Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

Filter by
Sorted by
Tagged with
1 vote
1 answer
13 views

Differential uniformity of vectorial Boolean function

What could we say about differential uniformity of (a vectorial Boolean function) $F = f+g \pmod 2$ (i.e. XOR) in terms of differential uniformity of $f$ and $g$?
Ranit Dutta's user avatar
1 vote
0 answers
23 views

I do not understand the result of 'proposition 2' of "MDx-MAC and building fast MACs from hash functions"

I saw the difference between the proof and the statement of "proposition 2" in the paper "MDx-MAC and building fast MACs from hash functions" by Bart Preneel & Paul C. van ...
hellobc's user avatar
  • 31
1 vote
0 answers
131 views

Need help with Cryptohack's ProSign 3 ECDSA problem [closed]

I'm trying to solve the CTF challenge called ProSign 3 at Cryptohack platform which involves exploiting an ECDSA signing service that allows us to sign a fixed message being padded with the time ... ...
YazeedAllabadi24's user avatar
0 votes
0 answers
40 views

Reaching the bound of Boneh and Durfee Attack

According to the paper, theoretically,we can get $\delta=0.292 \lt 1-\frac{1}{\sqrt{2}}$,but how to set the lattice and implement it in sagemath? I generated some data by ...
Cred Mao's user avatar
1 vote
0 answers
98 views

Security of $E(c,k) = AES(c,(k \oplus c)\cdot (2^{n} - 1 - c)) $ used multiple times with low bit keys $k$. Avoids MitmA?

More precisely the Encryption function will be $E(c_i,k_i,i)$ with a 128-bit cipher/number $c_i$, a 16-bit encryption key $k_i$ and a 8-bit index $i$ as input using a Xor key obfuscation $k'$ with ...
J. Doe's user avatar
  • 453
0 votes
1 answer
41 views

Vulnerabilities of a word-level substitution cipher

What kind of attacks would be possible against this kind of substitution cipher? Every word in the plaintext is to be replaced with a random string of the same length The encryption of any given word ...
u2892's user avatar
  • 1
1 vote
1 answer
57 views

What's the difference between these two attacks?(Lim Lee and Sub group) I am a beginner can someone explain in detail?

I am reading collin boyd textbook to learn MTI key agreement and various attacks on them . I encountered two such attacks called Small sub group attack and Lim-Lee attack where in Small sub group ...
whatisLimlee's user avatar
0 votes
0 answers
48 views

RSA decrypt using Openssl error : Public Key operation error

Hello im got stuck at ctf crypto challenge, so at the challenge is given 3 file which is flag.enc pub.key priv.key , so i tried to decrypt using openssl here is ...
iykyk's user avatar
  • 1
2 votes
1 answer
69 views

Small subgroup attack when using a Schnorr group for DHKE

One uses a Schnorr group both for Schnorr signature (or DSA), and for Diffie-Hellman Key Exchange. They target 128-bit security, and choose prime $q$ that's 256-bit, prime $p=q\,r+1$ that's 3072-bit, ...
fgrieu's user avatar
  • 141k
1 vote
0 answers
117 views

Different public keys $(e_i,N_i)$ but same decryption exponent $d$

We are given a number of distinct RSA public keys $(e_i,N_i)$ sharing the same unknown decryption exponent $d$. The $e_i$ were computed from $d$ drawn first, so we have different public keys. Can we ...
Pyp's user avatar
  • 11
0 votes
1 answer
46 views

What does it mean the "Distinguisher" in LWE decision version?

