Questions tagged [attack]
A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.
435
questions
0
votes
1
answer
138
views
Encrypting two messages with the same content with different keys/IVs still secure if attacker knows they are the same?
I want to store two ciphertexts inside the same file.
The data stored in each ciphertext is the same (except for padding), but the data was encrypted with different keys and IVs. Both ciphertexts were ...
- 25
3
votes
1
answer
323
views
Key Committing AES-GCM
There is a handful of attacks against AEAD, and GCM in particular, which demonstrates that it is feasible for an attacker $\mathcal{A}$ to obtain a ciphertext $C$ which encrypts to multiple key/...
0
votes
0
answers
66
views
An adversary does know the block cipher key and some bits of the message and the cipher (same length as key). Does this help him to find pairs? (ECB)
Given a $N$-bit AES or similar block cipher with his $N$-bit key $k$.
We can encrypt a $N$-bit message $m$ to a $N$-bit cipher $c$ and decrypt it again.
$$E(m,k) = c$$
$$D(c,k) = m$$
An adversary does ...
- 573
6
votes
0
answers
125
views
About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?
Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$
with
$$p=(p_1, p_2)$$
$$q=(q_1,q_2)$$
$$p_1,q_1 \in [0,s)$$
$$p_2,q_2 \in [0,s^2)$$
We want to find a path in between ...
- 573
3
votes
1
answer
111
views
How to solve LWE/RLWE under partial information about $s$
For LWE/RLWE, it's difficult to find $s$ from $\left(A, b = As + e\right)$. But if the partial information of $s$ is leakaged, such as partial $s$ or parity of $s$, how easy would it become to solve ...
0
votes
1
answer
97
views
Proving you're from the year 2069
Just a question I thought of while playing an amazing game about time travel (13 sentinals aegis rim). What are the most bullet-proof cryptographic methods for proving you've come from beyond a ...
- 335
0
votes
1
answer
132
views
Proving that RSA CCA is possible
I'm reading from William Stalling's Cryptography & Network Security - 7th Edition
To me the first line suggests
$$(M^e\bmod n)\times(2^e\bmod n)=((2M)^e\bmod n)$$
which means that if we want to ...
- 103
1
vote
0
answers
1k
views
RSA Hastad's broadcast attack with large numbers
I understand the theory behind Hastad's broadcast attack.
Namely if we have three encrypted messages with the exponent e=3:
...
- 153
1
vote
1
answer
103
views
What's the probability of cracking this cipher using partial information about the private key obtained from $k$ public keys?
For the following cipher, what is the probability of someone without the private key generating a valid public key, using only information from a list of $k$ public keys previously generated with the ...
- 139
3
votes
0
answers
387
views
Is Ntru-Encrypt still secure in 2022
I'm going to use NTRU as post-quantum public-key encryption algo in my project.
I've googled attacks on NTRU and found a lot of them
but since I'm new to NTRU and don't understand the math used, and ...
- 31
3
votes
3
answers
740
views
How can we prevent duplicate key attacks on digital signatures
A limitation digital signatures is that for a given signature σ of a message m corresponding to a public key pk, an adversary could generate a pk', sk' that produces a signature σ' for m, such that σ'...
- 41
1
vote
0
answers
93
views
How to find strength of a cryptographic hash function?
I am having an idea to create a cryptographic hashing algorithm. I found a mathematical function $f: x \rightarrow y$ . By using Merkle-Damgård construction wide pipe, I designed a hashing function. ...
2
votes
2
answers
1k
views
Help with RSA CTF question
I'm trying to solve a CTF problem relating to RSA encryption.
I can run a challenge binary that will read a flag from a file, the flag will match the following RegEx:
...
- 23
2
votes
2
answers
553
views
Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 vulnerable to Zombie POODLE/GOLDENDOODLE attacks?
I'm getting mixed reports on this one. I have a web host and multiple SSL scanning tools (including the one run by Qualsys SSL Labs), saying that the cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ...
- 121
1
vote
0
answers
267
views
Invalid point attack yields wrong results for low order points
I've recently tried to replicate the results of the question Ruggero asked and which Samuel Neves answered here: Understanding Twist Security with respect to short Weierstrass curves
In my attempt to ...
2
votes
1
answer
386
views
Invalid point attack on quadratic twist of Elliptic Curve when -1 is a quadratic residue
I'm replicating an invalid point attack on ECC using Short Weierstrass curves. For this I have written a "dumb" implementation that does not validate points are on the curve before going ...
26
votes
7
answers
5k
views
Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?
