# Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

97 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
523 views

### The aftermath and considerations of the new record of 30750-Bit Binary Field Discrete Logarithm - 2020

Granger et al. recently published a paper about breaking a record for discrete logarithm on the Binary field Computation of a 30 750-Bit Binary Field Discrete Logarithm, Robert Granger and Thorsten ...
• 49.2k
137 views

### About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?

Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$ with $$p=(p_1, p_2)$$ $$q=(q_1,q_2)$$ $$p_1,q_1 \in [0,s)$$ $$p_2,q_2 \in [0,s^2)$$ We want to find a path in between ...
• 453
345 views

### Statistical saturation attack on block ciphers

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack against the Block Cipher ...
• 81
589 views

### How hard is a known prefix hash preimage attack on SHA-2?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...
• 1,907
72 views

### On the current memory retain limits for the coldboot attack (2020)

ColdBoot attack is introduced by Halderman et. al in 2009 Lest we remember: cold-boot attacks on encryption keys In their articles, they represent experimented that We found that the dimensions of ...
• 49.2k
138 views

### Implementation Attacks on Hashes

So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc. What implementation attacks are there against hashes or hashed based functions (...
• 187
174 views

### What would be the requirements for a new-age cipher standard?

While nowhere near being broken, AES has known attacks like reading from the substitution table, memory-based attacks, etc. If we keep getting better at breaking ciphers and we eventually get close to ...
510 views

### Is Ntru-Encrypt still secure in 2022

I'm going to use NTRU as post-quantum public-key encryption algo in my project. I've googled attacks on NTRU and found a lot of them but since I'm new to NTRU and don't understand the math used, and ...
• 31
833 views

### MOV-attack on ecc: Time complexity and example

There already is this pretty big post about the MOV-attack. It states, that the discrete logarithm problem on elliptic curves can be transformed to a discrete logarithm problem over a finite field. ...
• 2,357
254 views

### Pollard Rho Optimization

One of the most important attacks on Elliptic Curve cryptography is Pollard's Rho method. The effect on security can be seen on SafeCurves. This attack is pretty old and there has been a bunch of ...
• 2,357
748 views

### Curve25519 Attacks and Security

Curve25519 is a pretty secure way to exchange a key. In the original Paper and on SafeCurves a lot of attacks and security aspects are mentioned: Attacks: Brute force: This one is theoretically ...
• 2,357
554 views

### RSA calculate $d$ using Chinese Remainder Theorem with $d_p$, $d_q$ and $e$

Suppose for a RSA system I have the following variables given: modulus $n$, expononent $e$, $d_p$ and $d_q$Where, $d_p = d\bmod(p-1)$ and $d_q = d\bmod(q-1)$, Is it possible to find the private ...
174 views

### Is the "Pico" alternative to passwords vulnerable to man-in-the-middle?

Maybe someone has already heard about "Pico" by Frank Stajano. In short: It is a model for an alternative for using passwords for authentication and seems to be very interesting. Regarding the paper, ...
• 519
125 views

### Pollard's Rho - Restricting the random function to the exponents

Pollard's Rho is usually constructed using a function $f:G \rightarrow G$ which behaves 'random enough' in order to detect a collision with Floyd's cycle detection trick. It is easy enough to observe, ...
236 views

### Timing Attack on OpenSSL by Brumley

I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003). In this paper on page 4, Brumley ...
• 31
51 views

...
59 views

### Trying to understand length recovery attack on EAP-MD5

I'm failing to understand how length recovery attack works in EAP-MD5 described in this paper on page 6: https://inria.hal.science/hal-01534313/document I setup ...
• 71
181 views

### How can I extend the RSA LSB Oracle attack, to n-LSBs?

Suppose we have an RSA-Oracle that can encrypt and decrypt our input. The the decryption output is equal to: $(C^d \mod N) \mod 2^n$. How can I extend the LSB oracle attack, using the using ...
• 21
562 views

### Short Nonces in ECDSA signature generation

Recently I noticed that my device generates short-sized Nonces. Approximately $2 ^ {243} - 2^{244}$. Could it turn out that there will be a small leak of ...
141 views

### Howgrave-Graham lattice attack on NTRU

I am lookin for a good example to illustrate this attack on NTRU using low parameters but I failed to do that, The attack consist to use LLL reduction on A basis of NTRU Lattice, let us use the column ...
• 463
146 views