As we know in block ciphers, the distinguisher means that despite thousands ciphertexts (and plaintexts), allows an attacker to distinguish the encrypted data from random data. This attack is ...
R_Jalaei's user avatar
  • 141
3 votes
2 answers
83 views

Breaking a 'Many' - Time Pad [closed]

I'm working on a problem, where given 12 ciphertexts, I'm trying to decode the 12th and find out the key. I've implemented a crib dragging attack, where the crib is a purely guessed word (not known/...
k0redump's user avatar
0 votes
0 answers
83 views

Algorithm attack on an hash attack (Python)

Here is an attempt at a Python implementation of what is described in the paper I attached as an image. The algorithm is too slow or there is something wrong with the code. Any ideas! ...
surimaji's user avatar
1 vote
0 answers
155 views

How to achieve $d-$privacy considering some secrets?

We have a set of secrets $S = \{x_1, x_2, \dots, x_n\}$ known to an adversary. Each $x_i \in S$ belongs to user $u_i$ who needs to obfuscate his secret using the notion of $d-$privacy defined in the ...
Amirhossein Adavoudi's user avatar
1 vote
0 answers
165 views

Help with HMAC Known plaintext / mac puzzle

Finally caving and asking for help...I'm not in the field, just doing random CTF challenges to learn more and I've really been enjoying it in general. However, I'm totally stuck on this puzzle at the ...
Heath's user avatar
  • 13
1 vote
0 answers
86 views

Time-memory tradeoffs in RSA Meet-in-the-Middle attack

We assume a standard secure RSA public key $(n,e)$, e.g. 3072-bit $n$ and $e=65537$. The Meet-in-the-Middle attack (not to be confused with Man-in-the-Middle attack) on textbook RSA recovers $m$ from $...
fgrieu's user avatar
  • 141k
3 votes
3 answers
402 views

"crandall" - unsolved CTF challenge - ASIS-quals-2023

...
akonzu's user avatar
  • 57
4 votes
1 answer
164 views

Is this new bound for Wiener Attack well accepted?

I found this recent paper The Wiener Attack on RSA Revisited: A Quest for the Exact Bound, which reported a new bound $d\le \frac 1 {\sqrt[4]{18}} N^\frac 1 4$. Is this well accepted in the ...
Zixi Sean's user avatar
  • 159
0 votes
1 answer
91 views

Primal attack On Kyber algorithm specifications

In the Kyber Algorithm specifications document, chapter 5.1.2 primal attack, it says that: Given the matrix LWE instance $(A,b=As+e)$, one builds the lattice $\Lambda = \{x\in \mathbb{Z}^{m+kn+1}:(A\...
qiuxicj's user avatar
0 votes
1 answer
82 views

Nonce reuse in GMAC without ciphertext (only AAD)

As we all know, nonce reuse in AES/GCM can easily be catastrophic. However, I'm wondering if the same risks are present if an adversary has access to: Ciphertext and corresponding MAC of one message ...
Julian Durchholz's user avatar
0 votes
1 answer
245 views

RSA - Twin Primes across two messages

This was a CTF challenge I was unable to solve, but I thought I may had come close. We were given two $N$'s $N_1$ and $N_2$ each calculated with $P_1 \times Q_1$ and $P_2 \times Q_2$; however, $P_1 = ...
Nasica's user avatar
  • 1
2 votes
2 answers
177 views

A question about "attacks on MAC key space"

At page 336 in "Handbook of Applied Cryptography - Menezes", I see the sentence For $n$-bit MAC with $t$-bit key space this requires $2^t$ MAC operations, after which one expects $1+2^{(t-n)...
hellobc's user avatar
  • 31
1 vote
1 answer
559 views

A RSA crypto CTF chanllenge with known private key ,cipher text and modules factor n

Here is a CTF chanllege about RSA(The competition has ended for serval hours),and here is the critical encryption code: ...
Ayumi80s's user avatar
0 votes
0 answers
35 views

How by changing ciphertext can the attacker know the length of the padding in POODLE attack

I try to understand the POODLE attack. I read that the attacker try to change one byte of the last block of the ciphertext. Becasue the last block is only have padding and the last byte is the padding ...
eitan's user avatar
  • 31
1 vote
0 answers
29 views

Can an attacker impersonate any party in a modified Needham-Schroeder protocol?

