# Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

324 questions
Filter by
Sorted by
Tagged with
1answer
107 views

### Examples of Weak Cryptography being exploited in the wild by cybercriminals?

As a theorist, I often motivate the need for strong cryptography via simplistic methods, such as "If this did not exist, your online bank transactions would be vulnerable". This is of course ...
1answer
40 views

### Why is $\phi(N) = (p^2 -1) (q^2 - 1)$ here?

I was reading a paper on attacks on RSA variants, and the paper equates $\phi(N) = (p^2-1)(q^2-1)$. Before, I have always seen $\phi(N) = (p-1)(q-1)$ and don't understand why it is different here. I ...
2answers
184 views

### Is it possible to unscramble a scrambled ed25519 SSH key?

Let's say I generate an ed25519 SSH key with ssh-keygen -t ed25519. Then I take the private key file and randomly scramble the order of base64 encoded characters. ...
1answer
105 views

1answer
93 views

1answer
54 views

### How to attack Oblivious Transfer from a malicious sender that can deviate from the protocol

I am looking at at the $1–2 \space \text{oblivious transfer}$ that is described here: https://en.wikipedia.org/wiki/Oblivious_transfer#:~:text=In%20cryptography%2C%20an%20oblivious%20transfer,Rabin. I ...
0answers
39 views

### Complete crypto attack explanation or hierarchy including statistical attack, entropy attack, correlation attack, differential attack?

How exactly statistical attack(resistancy tested using histogram analysis), entropy attack(resistancy tested using entropy information), correlation attack(resistancy tested using correlation ...
0answers
49 views

### Known attacks against ECC in case many multiples are known?

Suppose there's a secret value x, an elliptic curve with the (public) generator G, and a sequence of secret values ...
2answers
1k views

### Can I alter encrypted data without decrypting it?

I didn't find a direct solution for it. Can I modify encrypted data without accessing it? If there is an example, I would appreciate it.
1answer
49 views

### AES 5 and 6 round SQUARE Attack

SQUARE attack on AES128 requires a single delta set for 4-round variant, or I assume single delta set is enough since keyspace is reduced to few keys which can be easily brute-forced. However, as we ...
0answers
51 views

### On the current memory retain limits for the coldboot attack (2020)

ColdBoot attack is introduced by Halderman et. al in 2009 Lest we remember: cold-boot attacks on encryption keys In their articles, they represent experimented that We found that the dimensions of ...
0answers
16 views

### Are there any mutual-distance bounding protocols in RFID context?

Distance-bounding algorithms are a classical solution for the Relay Attack, wherein a verifier can determine an upper bound on its distance from the prover. However, recent literature is discussing ...
0answers
29 views

### Boomerang attack - looking for simply explanation

Can someone explain to me in a simple way how it works? I know what differential cryptoanalysis is, but my knowledge is rather amateur. Nevertheless, reading the post on Wikipedia:Boomerang Attack I ...
1answer
167 views

### Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)

When you know the Salsa20's keystream, how do you know the next keystream? In other words, can I infer the next keystream when I don't know the Key and IV of Salsa20, but the keystream is ...
1answer
73 views

### Which RSA keys are actually attacked In practice?

I understand that it is important to check how hard it is to attack RSA keys, but I assume at some key size attackers would not even try. Real attacks are carried out by exploiting mistakes in the ...
1answer
62 views

### Security of a custom AES-based attack model

Provided that: $AES(plaintext, key)$ is the standard AES block cipher for a 128 bits block. $\oplus$ is the standard XOR operation. $K$ is a constant 128 bits pseudorandom value, which is used as the ...
0answers
71 views

### Breaking vulnerable ElGamal encryption

In a ctf, I encountered this problem: ...
1answer
70 views

### May an adversary be fooled by a random-looking input that in reality is fixed?

I want to prove the EUF-CMA-security of a signature scheme. It is a variation on an established scheme, therefore I would ideally like to reduce the new-scheme-security to the old-scheme-security. the ...
1answer
64 views

### When attacking keyed algorithms, how is it known when the output is correct?

I've been reading a little bit about cryptanalysis, and I'm wondering how attacking algorithms that work on keys is performed. It's obvious how algorithms like MD5 are attacked, in pseudocode: ...
1answer
142 views

### Cracking RSA with small plaintext

I read a CTF writeup about cracking 4 primes RSA numbers from here: Given $p, q, r,$ and $p+q+r$ are prime numbers. The challenge encrypts the flag with a modulus $N=(p∗q∗r)∗(p+q+r)$ and gives the ...
0answers
203 views

### The aftermath and considerations of the new record of 30750-Bit Binary Field Discrete Logarithm - 2020

Granger et al. recently published a paper about breaking a record for discrete logarithm on the Binary field Computation of a 30 750-Bit Binary Field Discrete Logarithm, Robert Granger and Thorsten ...
1answer
263 views

### What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI

What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI (Crypt32.dll) Could someone provide details?
0answers
62 views

### Understanding birthday attacks on 256 bit hashing and 512 bit hashing [duplicate]

Does it make a difference against birthday attacks if the algorithm that I am using is 512 bit hashing?
0answers
20 views

