Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

Filter by
Sorted by
Tagged with
1
vote
1answer
248 views

Determine RSA modulus from encryption oracle

Suppose we have an RSA encryption oracle $E(m)$ which basically just calculates $m^e \mod n$ for a given message $m$. Here $e=65537$ is known but $n$ is not. Can we determine the value of $n$ without ...
1
vote
1answer
2k views

Hash Collision Probabilities

Please give help! how can I calculate the probability of collision? I need a mathematical equation for my studying. Assume, I am using SHA256 to hash 100-bits. Thus: SHA256 {100} = 256-bits (hash ...
2
votes
1answer
359 views

ECDSA with common nonce?

I'm new to cryptography, and I've searching about ECDSA because I'm trying to solve a CTF. I've already check this site and Google, and I think I'm in the right path, but probably I am missing ...
7
votes
3answers
4k views

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? If, how big does the list of plaintext ...
1
vote
1answer
204 views

Recovering plaintext from AES-128 given round key 10 and ciphertext

I'm working on an old CTF challenge where AES-128 was used on a 16 byte block. I have the round 10 key and the ciphertext. What techniques exist for obtaining the plaintext?
0
votes
1answer
248 views

Are the Common modulus attack, Common Factor Attack, and Wiener's attack different?

Is there a difference between: Common modulus attack Common Factor attack Wiener's attack or are these just a different name for the same attack?
1
vote
1answer
606 views

Difference between eavesdropping and traffic analysis

I was wondering what is the conceptual difference between these two passive attacks on a network. I was reading about them on Wikipedia and they seem quite similar to me. Is there a difference?
2
votes
1answer
913 views

Fault attack on RSA-CRT

I am trying to understand fault attack on RSA-CRT, and I found some example, which I don't know how to solve it. I know public modulus $N$, public exponent $e$, a value of faulty signature (where ...
2
votes
1answer
780 views

Attack on RSA when I know $e$, ciphertexts $c_1, c_2$ of the same message $m$ with 2 coprime modules?

I know that the same message $m$ was sent to two people resulting in ciphertexts $c_1, c_2$. The public keys are $n_1$ and $n_2$, $gcd(n_1, n_2) = 1$. And $e=3$ in both cases. How can I retrieve the ...
1
vote
2answers
108 views

RSA: Should the generation of random data used for primes include zero

When generating random data that is later tested for primality, should the random data include the value 0x0? I would have thought that primes that do not include zero's are a subset of the set of ...
1
vote
1answer
247 views

Is forward search attack is the same as dictionary attack?

Currently, I started to learn about secure passwords in password file. The password file contains the hashed values for passwords. I know that the forward search attack for a password that if an ...
3
votes
1answer
142 views

Can perfect forward secrecy introduce vulnerabilities?

Is it always a win or could PFS algorithms introduce new attack vectors or weaken the level of secrecy vs not being used?
3
votes
2answers
328 views

What is the name of an attack where the compromise of one key compromises the whole system?

Consider the following: A whole system depends on the security of one private key and if this key is, for any reason, compromised, the whole system will be compromised. What's a suitable name for ...
0
votes
1answer
146 views

Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
2
votes
1answer
221 views

How to prove that a rainbow table is complete?

Passwords that are hashed but not salted can be cracked using the rainbow table. I went through this and this which explains the logic behind rainbow table very well. But I am missing something about ...
-2
votes
2answers
863 views

side channel attack on RSA [duplicate]

A side-channel attack is any attack based on information gained from the implementation of Encryption protocol and by monitoring security-critical operations. Almost every encryption had a side-...
1
vote
1answer
43 views

what can attackers do between two end hosts

I have one question that I couldn't come up with a nice solution. So let's have this analogy, I have a box full of money and I want to deliver to this my friend. Here if we think of a potential ...
1
vote
1answer
581 views

What is the difference between a forgery attack and an user impersonation attack? [closed]

I'm new to cryptography, so I was searching for a forgery attack, but unable to find anything. Can anybody tell me the difference between forgery attack and user impersonation attack?
3
votes
0answers
109 views

Cryptographic Attacks [closed]

I've been asked to write some course materials on cryptography and included in the objectives are some vulnerabilities/attacks. Most of these I have nailed but there are three that I don't seem to be ...
1
vote
1answer
69 views

What (if any) information can an eavesdropper infer in this scenario when using DES in OFB mode?

