Questions tagged [attack]
A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.
81
questions with no upvoted or accepted answers
18
votes
0
answers
483
views
The aftermath and considerations of the new record of 30750-Bit Binary Field Discrete Logarithm - 2020
Granger et al. recently published a paper about breaking a record for discrete logarithm on the Binary field
Computation of a 30 750-Bit Binary Field Discrete Logarithm, Robert Granger and Thorsten ...
- 47.6k
6
votes
0
answers
125
views
About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?
Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$
with
$$p=(p_1, p_2)$$
$$q=(q_1,q_2)$$
$$p_1,q_1 \in [0,s)$$
$$p_2,q_2 \in [0,s^2)$$
We want to find a path in between ...
- 573
6
votes
0
answers
343
views
Statistical saturation attack on block ciphers
I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack
against the Block Cipher ...
- 81
5
votes
0
answers
564
views
How hard is a known prefix hash preimage attack on SHA-2?
Suppose the attacker knows $X, Z$ such that
$H(X || Y) = Z$
If bit-length(Y) < 60 then a brute force attack is possible.
What if ...
- 1,867
4
votes
0
answers
72
views
On the current memory retain limits for the coldboot attack (2020)
ColdBoot attack is introduced by Halderman et. al in 2009
Lest we remember: cold-boot attacks on encryption keys
In their articles, they represent experimented that
We found that the dimensions of ...
- 47.6k
4
votes
0
answers
137
views
Implementation Attacks on Hashes
So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc.
What implementation attacks are there against hashes or hashed based functions (...
- 189
4
votes
2
answers
169
views
What would be the requirements for a new-age cipher standard?
While nowhere near being broken, AES has known attacks like reading from the substitution table, memory-based attacks, etc.
If we keep getting better at breaking ciphers and we eventually get close to ...
3
votes
0
answers
390
views
Is Ntru-Encrypt still secure in 2022
I'm going to use NTRU as post-quantum public-key encryption algo in my project.
I've googled attacks on NTRU and found a lot of them
but since I'm new to NTRU and don't understand the math used, and ...
- 31
3
votes
0
answers
223
views
Pollard Rho Optimization
One of the most important attacks on Elliptic Curve cryptography is Pollard's Rho method. The effect on security can be seen on SafeCurves.
This attack is pretty old and there has been a bunch of ...
- 2,120
3
votes
0
answers
653
views
Curve25519 Attacks and Security
Curve25519 is a pretty secure way to exchange a key. In the original Paper and on SafeCurves a lot of attacks and security aspects are mentioned:
Attacks:
Brute force: This one is theoretically ...
- 2,120
3
votes
0
answers
521
views
RSA calculate $d$ using Chinese Remainder Theorem with $d_p$, $d_q$ and $e$
Suppose for a RSA system I have the following variables given:
modulus $n$, expononent $e$, $d_p$ and $d_q$Where, $d_p = d\bmod(p-1)$ and $d_q = d\bmod(q-1)$,
Is it possible to find the private ...
3
votes
0
answers
173
views
Is the "Pico" alternative to passwords vulnerable to man-in-the-middle?
Maybe someone has already heard about "Pico" by Frank Stajano. In short: It is a model for an alternative for using passwords for authentication and seems to be very interesting.
Regarding the paper, ...
- 509
3
votes
0
answers
120
views
Pollard's Rho - Restricting the random function to the exponents
Pollard's Rho is usually constructed using a function $f:G \rightarrow G$ which behaves 'random enough' in order to detect a collision with Floyd's cycle detection trick. It is easy enough to observe, ...
- 75
3
votes
0
answers
230
views
Timing Attack on OpenSSL by Brumley
I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003).
In this paper on page 4, Brumley ...
- 31
2
votes
0
answers
103
views
How can I extend the RSA LSB Oracle attack, to n-LSBs?
Suppose we have an RSA-Oracle that can encrypt and decrypt our input. The the decryption output is equal to: $ (C^d \mod N) \mod 2^n $.
How can I extend the LSB oracle attack, using the using ...
- 21
2
votes
0
answers
466
views
Short Nonces in ECDSA signature generation
Recently I noticed that my device generates short-sized Nonces.
Approximately $2 ^ {243} - 2^{244}$.
Could it turn out that there will be a small leak of ...
2
votes
0
answers
129
views
Howgrave-Graham lattice attack on NTRU
I am lookin for a good example to illustrate this attack on NTRU using low parameters but I failed to do that, The attack consist to use LLL reduction on A basis of NTRU Lattice, let us use the column ...