### The Primal and Dual attack security estimates in Kyber round 3 specification

In Kyber round 3 specification, the table 4 gave the security estimates of Primal and Dual attack with respect to Kyber 512, 768 and 1024 (see the figure below). However, using the python script given ...
• 171
88 views

### Complexity of AES key reconstruction from state 1 output and plaintext

Assuming that I am able to read the plaintext as well as the output of round 1 of an AES-128 encryption: Is it possible (if yes: how?) to obtain the RoundKey with a lower complexity than brute-force ...
• 121
4k views

### RSA encryption extremely large public exponent

I'm trying to do learn a bit about RSA by doing CTF's and now I am doing one problem probably more than 7 hours so I would really appreciate a hint here from an expert. I have an encrypted message $c$...
• 121
146 views

### Non-exact substitution cyphers

Picture a simple substitution cypher of text with length $N$(spaces optional): Plain : ATTACK AT DAWN Encrypted: ELLETI EL HEPG Another way to represent the encrypted text is with an $N \times N$ ...
431 views

### RSA signatures that allow hash to move around in block

I'm looking at a broken RSA signature padding implementation in a real device. It's a very-badly implemented version of PKCS #1-like encoding, but before PKCS added the DER-encoded hash identifier. ...
• 2,615
212 views

### *feasible* pre-image attacks against reduced SHA-1

(tldr: see last paragraph) Although SHA-1 is vulnerable to collision attacks, it is still resistant to pre-image attacks. SHA-1 was designed to be resistant until a brute-force attack of $2^{160}$ is ...
240 views

### Cost of attack on DSA with attack on DLP

Are there any (recent) estimates of cost of attack on DSA by solving the discrete logarithm? I'm especially interested in attacks that use Pollard's rho algorithm. Are there any optimized ...
157 views

### Correlation attack on Lagged Fibonacci Generator

Say that one uses a known LFG (2 known lags $a$ & $b$, known inner state length $N$, known modulo $m$) to hide some text with a basic à la Vigenère cipher: $C_i=(P_i + {PRNG}_i) \bmod 26$. Say ...
• 131
1 vote
69 views

### I do not understand the result of 'proposition 2' of "MDx-MAC and building fast MACs from hash functions"

I saw the difference between the proof and the statement of "proposition 2" in the paper "MDx-MAC and building fast MACs from hash functions" by Bart Preneel & Paul C. van ...
• 31
1 vote
100 views

### Security of $E(c,k) = AES(c,(k \oplus c)\cdot (2^{n} - 1 - c))$ used multiple times with low bit keys $k$. Avoids MitmA?

More precisely the Encryption function will be $E(c_i,k_i,i)$ with a 128-bit cipher/number $c_i$, a 16-bit encryption key $k_i$ and a 8-bit index $i$ as input using a Xor key obfuscation $k'$ with ...
• 453
1 vote
85 views

### What's the difference between these two attacks?(Lim Lee and Sub group) I am a beginner can someone explain in detail?

I am reading collin boyd textbook to learn MTI key agreement and various attacks on them . I encountered two such attacks called Small sub group attack and Lim-Lee attack where in Small sub group ...
1 vote
131 views

### Different public keys $(e_i,N_i)$ but same decryption exponent $d$

We are given a number of distinct RSA public keys $(e_i,N_i)$ sharing the same unknown decryption exponent $d$. The $e_i$ were computed from $d$ drawn first, so we have different public keys. Can we ...
• 11
1 vote
155 views

### How to achieve $d-$privacy considering some secrets?

We have a set of secrets $S = \{x_1, x_2, \dots, x_n\}$ known to an adversary. Each $x_i \in S$ belongs to user $u_i$ who needs to obfuscate his secret using the notion of $d-$privacy defined in the ...
1 vote
219 views

### Help with HMAC Known plaintext / mac puzzle

Finally caving and asking for help...I'm not in the field, just doing random CTF challenges to learn more and I've really been enjoying it in general. However, I'm totally stuck on this puzzle at the ...
• 13
1 vote
93 views

• 103
1 vote
52 views

### Can the salt be derived based on the other components of encrypted data?

I'm using python.cryptography's Fernet with PBKDF2 passphrase hashing to encrypt a piece of data (the value) that is stored, encrypted, in a database. The hashed passphrase is not stored in the ...
• 111
1 vote