Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

Filter by
Sorted by
Tagged with
0
votes
0answers
26 views

Is Joux's multicollision attack applicable for truncated SHA256?

Joux presents an elegant way to generate k-way multi-collisions with about as much effort as generating a single collision: https://www.iacr.org/archive/crypto2004/31520306/multicollisions.pdf ...
1
vote
2answers
92 views

Secret sharing scheme WITHOUT Shamir Secrete Sharing

I am planning to use the following XOR scheme to divide a secret into only 2 shares (I do not want to use Shamir Secret Sharing for different reasons that are beyond the scope of this post). Here's ...
1
vote
1answer
28 views

Can MFA codes be predicted if you know what their values were at a previous time?

I use an app on my phone that, after scanning a QR code on a website, gives me 6-digit codes which change every 30 seconds. These codes can be used for Multi-Factor Authentication (MFA) on some ...
0
votes
0answers
49 views

Can someone explain the timing attack on RSA with Montgomery multiplication?

I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle. I understood that there is a additional ...
3
votes
1answer
123 views

Breaking ciphertext using a quantum computer when the public key is not available

As we know about Shor's algorithm on quantum computers it is possible to crack RSA / ECC easily if we have enough qubits. Is it possible to crack RSA / ECC on a quantum computer if we only have ...
4
votes
1answer
146 views

Find prime $p$ such that $a^x\equiv b\pmod p$ for many $x\in[1,p)$

Given haphazard large integers $a$ and $b$ (like few thousand bits), can we efficiently find (and how) some integer triplet $(p,x,k)$ with $p$ a large prime (like a thousand bits) $a^x\equiv b\pmod p$...
1
vote
0answers
29 views

is there an effective attack against rsa by knowing the coefficient $u$ of the private key? [duplicate]

consider that an attacker has the public key $(n, e)$, where $n$ is $1024$ bits long, the $32$ largest bits of $p$ (where $n = p \cdot q$), as well as $u = p^{-1} \pmod q$. Is there an attack that ...
3
votes
2answers
322 views

Things already known to adversary before planning an attack

This is a very basic and practical question. Since I started reading cryptography recently, these things keep bugging me. What are the things that an adversary is usually aware of before planning an ...
0
votes
0answers
53 views

An insecure signature with message recovery, Dan Boneh

Someone can help me to resolve this questions from the book of Dan Boneh (University of Standford)
1
vote
0answers
37 views

Can Trivium ciphertext be decrypted by an adversary if the key is known, but the IV is not?

Suppose that the adversary is able to recover the key of Trivium cipher. But the associated IV is unknown to him. Will he be able to decrypt the ciphertexts without any complexity?
1
vote
1answer
67 views

RSA CTF Guidance

There's a great cryptography based ctf site that I've been going through. There's this one question around RSA that has been puzzling me for over a week now. Please don't tell me the answer, I'm only ...
2
votes
1answer
65 views

Short padding + known prefix RSA attack

Suppose I have a message in the form of: $m = \text{prefix} \mathbin\| \text{secret} \mathbin\| \text{padding}$ We have: $e=3$ $n$ $n_\text{padding}$ (length of the random padding, <$1/4$ of $m$)...
0
votes
1answer
49 views

AES 5-round Square attack, how to choose plaintexts?

I know that we need to generate a delta-set (with 256 plaintexts). During the attack, we guess 4 bytes of round 5 key and 1 bytes of round 4 key, which allows us the byte at one position of the state ...
3
votes
0answers
64 views

RSA calculate $d$ using Chinese Remainder Theorem with $d_p$, $d_q$ and $e$

Suppose for a RSA system I have the following variables given: modulus $n$, expononent $e$, $d_p$ and $d_q$Where, $d_p = d\bmod(p-1)$ and $d_q = d\bmod(q-1)$, Is it possible to find the private ...
0
votes
1answer
58 views

KRACK - Is all-zero key installed by the acces point?

I don't really understand (and I think it's not described in the official paper) how the encryption can work when the encryption key is set to 0 by a KRACK attack on a device using wpa_supplicant 2.4 ...
1
vote
1answer
55 views

Key at start or end of HMAC

In the book Information Security Principles and Practice, the author explains why HMAC should be used for integrity with a symmetric key with the message, to prevent a MiTM to replace both the message ...
3
votes
1answer
61 views

If I allow arbitrary initial hash values for SHA-256, what would be the weaknesses?

The initial hash values (IV) of SHA256 are fixed. However, let's say I modify the SHA256 hash function to allow the attacker to use arbitrary IVs rather than fixed IVs. What kind of weaknesses would ...
0
votes
2answers
69 views

How is asymmetric cryptography safe if one of the keys is public?