- 421
2
votes
0
answers
111
views
The Primal and Dual attack security estimates in Kyber round 3 specification
In Kyber round 3 specification, the table 4 gave the security estimates of Primal and Dual attack with respect to Kyber 512, 768 and 1024 (see the figure below). However, using the python script given ...
- 171
2
votes
0
answers
704
views
MOV-attack on ecc: Time complexity and example
There already is this pretty big post about the MOV-attack. It states, that the discrete logarithm problem on elliptic curves can be transformed to a discrete logarithm problem over a finite field. ...
- 2,120
2
votes
0
answers
88
views
Complexity of AES key reconstruction from state 1 output and plaintext
Assuming that I am able to read the plaintext as well as the output of round 1 of an AES-128 encryption: Is it possible (if yes: how?) to obtain the RoundKey with a lower complexity than brute-force ...
- 121
2
votes
0
answers
144
views
Non-exact substitution cyphers
Picture a simple substitution cypher of text with length $N$(spaces optional):
Plain : ATTACK AT DAWN
Encrypted: ELLETI EL HEPG
Another way to represent the encrypted text is with an $N \times N$ ...
- 129
2
votes
0
answers
427
views
RSA signatures that allow hash to move around in block
I'm looking at a broken RSA signature padding implementation in a real device. It's a very-badly implemented version of PKCS #1-like encoding, but before PKCS added the DER-encoded hash identifier.
...
- 2,513
2
votes
0
answers
208
views
*feasible* pre-image attacks against reduced SHA-1
(tldr: see last paragraph)
Although SHA-1 is vulnerable to collision attacks, it is still resistant to pre-image attacks. SHA-1 was designed to be resistant until a brute-force attack of $2^{160}$ is ...
- 121
2
votes
0
answers
234
views
Cost of attack on DSA with attack on DLP
Are there any (recent) estimates of cost of attack on DSA by solving the discrete logarithm? I'm especially interested in attacks that use Pollard's rho algorithm.
Are there any optimized ...
- 21
2
votes
0
answers
149
views
Correlation attack on Lagged Fibonacci Generator
Say that one uses a known LFG (2 known lags $a$ & $b$, known inner state length $N$, known modulo $m$) to hide some text with a basic à la Vigenère cipher: $C_i=(P_i + {PRNG}_i) \bmod 26$.
Say ...
- 131
1
vote
0
answers
23
views
Can an attacker impersonate any party in a modified Needham-Schroeder protocol?
We are doing symmetric Needham-Schroeder protocol in university. We were provided a modified protocol and needed to answer the following questions.
Original protocol:
Modified protocol:
Task
a) An ...
- 63
1
vote
0
answers
74
views
Predicting compromised OpenSSL 3.0 DRBG
The OpenSSL 3.0 rand function's DRBG uses the getrandom() system call to get 48 bytes of secure entropy from the kernel. It also ...
- 33
1
vote
0
answers
89
views
Are Veracrypt, XTS and flash memory attacks feasible?
Some time ago I had a question here about WinRAR security and probably the most common recommendation I came across was to use Veracrypt.
Veracrypt uses XTS, but according to others, XTS encryption is ...
- 13
1
vote
1
answer
208
views
Decentralized identity, how to prevent duplicate uses of the same identity
In a system that relies on decentralized identity, is it possible to prevent duplicate uses of the same real-life identity, i.e. same real-life person creates more than one user entity (each is ...
- 91
1
vote
0
answers
32
views
Does privacy-preserving linear (logistic ) regression necessary?
The linear regression is simply $y=Wx+b$, where the server holds $W$ and $b$ and the client holds $x$. The private linear regression means the client sends encrypted $x$ to the server, and receives ...
- 35
1
vote
0
answers
68
views
Non-uniform plaintext distribution -- AES attack
Are their any attacks on AES (any mode) in which before the attack is mounted, the adversary is aware that the input distribution is non-uniform?
Most of the work assume that the plaintext is ...
- 31
1
vote
0
answers
76
views
How to solve a system of modular equations with exponential difference
I`m solving one crypto problem on rsa.
p^e - q^e = C1 (mod n)
(p-q)^e = C2 (mod n)
n = p*q*r; p,q,r are prime numbers
e = 2 * 65537
We have e, n, C1, C2.
It's ...
- 11
1
vote
0
answers
107
views
How to factorize RSA modulus while given two Public Exponents and the difference between two Private Exponents?
The RSA modulus is the product of two $2048$-bit primes.
And the two Public Exponents are both $16$-bit.
