Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

55 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
14
votes
0answers
209 views

The aftermath and considerations of the new record of 30750-Bit Binary Field Discrete Logarithm - 2020

Granger et al. recently published a paper about breaking a record for discrete logarithm on the Binary field Computation of a 30 750-Bit Binary Field Discrete Logarithm, Robert Granger and Thorsten ...
9
votes
0answers
391 views

Bleichenbacher RSA1024 signature forgery, closed-form solution

Hal Finney's writeup (Bleichenbacher's RSA signature forgery based on implementation error) shows a formula for RSA3072. I tried to replicate the attack for RSA1024 and failed, since the first term of ...
5
votes
0answers
324 views

Statistical saturation attack on block ciphers

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack against the Block Cipher ...
4
votes
0answers
51 views

On the current memory retain limits for the coldboot attack (2020)

ColdBoot attack is introduced by Halderman et. al in 2009 Lest we remember: cold-boot attacks on encryption keys In their articles, they represent experimented that We found that the dimensions of ...
4
votes
0answers
133 views

Implementation Attacks on Hashes

So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc. What implementation attacks are there against hashes or hashed based functions (...
4
votes
0answers
401 views

How hard is a known prefix hash preimage attack on SHA-2?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...
3
votes
0answers
160 views

RSA calculate $d$ using Chinese Remainder Theorem with $d_p$, $d_q$ and $e$

Suppose for a RSA system I have the following variables given: modulus $n$, expononent $e$, $d_p$ and $d_q$Where, $d_p = d\bmod(p-1)$ and $d_q = d\bmod(q-1)$, Is it possible to find the private ...
3
votes
0answers
166 views

Is the “Pico” alternative to passwords vulnerable to man-in-the-middle?

Maybe someone has already heard about "Pico" by Frank Stajano. In short: It is a model for an alternative for using passwords for authentication and seems to be very interesting. Regarding the paper, ...
3
votes
0answers
107 views

Pollard's Rho - Restricting the random function to the exponents

Pollard's Rho is usually constructed using a function $f:G \rightarrow G$ which behaves 'random enough' in order to detect a collision with Floyd's cycle detection trick. It is easy enough to observe, ...
3
votes
0answers
212 views

Timing Attack on OpenSSL by Brumley

I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003). In this paper on page 4, Brumley ...
2
votes
0answers
171 views

MOV-attack on ecc: Time complexity and example

There already is this pretty big post about the MOV-attack. It states, that the discrete logarithm problem on elliptic curves can be transformed to a discrete logarithm problem over a finite field. ...
2
votes
0answers
106 views

Pollard Rho Optimization

One of the most important attacks on Elliptic Curve cryptography is Pollard's Rho method. The effect on security can be seen on SafeCurves. This attack is pretty old and there has been a bunch of ...
2
votes
0answers
170 views

Curve25519 Attacks and Security

Curve25519 is a pretty secure way to exchange a key. In the original Paper and on SafeCurves a lot of attacks and security aspects are mentioned: Attacks: Brute force: This one is theoretically ...
2
votes
0answers
65 views

Complexity of AES key reconstruction from state 1 output and plaintext

Assuming that I am able to read the plaintext as well as the output of round 1 of an AES-128 encryption: Is it possible (if yes: how?) to obtain the RoundKey with a lower complexity than brute-force ...
2
votes
0answers
125 views

Non-exact substitution cyphers

Picture a simple substitution cypher of text with length $N$(spaces optional): Plain : ATTACK AT DAWN Encrypted: ELLETI EL HEPG Another way to represent the encrypted text is with an $N \times N$ ...
2
votes
0answers
361 views

RSA signatures that allow hash to move around in block

I'm looking at a broken RSA signature padding implementation in a real device. It's a very-badly implemented version of PKCS #1-like encoding, but before PKCS added the DER-encoded hash identifier. ...
2
votes
0answers
101 views

*feasible* pre-image attacks against reduced SHA-1

(tldr: see last paragraph) Although SHA-1 is vulnerable to collision attacks, it is still resistant to pre-image attacks. SHA-1 was designed to be resistant until a brute-force attack of $2^{160}$ is ...
2
votes
0answers
189 views

Cost of attack on DSA with attack on DLP

Are there any (recent) estimates of cost of attack on DSA by solving the discrete logarithm? I'm especially interested in attacks that use Pollard's rho algorithm. Are there any optimized ...
2
votes
0answers
116 views