Let's suppose $A$ is sending a message $m$ to $B$ using asymmetric cryptography. To guarantee the authenticity of a message, $A$ encrypts $m$ with $A$'s private key: $E(m, k_A) = m_A$. Then, $A$ ...
1
vote
1answer
63 views

averaging attack at Google's RAPPOR

I am reading the paper - "RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response". I don't understand how the averaging attack works. I searched for "average attack" but couldn't find a ...
2
votes
1answer
64 views

Is there a term for cryptographic attacks where you can verify decryption without assuming any known structure on the plaintext?

The questions https://security.stackexchange.com/questions/1696/if-someone-breaks-encryption-how-do-they-know-theyre-successful and https://security.stackexchange.com/questions/119887/how-to-know-if-a-...
1
vote
0answers
38 views

Primal and dual attack against NTRU

I am looking at the primal attack against schemes in the second round of the NIST Post-Quantum Standardization Project. The cost of primal attack usually comes from an estimate described in NewHope ...
0
votes
0answers
58 views

Another cut-and-paste attack on CBC mode

I am trying to see specific cases of attacks in the CBC mode, in particular, I am investigating some attacks such as Example of a cut-and-paste attack on CBC. Here I have posted something similar and ...
2
votes
1answer
38 views

How can an adversary use Mac(.) with a new key to compute a tag although this is not a query to Mac oracle?

I am having some troubles understanding the power of an adversary in attack against a MAC. In chapter 4 in Introduction of Modern Cryptography by Jonathan Katz and Yehuda Lindell, specifically in the ...
1
vote
0answers
85 views

How to find/determine the Polybius Square Key and Additive Key, if only the Cipher Text is known, in Nihilist Cipher?

I was solving a Crypto Challenge in a CTF, and I got a Nihilist Cipher Encoded String. Luckily the additive key was given as a hint, and for the polybius Square key, I kinda bruteforced or I just got ...
2
votes
3answers
760 views

Example of a cut-and-paste attack on CBC

I am reading the cryptography book by Stamp and there is a cut-and-paste attack on $ECB$ and this is easy to follow because $ECB$ is relatively simple, the problem is that I would like to see an ...
1
vote
1answer
98 views

Is it possible to perfom quadratic residues attack on elgamal cryptosystem?

I understand how this attack work on mental poker, but i am unable to see how can i apply it in Elgamal.
1
vote
0answers
35 views

How large a product out of 3 close-by factors need to be to avoid factorization?

For encryption a prime $P = 2 \cdot Q \cdot R \cdot S +1$ was used. An adversary want to solve the discrete log problem $m \equiv g^i \bmod P$. For this he want to use the Pholig-Hellmann algorithm. ...
1
vote
1answer
93 views

Given generator $g$ with prime order $k$ in $\bmod P$. Does increasing $P = 2 \cdot c \cdot k +1$ decrease security? Increasing $g$ increase security?

An adversary wants to find $a$ in $$m \equiv g^a \bmod P$$ He knows prime $P = 2 \cdot c \cdot k +1$ with it's primes $c,k$, value $m$ and $g$. And he also knows that $g$ only has an order of $k$, ...
1
vote
1answer
54 views

Attack on envelop mac

As I am reading the Paper: MDx-MAC and building fast MACs from hash functions I am having trouble understanding the Attack on the Envelope Method (4.3). In particular, I am not sure what chaining ...
3
votes
2answers
781 views

Is direct RSA encryption of AES keys secure?

I am wondering: If we take this scheme/procedure and each of it seems very secure (to me at least), is it truly secure or is there a vulnerability hidden in the process? This is the scheme: Bob has ...
1
vote
0answers
36 views

attacks and defenses on multi party Diffie-Hellman protocol

I tried to create a 4 partied Diffie-Hellman implementation for 4 people using its cyclic group property. However, I am not sure regarding those 2 issues, and would appreciate if you could elaborate ...
4
votes
1answer
185 views

Is double encryption really a bad idea? Are meet-in-the-middle attacks practical at all?

Meet-in-the-middle attacks are used to justify that attacks on ECC and double encryption will have complexity of $O(\sqrt{n})$ for ECC and $O(2^{n+1})$ for double encryption complexity instead of $O(n)...
2
votes
1answer
36 views

Security implications of not concatenating a 1 to the IV when using GCM

When using GCM, The padding string $0^{31}||1$ is appended to the IV. I know that this is done to avoid the repetition of $E_K(0^n)$ which is used as key for the GHash. But what would be the security ...
1
vote
0answers
44 views

Why is this attack complexity equal that exact number of bit operations?

in the this paper,section 3,autors attack hamsi-256. Im trying to make a parametrized version, so i need to understand how do they estimate the complexity of attack in bit operations,that reads as ...
2
votes
2answers
603 views

What is a multi-target attack?