We are doing symmetric Needham-Schroeder protocol in university. We were provided a modified protocol and needed to answer the following questions. Original protocol: Modified protocol: Task a) An ...
PCFX's user avatar
  • 63
3 votes
1 answer
69 views

how 0/n split prevent BEAST attack against TLS?

I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way? ...
eitan's user avatar
  • 31
0 votes
1 answer
940 views

RSA Oracle - CTF

I am trying to solve a challenge regarding a RSA oracle which allows me to encrypt/decrypt any plaintext/ciphertext I want, but there are a few checks that I have to bypass, and my goal is to decrypt ...
Shark44's user avatar
  • 145
2 votes
1 answer
763 views

CTF - AES Padding Oracle [closed]

I am trying to solve another CTF challenge. The challenge consists in trying to exploit an oracle that decrypts any hex text we send (see code below). I am kind of stuck on this one as this is not a ...
Shark44's user avatar
  • 145
2 votes
1 answer
835 views

CTF - DES Challenge

I am trying to solve a CTF challenge based on DES. I attached the code of the challenge to the question. So far I have noticed that the otp used for the encryption is the same for the entire session, ...
Shark44's user avatar
  • 145
0 votes
0 answers
1k views

AES CBC - Find IV (CTF)

I am currently trying to solve a training challenge based on AES with CBC. This is the infos I'm given: ...
Shark44's user avatar
  • 145
0 votes
0 answers
39 views

The specific nature of a 51% attack - in relation to a multiple choice question that I was marked as incorrect on

In a course I'm taking the following question came up: ...
phoenixestant's user avatar
1 vote
1 answer
114 views

Use of PRNG's vulnerability for attacking a cryptographic system

I am investigating a PRNG which fails some of NIST tests (FFT, ApproximateEntropy and Serial). If such a generator is used in cryptography for any purpose, what consequences can it has? How this ...
user110019's user avatar
2 votes
1 answer
106 views

Bit flipping attack in hash function for message authentication

In this picture we have a use of a hash function for message authentication. M is plaintext message. H is hash function. E is encryption block with K symmetric key. || is concatenation of plaintext M ...
Allexj's user avatar
  • 143
5 votes
1 answer
449 views

Leaking key when adding small order point

I was (trying to) read the following paper: https://eprint.iacr.org/2015/673.pdf Page 2 says: A related attack is to replace a point P with P + T, where T lies in a small subgroup. If the user ...
Enthusiast's user avatar
1 vote
1 answer
400 views

Solve congruent equation likes N = p*q c1 = (2*p + 3*q)**e1 mod N c2 = (5*p + 7*q)**e2 mod N

Here is a CTF crypto challenge likes(its write up is public on https://ctftime.org/writeup/15438): $$N = p*q\\ c1 = (2*p + 3*q)^{e_{1}} mod N\\ c2 = (5*p + 7*q)^{e_{2}} mod N$$ After i transform these:...
Ayumi80s's user avatar
1 vote
0 answers
91 views

Predicting compromised OpenSSL 3.0 DRBG

The OpenSSL 3.0 rand function's DRBG uses the getrandom() system call to get 48 bytes of secure entropy from the kernel. It also ...
Wesley Jones's user avatar
2 votes
1 answer
297 views

Best practices on implementing a password manager

I'm a dev new to security and cryptography. I'm writing a password manager and Time-based OTP combo in dart/flutter to use in multiple devices and platform for fun and use it personally for real. I ...
anthonychwong's user avatar
2 votes
1 answer
76 views

The second moment and fourth moment of $\mathcal{P}(V)$?