### Check linear and differential cryptanalysis of a new block cipher [duplicate]

I am developing a new block cipher primitive. I would like to test its robustness against attacks of linear and differential cryptanalysis. Is there a tool to evaluate this using only plaintext and ...
1answer
398 views

### Iterations of pollards kangaroo attack on elliptic curves

I want to understand the Pollard kangaroo attack on elliptic curves. I found this Pollard's kangaroo attack on Elliptic Curve Groups Q/A pretty helpful, but not complete. The posts provides a pretty ...
0answers
160 views

### MOV-attack on ecc: Time complexity and example

There already is this pretty big post about the MOV-attack. It states, that the discrete logarithm problem on elliptic curves can be transformed to a discrete logarithm problem over a finite field. ...
0answers
100 views

### Pollard Rho Optimization

One of the most important attacks on Elliptic Curve cryptography is Pollard's Rho method. The effect on security can be seen on SafeCurves. This attack is pretty old and there has been a bunch of ...
0answers
165 views

### Curve25519 Attacks and Security

Curve25519 is a pretty secure way to exchange a key. In the original Paper and on SafeCurves a lot of attacks and security aspects are mentioned: Attacks: Brute force: This one is theoretically ...
1answer
442 views

### Pohlig Hellman and small subgroup attacks

While studying Curve25519 I read about the small subgroup attack in chapter 3. So far i know, that you need a point with a small subgroup to do such an attack. Curve25519 has a basepoint with prime ...
1answer
67 views

### Proof by reduction for for digital signature scheme $S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$

Let $(Gen,S,V)$ be a secure signature scheme (existentially unforgeable under a chosen message attack) with message space${\{0,1\}}^n$. Generate two signing/verification key ...
2answers
236 views

### Adversary for attack on one variant of ElGamal

I came by the following question: Consider the following variant of ElGamal encryption. Let $p= 2q+ 1$, let $G$ be the group of squares modulo $p$ so $G$ is a subgroup of $Z_p^*$ of order $q$, and ...
0answers
81 views

### Which cryptographic attacks can AES 128-bit withstand?

Most of the articles and forums are stating that the Brute Force attack can test the strength of an encryption algorithm. However, I am looking for those attacks that AES can withstand for the testing ...
1answer
52 views

### How to solve high exponent attack for same message in RSA

I know Håstad's broadcast attack when e = 3, but what if e = getPrime(randint(350))?
0answers
111 views

### Can we defends against RSA Timing attack when we use java.math.BigInteger.modPow?

I think that Montgomery and sliding window techniques are applied within java.math.BigInteger.modPow (and more specifically ...
1answer
175 views

### Attack against $\operatorname{DESA}_{k,k_1} (x) \underset{\text{def}}= \operatorname{DES}_k(x)⊕k_1$

Problem 5.16 in this pdf, from the book: Christof Paar, Jan Pelzl, Understanding Cryptography 5.16. This is your chance to break a cryptosystem. As we know by now, cryptography is a tricky business. ...
1answer
478 views

### Why does the Bombe not consider the Ringstellung when determining stecker pairs?

I am doing research on the Bombe Machine, and I read that when the Bombe tries to find the stecker (plugboard) partners of letters, it only needs to use the rotor types and arrangement and also the "...
1answer
47 views

### Why are the indicator drums of a Bombe machine labelled from A to Z clockwise?

I am researching the Bombe Machine, having just completed a project on the Enigma Machine. I visited The Rutherford Journal - The Turing Bombe, and it claimed that The scales on the three ...
1answer
738 views

### Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password?

A malicious actor wants to decrypt ciphertext that was encrypted with a password. He also possesses the hash (bcrypt/PBKDF2) of that password. Does he have any significant practical advantage in ...
0answers
46 views

### Is Joux's multicollision attack applicable for truncated SHA256?

Joux presents an elegant way to generate k-way multi-collisions with about as much effort as generating a single collision: https://www.iacr.org/archive/crypto2004/31520306/multicollisions.pdf ...
2answers
472 views

### XOR cipher with fixed key and known relation among plaintexts

I have three messages, each known to be XOR-encoded, with the same key used for each message of this XOR cipher. Encoded message 1: $e_1\,=\,00100111010$ Encoded message 2: $e_2\,=\,01001110110$ ...
1answer
63 views

### Inside attack (attack from participants) in secret sharing

I have considered a $(t,n)$ secret sharing scheme with $n$ secret, say $a1,a2....an$. It's third party secure, but it has inside adversaries. While reconstructing secrets, a group of $t$ qualified ...
2answers
184 views

### Secret sharing scheme WITHOUT Shamir Secrete Sharing

I am planning to use the following XOR scheme to divide a secret into only 2 shares (I do not want to use Shamir Secret Sharing for different reasons that are beyond the scope of this post). Here's ...
1answer
44 views

### Can MFA codes be predicted if you know what their values were at a previous time?

I use an app on my phone that, after scanning a QR code on a website, gives me 6-digit codes which change every 30 seconds. These codes can be used for Multi-Factor Authentication (MFA) on some ...