Questions tagged [attack]
A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.
435
questions
30
votes
1
answer
5k
views
How was this 2048 bit number factored so fast?
I'm working on a CTF. The challenge is to get the contents of an encrypted message given the ciphertext and the 2048-bit RSA public key. I did finally get the flag after a few hours, but I'm still not ...
- 403
26
votes
6
answers
4k
views
Did a certain cryptography method get abandoned due to security flaws in the past?
I am researching how quantum computers affect current encryption methods (RSA and more).
However, I remember learning in a course that there used to be a particular encryption method which was ...
26
votes
7
answers
5k
views
Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?
Are there moderns (post World War II) and famous protocols that were proven secure (in any model: game-based, UC...) but whose proof was wrong and could have led to real-world attacks?
Note that:
I'm ...
- 1,136
19
votes
2
answers
5k
views
How is encryption broken today?
There are often articles in the news that state that a certain country or hacker has been able to decrypt/hack highly protected systems: Some examples are the Lockheed Martin RQ-170 Sentinel that was ...
- 301
18
votes
1
answer
2k
views
What does a "real" quantum computer need for cryptanalysis and/or cryptographic attack purposes?
The cryptographic world has been buzzing the word "quantum" for a while now (even the NSA is currently preparing itself for a post-quantum crypto world) and quantum-related hardware engineering is ...
- 17.8k
18
votes
0
answers
481
views
The aftermath and considerations of the new record of 30750-Bit Binary Field Discrete Logarithm - 2020
Granger et al. recently published a paper about breaking a record for discrete logarithm on the Binary field
Computation of a 30 750-Bit Binary Field Discrete Logarithm, Robert Granger and Thorsten ...
- 47.5k
17
votes
4
answers
14k
views
How can C rand() be exploited if a secure seed is used?
I've just started doing a research project on CSPRNGs and I would like to know what kind of vulnerabilities a regular PRNG has with a secure seed. For example, if I generate a random number using ...
- 364
17
votes
1
answer
19k
views
The difference between these 4 breaking Cipher techniques?
I'm trying to understand the difference between the following and what they actually mean :
Known plaintext attack
Known ciphertext attack
Chosen ciphertext attack
Chosen plaintext attack
Any ...
- 445
14
votes
1
answer
5k
views
Why "1" in 51% attack on Blockchain network
In many sources, included Wikipedia, we read:
Any pool that achieves 51% hashing power can effectively overturn network transactions, resulting in double-spending.
My question is: Why do we talk ...
- 243
13
votes
1
answer
3k
views
Cracking a PRNG by observing ranks within groups of its output
Suppose that I am generating random numbers with Python's random module, so that there is a known random number generator (Mersenne Twister in this case). I've ...
- 273
12
votes
5
answers
2k
views
What is the malicious potential of a key-substitution-attack?
What is the idea behind a key-substitution-attack?
We start from a given pair of message $m$ and signature $s(m)$. The signature can be verified by anybody in possess of the public key $y$:
$v(m, s, ...
- 1,477
12
votes
2
answers
3k
views
How can I implement the elliptic curve MOV attack myself?
I understand and have implemented elliptic curve signatures in Python without the use of libraries like Sage, and would like to implement the MOV attack against certain weak types of elliptic curves.
...
- 121
12
votes
1
answer
344
views
Why doesn't Wang's attack work on SHA-1?
Wang's (et al) differential attack works on MD5, MD4, RIPEMD and HAVAL.
Why doesn't it work on SHA-1?
- 121
11
votes
1
answer
4k
views
Is MD5 second-preimage resistant when used only on FIXED length messages?
I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient.
I have read a lot about MD5 security for this ...
- 343
11
votes
1
answer
2k
views
Relation between attack and attack model for signatures
What is the relationship between an attack and an attack model?
For example, let $\Pi$ be the Lamport signature scheme. This signature has its security based on any one-way function. The Grover ...
- 2,661
11
votes
2
answers
3k
views
In textbook RSA with low public exponent, how big does a random message needs to be?
Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
- 138k
11
votes
1
answer
329
views
What informal indicators exist for estimating the computational infeasibility of cryptographic problems?
When assuming a block cipher primitive is secure, or a number theoretic problem is hard, this assumption is usually based on how far we are from breaking the primitive or solving the problem using ...