Assume that a company wants to use DES in order to encrypt messages to remotely control its manufacturing machines. The company uses different messages types of 8 ASCII characters length each. The ...
-1
votes
1answer
102 views

What will happen to existing cyphertext when today's encryption is broken? [closed]

Even optimistically, I think we can all agree that many encryption algorithms that are widely used in production today will be "broken" sometime in the next decades. With "broken", I mean that (...
0
votes
2answers
90 views

Self signed certificate for mobile app and backend from same company

My company's product is Android and iOS mobile app which connects to our own backend. All interactions of the mobile app are with backend developed by our own company. In such a situation, can the ...
0
votes
1answer
329 views

ElGamal with weak public key

Assuming this setup: A prime $p$, a generator $\alpha$ in $\mathbb{Z}_p^\ast$. Alice chooses her private exponent $d$ from $[2, p-2]$ and calculates her public key $\beta$ = $\alpha^d$. Bob then ...
8
votes
0answers
253 views

Bleichenbacher RSA1024 signature forgery, closed-form solution

Hal Finney's writeup (Bleichenbacher's RSA signature forgery based on implementation error) shows a formula for RSA3072. I tried to replicate the attack for RSA1024 and failed, since the first term of ...
3
votes
1answer
103 views

Statistical attacks on a list of MD5/SHA-1 hashes?

I have a list of MD5 and SHA-1 hashes where the input string is of the form secret1000 secret1001 … all the way up to ...
3
votes
1answer
142 views

Birthday problem applied to hash function with partition of the input set

I am not able to understand why if we consider a regular hash function, it is possible to say that we are partitioning the starting set and then apply the the birthday paradox/problem. Can anyone ...
0
votes
0answers
44 views

(Side channel) attack on a PIC18 micro controller

I'm trying to get some practical experience on (side channel) attacks. First I want to note all possible vulnerabilities. I thought about: Preset I have physical access and I own/wrote the software, ...
2
votes
2answers
134 views

Bellovin ESP Attack on UDP Packets

In Bellovin's ESP Attack, it is stated that: If $L_A$, $L_B$ are using UDP, attack is easier: Wait till session ends Allocate $L_B$'s UDP port to $X_B$ Replay all packets So, how ...
0
votes
1answer
964 views

Decryption of a file encrypted by pseudo-random number generator (The Linear Congruence rand()

How to decrypt this file: https://drive.google.com/open?id=1gZCujDYmEL-FZ5o_xBUS-Ng5979HSsZ7 Given that the only information available about it are: It has been created ‎on 21/3/‎2018, ‏‎9:05:15 AM ...
1
vote
0answers
52 views

Difference between fault measurement and fault model [closed]

In the context of fault attacks. What is the difference between fault measurement and fault model? I am reading a lecture and I can not understand for what measurement is used? Could you help me ...
6
votes
1answer
1k views

RSA attack with continued fractions (Wieners attack)

I found an article on the internet about an RSA attack with continued fractions. Given are the following numbers: $n = 205320043521075746592613$ $e = 70760135995620281241019$ $\frac{e}{n}=[0;2,1,...
2
votes
0answers
309 views

RSA signatures that allow hash to move around in block

I'm looking at a broken RSA signature padding implementation in a real device. It's a very-badly implemented version of PKCS #1-like encoding, but before PKCS added the DER-encoded hash identifier. ...
1
vote
1answer
943 views

Is there any ECDSA Attack if I have millions of signatures?

I have been given the task to test the security of our company software. Our company software generates ecdsa signed supply order files. One can generate as many files as he wants. so my question is ...
4
votes
1answer
190 views

What is the reasoning behind the PRESENT key schedule?