I also got the difference between two Private Exponents $\left | d_1-d_2 \right |.$
Is there ...
- 59
1
vote
0
answers
1k
views
RSA Hastad's broadcast attack with large numbers
I understand the theory behind Hastad's broadcast attack.
Namely if we have three encrypted messages with the exponent e=3:
...
- 153
1
vote
0
answers
93
views
How to find strength of a cryptographic hash function?
I am having an idea to create a cryptographic hashing algorithm. I found a mathematical function $f: x \rightarrow y$ . By using Merkle-Damgård construction wide pipe, I designed a hashing function. ...
1
vote
0
answers
270
views
Invalid point attack yields wrong results for low order points
I've recently tried to replicate the results of the question Ruggero asked and which Samuel Neves answered here: Understanding Twist Security with respect to short Weierstrass curves
In my attempt to ...
1
vote
0
answers
104
views
How does an attacker decrypt a hash function by looking for linearity?
Reading the selected answer to Designing a hash function from first principles rather than depending on heuristics is very insightful.
The section on "nonlinearity" suggests that making ...
- 171
1
vote
0
answers
146
views
SHA-256 Hash Crack
Suppose, If a SHA-2 hash does get broken completely with hardly any power, where would it get reported and is there currently a bounty on it?
- 11
1
vote
0
answers
419
views
Cracking secret key, n, and m by hand with the Diffie-Hellman key exchange brute force
Problem: You see Michael and Nikita agree on a secret key using the Diffie-Hellman key exchange. Michael and Nikita choose $p = 97$ and $g = 5$.
Nikita chooses a random number n and tells Michael that ...
- 103
1
vote
0
answers
51
views
Can the salt be derived based on the other components of encrypted data?
I'm using python.cryptography's Fernet with PBKDF2 passphrase hashing to encrypt a piece of data (the value) that is stored, encrypted, in a database. The hashed passphrase is not stored in the ...
- 111
1
vote
0
answers
76
views
Impact of partitioning oracle attacks on file encryption?
I've just learned about partitioning oracle attacks recently, and I would like to clarify some things that are a little foggy to me right now.
According to this thread,
The aim is the recovery of a ...
- 421
1
vote
0
answers
259
views
Vulnerability in DES3 when key can be chosen
In the question there are two functions encrypt basically does IV ⨁ DES3(P⨁IV) and encrypt_flag just encrypts the flag after being padded into a multiple of 8. IV is a random 8 byte number which is ...
- 201
1
vote
0
answers
77
views
Attacks on LWE when q is a power of 2
I am working on an LWE instance where q is a power of 2 and I'm wondering if there is any literature about attacks in this context, especially if there are any attacks which work significantly better. ...
- 63
1
vote
0
answers
26
views
Are there any mutual-distance bounding protocols in RFID context?
Distance-bounding algorithms are a classical solution for the Relay Attack, wherein a verifier can determine an upper bound on its distance from the prover.
However, recent literature is discussing ...
1
vote
0
answers
385
views
Breaking vulnerable ElGamal encryption
In a ctf, I encountered this problem:
...
1
vote
0
answers
59
views
Can Trivium ciphertext be decrypted by an adversary if the key is known, but the IV is not?
Suppose that the adversary is able to recover the key of Trivium cipher. But the associated IV is unknown to him. Will he be able to decrypt the ciphertexts without any complexity?
- 73
1
vote
0
answers
171
views
Primal and dual attack against NTRU
I am looking at the primal attack against schemes in the second round of the NIST Post-Quantum Standardization Project. The cost of primal attack usually comes from an estimate described in NewHope ...
- 167
1
vote
0
answers
670
views
How to find/determine the Polybius Square Key and Additive Key, if only the Cipher Text is known, in Nihilist Cipher?
I was solving a Crypto Challenge in a CTF, and I got a Nihilist Cipher Encoded String. Luckily the additive key was given as a hint, and for the polybius Square key, I kinda bruteforced or I just got ...
- 31
1
vote
0
answers
50
views
How large a product out of 3 close-by factors need to be to avoid factorization?
For encryption a prime $P = 2 \cdot Q \cdot R \cdot S +1$ was used.
An adversary want to solve the discrete log problem $m \equiv g^i \bmod P$. For this he want to use the Pholig-Hellmann algorithm.
...
- 573
1
vote
0
answers
84
views
attacks and defenses on multi party Diffie-Hellman protocol
I tried to create a 4 partied Diffie-Hellman implementation for 4 people using its cyclic group property.
However, I am not sure regarding those 2 issues, and would appreciate if you could elaborate ...
- 11