Correlation attack on Lagged Fibonacci Generator

Say that one uses a known LFG (2 known lags $a$ & $b$, known inner state length $N$, known modulo $m$) to hide some text with a basic à la Vigenère cipher: $C_i=(P_i + {PRNG}_i) \bmod 26$. Say ...
1
vote
0answers
37 views

Attacks on LWE when q is a power of 2

I am working on an LWE instance where q is a power of 2 and I'm wondering if there is any literature about attacks in this context, especially if there are any attacks which work significantly better. ...
1
vote
0answers
16 views

Are there any mutual-distance bounding protocols in RFID context?

Distance-bounding algorithms are a classical solution for the Relay Attack, wherein a verifier can determine an upper bound on its distance from the prover. However, recent literature is discussing ...
1
vote
0answers
77 views

Breaking vulnerable ElGamal encryption

In a ctf, I encountered this problem: ...
1
vote
0answers
45 views

Can Trivium ciphertext be decrypted by an adversary if the key is known, but the IV is not?

Suppose that the adversary is able to recover the key of Trivium cipher. But the associated IV is unknown to him. Will he be able to decrypt the ciphertexts without any complexity?
1
vote
0answers
72 views

Primal and dual attack against NTRU

I am looking at the primal attack against schemes in the second round of the NIST Post-Quantum Standardization Project. The cost of primal attack usually comes from an estimate described in NewHope ...
1
vote
0answers
264 views

How to find/determine the Polybius Square Key and Additive Key, if only the Cipher Text is known, in Nihilist Cipher?

I was solving a Crypto Challenge in a CTF, and I got a Nihilist Cipher Encoded String. Luckily the additive key was given as a hint, and for the polybius Square key, I kinda bruteforced or I just got ...
1
vote
0answers
41 views

How large a product out of 3 close-by factors need to be to avoid factorization?

For encryption a prime $P = 2 \cdot Q \cdot R \cdot S +1$ was used. An adversary want to solve the discrete log problem $m \equiv g^i \bmod P$. For this he want to use the Pholig-Hellmann algorithm. ...
1
vote
0answers
52 views

attacks and defenses on multi party Diffie-Hellman protocol

I tried to create a 4 partied Diffie-Hellman implementation for 4 people using its cyclic group property. However, I am not sure regarding those 2 issues, and would appreciate if you could elaborate ...
1
vote
0answers
44 views

Why is this attack complexity equal that exact number of bit operations?

in the this paper,section 3,autors attack hamsi-256. Im trying to make a parametrized version, so i need to understand how do they estimate the complexity of attack in bit operations,that reads as ...
1
vote
0answers
58 views

What if an AES Whitebox 1024-bit (or larger key) is created? Does it increase complexity consistently?

Following the Chow et al paper and Muir's tutorial, I was able to implement the AES algorithm using tables embedding keys of 128, 192 and 256-bit sizes, later extended to 1024, 2048 and 4096-bit sizes....
1
vote
0answers
160 views

How to solve a simple case of a RLWE problem

I've been reading up on the Ring Learning with Errors problem and the proposed attacks, in relation to homomorphic encryption. Some of the literature has been quite difficult to understand - what I ...
1
vote
0answers
35 views

Why, in general, are proofs of possession (POPs) “clearly” not sufficient for substantiating the knowledge of secret key (KOSK) assumption?

In Ristenpart, Yilek - The Power of Proofs-of-Possession: Securing Multiparty Signatures against Rogue-Key Attacks they have the statement: In general, such proofs of possession (POPs) are clearly ...
1
vote
0answers
2k views

RSA encryption extremely large public exponent

I'm trying to do learn a bit about RSA by doing CTF's and now I am doing one problem probably more than 7 hours so I would really appreciate a hint here from an expert. I have an encrypted message $c$...
1
vote
0answers
377 views

show that G' is not a secure PRG even if G is

Hello I'm trying to show that the function G'(s) = G(s) || G(G(s)) is not a secure PRG even if G is. My first question is that in this case, how do I know what G ...
1
vote
0answers
304 views

Need tips on how to break Fiat-Shamir sigma-protocol (programming challenge)

I'm completely stuck on an university programming challenge and I need some tips to get me out of the valley I'm in, you don't need to give the full answer if you do not wish to. What we have: Fiat ...
1
vote
0answers
204 views

Boneh and Durfee attack on RSA

I am a maths teacher and I'm trying to understand the Boneh and Durfee attack on RSA. I am not very familiar with cryptography. I found a dutch scripting about it. I know that: $ e*d\equiv1+k*\phi(...
1
vote
0answers
20 views

Can we protect PRESENT from the Statistical Saturation Attack if we change the permutation layer to a random permutation layer?