It seems there are few books on PRESENT and even fewer that give any reasoning behind the mechanics of the key schedule. I understand how it works to the extent that I made a simple Excel program of ...
3
votes
1answer
945 views

If a key is used to encrypt that same key, is the computational cost to brute force it decreased?

If a key $d$ is used to encrypt a message $m$ that is identical to the key $d$, resulting in a cipher $c$ $c = \text{Encrypt}(m, d) = \text{Encrypt}(d, d)$ is the computational cost to brute force $...
1
vote
2answers
11k views

Is it possible to break SHA-512?

Is it possible to break the SHA-512 hash algorithm? Are there any successful attacks out there?
6
votes
1answer
521 views

Does blinding work against side channel on RSA?

In the so called "blinding" technique for RSA, prior to decryption, the ciphertext is multiplied by random $r$ raised to the power of $e$; e.g., $C$ is replaced with $C\cdot r^e$; and then after ...
0
votes
1answer
84 views

Is rekeying attack the same as related-key attack?

I've been searching about rekeying attack, but what I found is always using the term "rekeying/related-key attack". Is rekeying attack the same as related-key attack?
1
vote
1answer
49 views

What is the procedure to proceed towards breaking a cipher text when the process of encryption is not known?

I mean , if one is provided with a cipher text and the process of encryption through which text has has been encrypted has not been provided , then how is the cipher text broken ? Is frequency ...
-1
votes
1answer
92 views

Question about key establishment protocol and key exchange attack

If an adversary $M$ observes a session of the protocol between $A$ and $B$ and learns the session key $k_{AB}$.How Can the adversary mount a successful impersonation attack and communicate with $B$ on ...
1
vote
1answer
190 views

Using round constants to thwart slide attacks

I'm partly unclear as to how the use of round constants in an iterated cipher makes it immune to slide attacks. I mean, I can see how it does from one perspective, but if the solution to slide attacks ...
7
votes
1answer
995 views

How does the ROCA attack work?

I have been trying to understand the ROCA attack described here as the "First Attack" and I cannot follow the explaination. I have been trying to generate a 512-bits key and crack it. As far as I can ...
2
votes
1answer
153 views

Risks of full length KCV (components and full keys)?

We have to comply with third-party security requirements for the loading of 3DES keys. I'm a little confused about the reason behind why Key Check Values (KCVs) can't be full length. As KCV are hashes,...
2
votes
0answers
90 views

*feasible* pre-image attacks against reduced SHA-1

(tldr: see last paragraph) Although SHA-1 is vulnerable to collision attacks, it is still resistant to pre-image attacks. SHA-1 was designed to be resistant until a brute-force attack of $2^{160}$ is ...
0
votes
1answer
468 views

Can you help me understand Pollard's rho example?

I'm studying the Pollard's rho algorithm to solve discrete logaritms on the Handbook of applied cryptografy but I didn't understand one part of the theory and looking at the example gets me more ...
1
vote
0answers
161 views

Boneh and Durfee attack on RSA

I am a maths teacher and I'm trying to understand the Boneh and Durfee attack on RSA. I am not very familiar with cryptography. I found a dutch scripting about it. I know that: $ e*d\equiv1+k*\phi(...
3
votes
4answers
3k views

Would possessing a string with the SHA-256 hash of all zeros lead to an attack on SHA-256?

Would possessing a string with the SHA-256 hash of all zero bits lead to an attack on SHA-256? I could easily imagine that a specialized attack leaked knowledge of how to do it, but I could equally ...
0
votes
1answer
66 views

The differences between the attackers in the definitions of IND-ATK and NM-ATK

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
1
vote
1answer
1k views

Algorithm for factoring knowing RSA private key

According to this and this paper from Alexander May is possible to factor given the knowledge of the RSA private key. This is possible via Coppersmith and LLL reduction. Now I am trying to implement ...
3
votes
1answer
211 views

How is the DUHK attack specific to the ANSI X9.31 RNG?

Recently, the DUHK attack on bad RNG implementations of hardware devices has been published. The attack is based on a (known or reverse engineerable) hardcoded key, which is used for a ANSI X9.31 ...