Backgroud: I am reading the paper "Learning a Parallelepiped: Cryptanalysis of GGH and NTRU Signatures". (here is the link). And I got stuck in understanding the computation of moment. ...
zbo's user avatar
  • 75
2 votes
1 answer
188 views

Double Ratchet Algorithm: Active Man in the Middle Attack without Root-Key or Ratchet-Key

I am currently studying the Double Ratchet Algorithm from Signal (link to the documentation). I stepped over a security issue which I was not able to find that it was mentioned anywhere. I assume that ...
p_1092131280's user avatar
1 vote
0 answers
93 views

Are Veracrypt, XTS and flash memory attacks feasible?

Some time ago I had a question here about WinRAR security and probably the most common recommendation I came across was to use Veracrypt. Veracrypt uses XTS, but according to others, XTS encryption is ...
Hasbo's user avatar
  • 13
2 votes
0 answers
134 views

How can I extend the RSA LSB Oracle attack, to n-LSBs?

Suppose we have an RSA-Oracle that can encrypt and decrypt our input. The the decryption output is equal to: $ (C^d \mod N) \mod 2^n $. How can I extend the LSB oracle attack, using the using ...
Jamal's user avatar
  • 21
3 votes
1 answer
66 views

Cost of attacking textbook RSA signature of $b$-bit hash of the message

A signature system applies textbook RSA to a $b$-bit hash of the message. What's the cost (preferably, as CPU time on common hardware) of existential forgery assuming known signature of $r$ random ...
fgrieu's user avatar
  • 141k
2 votes
1 answer
722 views

Crack RSA with $e$ and $d$?

Is it possible to decipher a ciphertext, in RSA with small primes (two 128-bit factors) when we only have ciphertext $c$, private exponent $d$ and public exponent $e=65537$ to crack it? I try hard on ...
Siyanew's user avatar
  • 121
1 vote
2 answers
485 views

Stuck on a cryptanalytical research project [closed]

This is not a technical question, but rather it seeks advice on what to do if cryptanalytical research goes wrong. I've discovered a new attack that works great in theory, but in practice, it fails. I ...
MayDen's user avatar
  • 11
5 votes
1 answer
1k views

Is it insecure to sign the value 0 with ElGamal?

Is it insecure to sign the plaintext 0 with ElGamal signature algorithm? Can this leak the private key, give the possibility to forge other signatures or does provide any other attack vector?
PCFX's user avatar
  • 63
1 vote
1 answer
237 views

Decentralized identity, how to prevent duplicate uses of the same identity

In a system that relies on decentralized identity, is it possible to prevent duplicate uses of the same real-life identity, i.e. same real-life person creates more than one user entity (each is ...
rapt's user avatar
  • 91
3 votes
1 answer
307 views

Breaking Ed25519 Discrete Logarithm with Degenerate Curve Attack

Following this question ed25519 attacks and also this paper on degenerate curve attacks https://eprint.iacr.org/2015/1233.pdf, I tried to implement my own attack: Given a point (0, y) and a scalar (k),...
J Medeiros's user avatar
2 votes
1 answer
79 views

Significance of theoretical weaknesses?

What is the significance of theoretical weaknesses? Any real life incident where a theoretical weakness was ignored and later it compromised the system? Whats the dividing line between theoretical and ...
crypt's user avatar
  • 2,427
1 vote
1 answer
92 views

How does the security of AES change if we allow multiple uses in a row? How does it change if we limit the key space? And introduce a filter function?

$$f_0 = A$$ $$f_{n+1}=AES(f_n,k_n)$$ $$f_i = B$$ For given 128-bit values $A, B$ we want to find a chain of suitable 128-bit keys $k_1$ to $k_i$. The total length $i$ is undetermined. Every valid key ...
J. Doe's user avatar
  • 453
1 vote
0 answers
32 views

Does privacy-preserving linear (logistic ) regression necessary?

The linear regression is simply $y=Wx+b$, where the server holds $W$ and $b$ and the client holds $x$. The private linear regression means the client sends encrypted $x$ to the server, and receives ...
Zhengyi Li's user avatar

1
2 3 4 5
10