- 10.4k
11
votes
1
answer
1k
views
Are there any practical attacks that create a printable chosen prefix MD5 collision?
I would like to create two ASCII text messages with the same MD5. Is this possible? If not, is there a similar but less strict attack that could work?
Or to rephrase my last question: what are the ...
- 111
10
votes
2
answers
789
views
Which attacks are possible against raw/textbook NTRU encryption?
In the same fashion that these questions about attacks to textbook RSA and ECC, I was wondering what are the immediate drawbacks of applying NTRU Encryption directly, without any padding scheme, such ...
- 4,942
9
votes
3
answers
16k
views
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.
Can I recover that key?
If, how big does the list of plaintext ...
- 201
9
votes
2
answers
3k
views
What is a multi-target attack?
What exactly is a multi-target attack? How does the attack work on different cryptographic schemes (block ciphers, hash functions, elliptic curves)? How can it be avoided?
- 6,404
9
votes
2
answers
3k
views
Is there a downside to encrypting too much data with the same key?
Is there a downside to encrypting too much data? If so, what?
I'm guessing things like
too much data encrypted with the same key, possibly leaking information due to a collision
encrypting non-...
- 1,003
9
votes
3
answers
3k
views
SHA-1 collisions - what about practical attacks?
I understand the theoretical problem with hash collision but when it comes to practice, I get very confused.
Suppose a attacker would like to forge a certificate (or any kind of structured piece of ...
- 347
9
votes
1
answer
1k
views
Does blinding work against side channel on RSA?
In the so called "blinding" technique for RSA, prior to decryption, the ciphertext is multiplied by random $r$ raised to the power of $e$; e.g., $C$ is replaced with $C\cdot r^e$; and then after ...
- 1,066
9
votes
1
answer
3k
views
How can I attack a Triple-Block cipher with 2 keys (like 3DES) with a cost of ≤ 2⁵⁶
I am trying to solve something and I have but I have no idea anymore. Maybe anyone of you has an idea/solution/hint.
Given is a block cipher $F$ with key length $n$. It looks like this:
$$c = ENC_{k1}...
- 395
9
votes
1
answer
580
views
Are there any long term RC4 bias based exploits?
The RC4 cipher possibly exhibits low level bias in it's long run PRNG keystream. I'm specifically excluding short term bias attacks which I'm defining as outputs < 1024 bytes. Are there any real ...
- 15.1k
9
votes
1
answer
3k
views
Algorithm for Boneh and Durfee attack on RSA
I am trying to understand various attacks on RSA and I believe that they only way to fully understand the algorithm is to implement it. I am trying to implement the code in this paper (pdf) (Private ...
- 312
9
votes
1
answer
696
views
Bleichenbacher RSA1024 signature forgery, closed-form solution
Hal Finney's writeup (Bleichenbacher's RSA signature forgery based on implementation error) shows a formula for RSA3072. I tried to replicate the attack for RSA1024 and failed, since the first term of ...
- 407
8
votes
1
answer
607
views
What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?
Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...
- 17.8k
8
votes
5
answers
2k
views
Does frequent key change weaken encryption?
Following scenario:
We are using OTR for communication between Alice and Bob which means after each successfull message exchange a re-keying happens for both parties leading to new AES-keys for the ...
- 131
8
votes
1
answer
3k
views
Understanding Twist Security with respect to short Weierstrass curves
I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves.
That section claims ...
- 6,894
8
votes
1
answer
943
views
How does the sponge construction avoid the weaknesses present in Merkle–Damgård hash function?
How are the weaknesses of the Merkle–Damgård construction (i.e. the Herding attack, multicollisions, length extension, expandable messages) avoided in the sponge construction?
- 97
8
votes
1
answer
212
views
How complex must round constants be to resist slide attacks?
A key schedule that generates round keys by XORing a round constant with the key is linear and can be vulnerable to related key attacks, but let's ignore that for now. Constants are necessary to avoid ...
- 15.1k
7
votes
2
answers
1k
views
Is there a complete summarized list of attacks on Diffie-Hellman?
Is there a complete summarized list of attacks on Diffie-Hellman?
For RSA, there is this paper by Boneh, so I was wondering whether there is such a list for attacks on DHKE. I have been looking ...