This is continuation-question based on: If PRESENT had different permutations s would that protect it against Statistical Saturation Attack? Can we protect PRESENT from Statistical Saturation Attacks ...
1
vote
0answers
56 views

How can I match each encrypted message with the public key used to encrypt them for a common encryption attack RSA

I have five encryption mods ($n_1$ through $n_5$) with the same encryption exponent ($e$) and the same message encrypted using the five public keys giving $E_1$ through $E_5$ that were not given in a ...
1
vote
0answers
192 views

How to generate an El Gamal signature without knowing the private key x?

Let $x$ be the private key. Let $k$ be a random generated number $< p-1$, with $p$ the large prime. Let $g$ be the generator of $p$ the large prime. Let $r$ be the equality $r=g^k$ Let $m_e$ be an ...
1
vote
0answers
53 views

Voting protocol - How many dishonest tallying centres can the protocol cope with?

We have the voting protocol that is described here. I am looking at the following exercise: Determine how many dishonest tallying centres the protocol can cope with before the following properties ...
1
vote
1answer
291 views

Recovering plaintext from AES-128 given round key 10 and ciphertext

I'm working on an old CTF challenge where AES-128 was used on a 16 byte block. I have the round 10 key and the ciphertext. What techniques exist for obtaining the plaintext?
0
votes
0answers
39 views

Complete crypto attack explanation or hierarchy including statistical attack, entropy attack, correlation attack, differential attack?

How exactly statistical attack(resistancy tested using histogram analysis), entropy attack(resistancy tested using entropy information), correlation attack(resistancy tested using correlation ...
0
votes
0answers
49 views

Known attacks against ECC in case many multiples are known?

Suppose there's a secret value x, an elliptic curve with the (public) generator G, and a sequence of secret values ...
0
votes
0answers
30 views

Boomerang attack - looking for simply explanation

Can someone explain to me in a simple way how it works? I know what differential cryptoanalysis is, but my knowledge is rather amateur. Nevertheless, reading the post on Wikipedia:Boomerang Attack I ...
0
votes
0answers
82 views

Which cryptographic attacks can AES 128-bit withstand?

Most of the articles and forums are stating that the Brute Force attack can test the strength of an encryption algorithm. However, I am looking for those attacks that AES can withstand for the testing ...
0
votes
0answers
111 views

Can we defends against RSA Timing attack when we use java.math.BigInteger.modPow?

I think that Montgomery and sliding window techniques are applied within java.math.BigInteger.modPow (and more specifically ...
0
votes
0answers
48 views

Is Joux's multicollision attack applicable for truncated SHA256?

Joux presents an elegant way to generate k-way multi-collisions with about as much effort as generating a single collision: https://www.iacr.org/archive/crypto2004/31520306/multicollisions.pdf ...
0
votes
0answers
67 views

Can someone explain the timing attack on RSA with Montgomery multiplication?

I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle. I understood that there is a additional ...
0
votes
0answers
56 views

An insecure signature with message recovery, Dan Boneh

Someone can help me to resolve this questions from the book of Dan Boneh (University of Standford)
0
votes
0answers
106 views

Another cut-and-paste attack on CBC mode

I am trying to see specific cases of attacks in the CBC mode, in particular, I am investigating some attacks such as Example of a cut-and-paste attack on CBC. Here I have posted something similar and ...
0
votes
0answers
58 views

Unique numbers with $P^aQ^bR^c \mod N$ for each combination of $a,b,c$ possible? Would it be safer than separate form (like $T^a \mod P$ for each)?

Main question: Is the computation of $a,b,c$ in $P^aQ^bR^c \mod N$ (much) harder than in $T_p^a \mod P$, $T_q^b \mod Q$, $T_r^c \mod R$ ? (assuming the first form exists) $P^aQ^bR^c \mod N$ With $P^...