties for my use case I need a prime $P$ which has the form:
$P=2\cdot Q \cdot R \cdot S \cdot t+1$
with $Q,R,S,t$ primes as well.
Why that form - Use case
Together with ...
- 573
6
votes
1
answer
536
views
What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI
What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI (Crypt32.dll)
Could someone provide details?
- 47.5k
3
votes
1
answer
2k
views
May and Coron's algorithm for factoring knowing RSA private key
According to this and this paper from Alexander May is possible to factor given the knowledge of the RSA private key.
This is possible via Coppersmith and LLL reduction.
Now I am trying to implement ...
2
votes
1
answer
610
views
Crack RSA with $e$ and $d$?
Is it possible to decipher a ciphertext, in RSA with small primes (two 128-bit factors) when we only have ciphertext $c$, private exponent $d$ and public exponent $e=65537$ to crack it? I try hard on ...
- 121
9
votes
1
answer
580
views
Are there any long term RC4 bias based exploits?
The RC4 cipher possibly exhibits low level bias in it's long run PRNG keystream. I'm specifically excluding short term bias attacks which I'm defining as outputs < 1024 bytes. Are there any real ...
- 15.1k
8
votes
1
answer
3k
views
Understanding Twist Security with respect to short Weierstrass curves
I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves.
That section claims ...
- 6,894
4
votes
1
answer
493
views
If PRESENT had different permutations, would that protect it against Statistical Saturation Attack?
The block cipher PRESENT is vulnerable to the Statistical Saturation Attack for up to 15 rounds (PDF) and a simple example is here.
My questions are if some (or all) of the permutations were changed:
...
- 1,025
3
votes
3
answers
3k
views
When is a cipher considered broken?
We've all read how some people claim AES is broken because there was supposedly a way to get the plain text from a cipher text faster than brute-force. But is this the definition?
Is a cipher broken ...
- 956
12
votes
5
answers
2k
views
What is the malicious potential of a key-substitution-attack?
What is the idea behind a key-substitution-attack?
We start from a given pair of message $m$ and signature $s(m)$. The signature can be verified by anybody in possess of the public key $y$:
$v(m, s, ...
- 1,477
11
votes
1
answer
4k
views
Is MD5 second-preimage resistant when used only on FIXED length messages?
I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient.
I have read a lot about MD5 security for this ...
- 343
10
votes
2
answers
789
views
Which attacks are possible against raw/textbook NTRU encryption?
In the same fashion that these questions about attacks to textbook RSA and ECC, I was wondering what are the immediate drawbacks of applying NTRU Encryption directly, without any padding scheme, such ...
- 4,942
9
votes
1
answer
3k
views
How can I attack a Triple-Block cipher with 2 keys (like 3DES) with a cost of ≤ 2⁵⁶
I am trying to solve something and I have but I have no idea anymore. Maybe anyone of you has an idea/solution/hint.
Given is a block cipher $F$ with key length $n$. It looks like this:
$$c = ENC_{k1}...
- 395
9
votes
3
answers
3k
views
SHA-1 collisions - what about practical attacks?
I understand the theoretical problem with hash collision but when it comes to practice, I get very confused.
Suppose a attacker would like to forge a certificate (or any kind of structured piece of ...
- 347
6
votes
0
answers
125
views
About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?
Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$
with
$$p=(p_1, p_2)$$
$$q=(q_1,q_2)$$
$$p_1,q_1 \in [0,s)$$
$$p_2,q_2 \in [0,s^2)$$
We want to find a path in between ...
- 573
6
votes
0
answers
342
views
Statistical saturation attack on block ciphers
I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack
against the Block Cipher ...
- 81
5
votes
1
answer
202
views
Could a strong round function be immune to slide attacks
An excerpt from the wikipedia article on slide attacks states:
...The only requirements for a slide attack to work on a cipher is that it can be broken down into multiple rounds of an identical F ...
- 19.5k
5
votes
0
answers
562
views
How hard is a known prefix hash preimage attack on SHA-2?
Suppose the attacker knows $X, Z$ such that
$H(X || Y) = Z$
If bit-length(Y) < 60 then a brute force attack is possible.
What if ...
- 1,867
4
votes
1
answer
5k
views
SHA-256 Partial Collision of initial 36 bits and more
I was lucky enough to, by brute force, have found two different messages, whose SHA-256 hashes collide in the first 9 hexadecimal characters, which are 36 bits, let'...
- 43
3
votes
2
answers
1k
views
XOR cipher with fixed key and known relation among plaintexts
I have three messages, each known to be XOR-encoded, with the same key used for each message of this XOR cipher.
Encoded message 1: $e_1\,=\,00100111010$
Encoded message 2: $e_2\,=\,01001110110$
...
- 31
3
votes
1
answer
593
views
Attacks on schemes based on elliptic curves when the transmitted points are not on the curve
Some elliptic curve schemes require to send a curve point during the normal execution of the protocol. For example, ElGamal encryption and ElGamal signature require this. On the other hand, ECDSA does ...
- 2,045
2
votes
1
answer
6k
views
Can you help me understand the RSA Broadcast Attack?
I am currently working on a broadcast attack on RSA. This is what I have:
17 ciphertexts $C_i$ and corresponding moduli $N_i$ for a single common message $m$.