What exactly is a multi-target attack? How does the attack work on different cryptographic schemes (block ciphers, hash functions, elliptic curves)? How can it be avoided?
4
votes
1answer
220 views

Any speed up methods for finding the index of a random value produced by the Inversive congruential generator?

The Inversive congruential generator produces random values with: $$x_{n+1} = a\cdot x_{n}^{-1} + b \mod P$$ (special case if $x_n=0$ -> $x_{n+1}=b$) starting with an initial value $x_0$ With well ...
1
vote
0answers
49 views

Is the 51% attack the only technical reason no country will ever adopt Bitcoin as a state currency? [closed]

Is the 51% attack the only technical reason no country will adopt Bitcoin as a state currency? Let's suppose a country with a GDP size less than 300 Billion USD adopt the Bitcoin as an official ...
3
votes
1answer
120 views

Attacking any one in many public keys

The problem of finding private key from public key is typically studied in the one-key setup: what's the expected cost of breaking one key (e.g. by factoring a public modulus, or solving a discrete ...
1
vote
0answers
48 views

What if an AES Whitebox 1024-bit (or larger key) is created? Does it increase complexity consistently?

Following the Chow et al paper and Muir's tutorial, I was able to implement the AES algorithm using tables embedding keys of 128, 192 and 256-bit sizes, later extended to 1024, 2048 and 4096-bit sizes....
3
votes
1answer
135 views

Why is the Domingo-Ferrer cryptosystem not used in practice?

The Domingo-Ferrer cryptosystem is a fully homomorphic cryptosystem. It works fast enough. I have only seen known-plaintext attacks. Is this a reason not to use it in practice? Or are there more ...
1
vote
1answer
107 views

Attacking Double DES (OFB Mode) given the initialization vector and not much else? [closed]

I'm given a Plaintext/Ciphertext pair, a Ciphertext to break, and the IV. One thing of note is that the same IV is used for both DES Encryptions, so $$C = E_{K_2}(E_{K_1}(P, IV), IV)$$ I have limited ...
2
votes
0answers
53 views

Complexity of AES key reconstruction from state 1 output and plaintext

Assuming that I am able to read the plaintext as well as the output of round 1 of an AES-128 encryption: Is it possible (if yes: how?) to obtain the RoundKey with a lower complexity than brute-force ...
1
vote
0answers
115 views

How to solve a simple case of a RLWE problem

I've been reading up on the Ring Learning with Errors problem and the proposed attacks, in relation to homomorphic encryption. Some of the literature has been quite difficult to understand - what I ...
3
votes
1answer
141 views

Does knowing that the exponent is in a certain range help solving discrete log?

given: $c=g^i \bmod P$ $g$ generator for group with group size $\varphi(P)$ $g,P,\varphi(P)$,c is known by the attacker He wants to know $i$. Now the attacker also knows $j,k$ with $j<i<k$ $k-j$...
-1
votes
1answer
129 views

How do discrete logarithm with modulo a prime and a non-prime compare?

Let $c_N = g^i \mod N$ and $N=p \cdot q$ and $c_P = f^j \mod P$ and $P$ a prime We assume $N,P$ has the same bit-length. $P$ is the best type of prime you can choose (e.g. safe prime). $N$ is a ...
-2
votes
1answer
103 views

On the security definitions [duplicate]

What are the differences between: perfect security information-theoretic security semantic security indistinguishability Are there any other definitions which are closely related? Do these security ...
1
vote
0answers
35 views

Why, in general, are proofs of possession (POPs) “clearly” not sufficient for substantiating the knowledge of secret key (KOSK) assumption?

In Ristenpart, Yilek - The Power of Proofs-of-Possession: Securing Multiparty Signatures against Rogue-Key Attacks they have the statement: In general, such proofs of possession (POPs) are clearly ...
0
votes
2answers
37 views

The opponent possesses a string of ciphertext and has access to the encryption machinery as black box. What is the name of this attack?

a quick example: The encryption function: y = E(x) = (13x + 9)(mod 27), when the letters A–Z are taken to be the numbers 0–25 and the Space (punctuation) is the number 26. The opponent has the ...
1
vote
1answer
33 views

Randomization attack in voting protocols

I'm looking into coercion-resistant voting schemes and one of the key elements of coercion-resistance is resistance to randomization attacks. Juels et al. define a randomization attack as one where ...
2
votes
1answer
89 views

How “Resending Message Attack” works?

In the second chapter of Bruce Schneier's book Applied Cryptography, 2nd Edition, 1996, we find this in section 2.7.1 Resending the Message as a Receipt: ...

1
2 3 4 5 6