- 201
7
votes
1
answer
2k
views
How does the ROCA attack work?
I have been trying to understand the ROCA attack described here as the "First Attack" and I cannot follow the explaination.
I have been trying to generate a 512-bits key and crack it. As far as I can ...
- 71
7
votes
1
answer
1k
views
Is the RSA signature attack from Desmedt and Odlyzko practical?
I would like to understand how the attack from the Desmedt and Odlyzko on RSA signatures (and subsequents works) can be made practical. This attack describes a way to forge the signature on a new ...
- 2,837
7
votes
2
answers
2k
views
Is there a feasible preimage attack for any hash function (no matter how deprecated) today?
Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack?
All hashes that are nowadays considered 'broken' (...
- 1,397
7
votes
1
answer
580
views
Why does the Bombe not consider the Ringstellung when determining stecker pairs?
I am doing research on the Bombe Machine, and I read that when the Bombe tries to find the stecker (plugboard) partners of letters, it only needs to use the rotor types and arrangement and also the "...
- 301
7
votes
2
answers
1k
views
What are the implications of a birthday attack on a HMAC?
After collecting approximately $2^{n/2}$ message-tag pairs a collision can be observed. So two different messages (m1 and m2) will have the same tag.
This paper states:
Then, for any string x, (...
- 161
7
votes
1
answer
405
views
How safe is a prime with $P=2 \cdot Q \cdot R \cdot S \cdot t+1$ for discrete logarithm? How to enhance/compare?
To get some certain properties for my use case I need a prime $P$ which has the form:
$P=2\cdot Q \cdot R \cdot S \cdot t+1$
with $Q,R,S,t$ primes as well.
Why that form - Use case
Together with ...
- 573
6
votes
3
answers
2k
views
What are the dangers of using CPU clock drift for generating random data?
From what I understand, a physical source of true randomness could be achieved with a multi-core processor, by using clock drift between two or more cores.
However, a processor is easier to ...
- 105
6
votes
2
answers
408
views
Examples of Weak Cryptography being exploited in the wild by cybercriminals?
As a theorist, I often motivate the need for strong cryptography via simplistic methods, such as "If this did not exist, your online bank transactions would be vulnerable". This is of course ...
- 11.6k
6
votes
1
answer
786
views
Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password?
A malicious actor wants to decrypt ciphertext that was encrypted with a password. He also possesses the hash (bcrypt/PBKDF2) of that password. Does he have any significant practical advantage in ...
- 63
6
votes
1
answer
536
views
What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI
What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI (Crypt32.dll)
Could someone provide details?
- 47.5k
6
votes
1
answer
2k
views
RSA attack with continued fractions (Wieners attack)
I found an article on the internet about an RSA attack with continued fractions.
Given are the following numbers:
$n = 205320043521075746592613$
$e = 70760135995620281241019$
$\frac{e}{n}=[0;2,1,...
- 181
6
votes
1
answer
682
views
Can iterated hashing be used to mitigate collision and preimage weaknesses?
How much security does double hashing add regarding collisions and preimages? Is it helpful to iterate a hash function even more times than two?
For example, can MD5 be fixed (in practice) by ...
- 163
6
votes
1
answer
177
views
Has a Two Key TDES encryption ever been successfully attacked?
Is there any known instance of a Two Key TDES ever being successfully attacked (in real life), when the key is used to encrypt less than $2^{20}$ words?
- 61
6
votes
1
answer
980
views
Iterations of pollards kangaroo attack on elliptic curves
I want to understand the Pollard kangaroo attack on elliptic curves. I found this Pollard's kangaroo attack on Elliptic Curve Groups Q/A pretty helpful, but not complete. The posts provides a pretty ...
- 2,120
6
votes
1
answer
776
views
Difference between actual attacks and theoretical attacks on SHA cryptographic series
Could anyone tell me what the difference is between a theoretical attack (Like the one done on SHA-1) and an actual, practical attack (Like the one done on SHA-0)? Is a theoretical attack a proposed ...
6
votes
0
answers
125
views
About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?
Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$
with
$$p=(p_1, p_2)$$
$$q=(q_1,q_2)$$
$$p_1,q_1 \in [0,s)$$
$$p_2,q_2 \in [0,s^2)$$
We want to find a path in between ...
- 573