Public key $e = 17$
The first part (of ...
- 395
30
votes
1
answer
5k
views
How was this 2048 bit number factored so fast?
I'm working on a CTF. The challenge is to get the contents of an encrypted message given the ciphertext and the 2048-bit RSA public key. I did finally get the flag after a few hours, but I'm still not ...
- 403
19
votes
2
answers
5k
views
How is encryption broken today?
There are often articles in the news that state that a certain country or hacker has been able to decrypt/hack highly protected systems: Some examples are the Lockheed Martin RQ-170 Sentinel that was ...
- 301
12
votes
2
answers
3k
views
How can I implement the elliptic curve MOV attack myself?
I understand and have implemented elliptic curve signatures in Python without the use of libraries like Sage, and would like to implement the MOV attack against certain weak types of elliptic curves.
...
- 121
7
votes
2
answers
1k
views
What are the implications of a birthday attack on a HMAC?
After collecting approximately $2^{n/2}$ message-tag pairs a collision can be observed. So two different messages (m1 and m2) will have the same tag.
This paper states:
Then, for any string x, (...
- 161
6
votes
1
answer
682
views
Can iterated hashing be used to mitigate collision and preimage weaknesses?
How much security does double hashing add regarding collisions and preimages? Is it helpful to iterate a hash function even more times than two?
For example, can MD5 be fixed (in practice) by ...
- 163
6
votes
1
answer
980
views
Iterations of pollards kangaroo attack on elliptic curves
I want to understand the Pollard kangaroo attack on elliptic curves. I found this Pollard's kangaroo attack on Elliptic Curve Groups Q/A pretty helpful, but not complete. The posts provides a pretty ...
- 2,120
5
votes
4
answers
7k
views
Would possessing a string with the SHA-256 hash of all zeros lead to an attack on SHA-256?
Would possessing a string with the SHA-256 hash of all zero bits lead to an attack on SHA-256?
I could easily imagine that a specialized attack leaked knowledge of how to do it, but I could equally ...
- 441
5
votes
1
answer
1k
views
Can a series of triangle reflections be used for cryptography?
(I guess no but why is this the case? Any way to make it possible?)
Out of a given equilateral triangle T1 (with his 3 vertices A,B,C lying in a finite Field $\mathbb F_N^D $) another equilateral ...
- 573
5
votes
1
answer
1k
views
Generate 64 bit HMAC
Given $plaintext$ and its respective authentication $tag$ which is generated from HMAC-MD5 so that $|tag| = 128$ bits.
If the application is constrained and can send only $64$ bits.
Is it ok, if we ...
- 6,134
4
votes
1
answer
2k
views
Is there a generic attack on encrypted CRC32 when used as a MAC?
I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break.
The ...
- 33
4
votes
1
answer
1k
views
Why is Diffie-Hellman Insecure If Order of the Generator Has Only Small Prime Factors?
In this post from security SE, Tom Leek mentioned that, for Diffie-Hellman to be secure order of the group $g$ should have a prime factor at least $2k$ bits long, where $k$ is the security parameter.
...
- 1,384
4
votes
1
answer
405
views
What is the largest parameter broken for NTRU?
The original secure parameters for NTRU shown below are from the original HPS98 paper. This is vastly different from the current secure suggested parameters in the NIST PQC round 3 submission.
...
- 237
4
votes
3
answers
890
views
One Time Pads and reuse of the decrypted message?
How is it insecure when Alice encrypts a message with a One-Time-Pad to Bob, and Bob then uses the decrypted message from Alice as the next One-Time-Pad?
For example: Alice sends Bob a message ...
- 43
4
votes
1
answer
903
views
RSA 1024 bit forge a new matching signature from a chosen message
I have an RSA signature scheme with 1024-bit key where I know the following:
Public modulus $N$
Public exponent $e=3$
A lot of signatures
Summary:
To compute a signature, an MD5 hash is calculated ...
- 251
3
votes
3
answers
1k
views
How much processing power should you assume an attacker has?
The answer to this question says that you should assume an attacker can do one billion operations per second: Key Size for Symmetric Homomorphic Encryption Over the Integers
Is that a single attacker ...
- 530
3
votes
3
answers
740
views
How can we prevent duplicate key attacks on digital signatures
A limitation digital signatures is that for a given signature σ of a message m corresponding to a public key pk, an adversary could generate a pk', sk' that produces a signature σ' for m, such that σ'...
- 41
3
votes
1
answer
180
views
Deriving user keys from ID
The "normal idea" is to generate a key per user, send them to the users (securely, of course), and store them in a database.
But what if I use a keyed hash (like Blake2b) with a server key and then ...
3
votes
1
answer
49
views
Cost of attacking textbook RSA signature of $b$-bit hash of the message
A signature system applies textbook RSA to a $b$-bit hash of the message. What's the cost (preferably, as CPU time on common hardware) of existential forgery assuming known signature of $r$ random ...
- 138k
3
votes
0
answers
646
views
Curve25519 Attacks and Security
Curve25519 is a pretty secure way to exchange a key. In the original Paper and on SafeCurves a lot of attacks and security aspects are mentioned:
Attacks:
Brute force: This one is theoretically ...
- 2,120