Are there moderns (post World War II) and famous protocols that were proven secure (in any model: game-based, UC...) but whose proof was wrong and could have led to real-world attacks?
Note that:
I'm ...
- 1,136
2
votes
1
answer
42
views
How difficult is finding $i$ for sequence $s_{i} = g^{s_{i-1}} \mod P$ with $s_0 = g$ for given value $v\in [1,P-1]$
Assuming we found a constant $g$ and a prime $P$ which is able to produce all values from $1$ to $P-1$ with it's sequence
$$s_{i} = g^{s_{i-1}} \mod P$$
$$s_0 = g$$
How many steps are needed to ...
- 573
2
votes
1
answer
81
views
How difficult is finding $i$ in tetration $^{i}g = g\uparrow \uparrow i = \underbrace{g^{g^{\cdot\cdot\cdot^{g}}}}_i\equiv v \mod P$ for $v\in[1,P-1]$
EDIT: I messed up something (see comments at answer). This question contains some false statements EditEnd.
For tetration modulo prime $P$
$$^{i}g = g\uparrow \uparrow i = \underbrace{g^{g^{\cdot\cdot\...
- 573
1
vote
2
answers
1k
views
Is it possible to find an AES key given part of the key, the ciphertext, initialization vector and mode of encryption?
The following details are given:
Partial Key: ...
- 21
1
vote
2
answers
287
views
RSA blind signature attack but without public exponents
I been trying to solve a particular challenge where we have to sign an admin message.
At first it seems a classic RSA blind signature attack but eventually they didnt give out the public exponents(e,n)...
- 13
0
votes
2
answers
856
views
How can I decrypt an RC4 encrypted text when knowing the first 8 characters of the plain text secret?
I'm having difficulty decrypting a secret message as a part of a CTF and I was wondering how could I decrypt an encrypted text that has been encrypted with pycrypto RC4 and when the first 8 characters ...
0
votes
0
answers
613
views
What attacks exist on ECDSA if there are more than 10 million signatures?
I am aware that there are weaknesses in ECDSA when reusing NONCE and I am aware that there is a lattice attack on ECDSA.
Are ...
- 3
1
vote
1
answer
244
views
Is there a benefit to "double encryption" when it comes to attacks analyzing attempted decryption results?
This is a beginner's question related to general security, but it fits cryptography exchange because it's more specific to the action of cryptographic attacks and how they work.
Assume the following ...
- 189
1
vote
0
answers
104
views
How does an attacker decrypt a hash function by looking for linearity?
Reading the selected answer to Designing a hash function from first principles rather than depending on heuristics is very insightful.
The section on "nonlinearity" suggests that making ...
- 171
1
vote
0
answers
146
views
SHA-256 Hash Crack
Suppose, If a SHA-2 hash does get broken completely with hardly any power, where would it get reported and is there currently a bounty on it?
- 11
1
vote
1
answer
206
views
What is a differential attack on a hash function? How would one attack a SHA algorithm and what would achieve?
Currently, I have been assigned to attack a reduced version of SHA-1. What are we trying to achieve? How do we attack it?
- 11
1
vote
2
answers
328
views
Using Shor's algorithm to access RSA messages without factoring
Most of the time people forgot that the real aim of the adversary against encryption is accessing the message. For example, in the RSA case, we talk about the factoring of the modulus to reach the ...
- 47.6k
14
votes
1
answer
5k
views
Why "1" in 51% attack on Blockchain network
In many sources, included Wikipedia, we read:
Any pool that achieves 51% hashing power can effectively overturn network transactions, resulting in double-spending.
My question is: Why do we talk ...
- 243
1
vote
1
answer
96
views
Revealing original message length having random padding
If I have a message that has a fixed unknown length $L$, and we add to it's TLS encryption a random sized padding $0\leq n \leq N$ so the sent message if $L+n$.
I'm also able to make the target re-...
- 153
1
vote
0
answers
416
views
Cracking secret key, n, and m by hand with the Diffie-Hellman key exchange brute force
Problem: You see Michael and Nikita agree on a secret key using the Diffie-Hellman key exchange. Michael and Nikita choose $p = 97$ and $g = 5$.
Nikita chooses a random number n and tells Michael that ...
- 103
2
votes
0
answers
456
views
Short Nonces in ECDSA signature generation
Recently I noticed that my device generates short-sized Nonces.
Approximately $2 ^ {243} - 2^{244}$.
Could it turn out that there will be a small leak of ...
5
votes
1
answer
1k
views
Can a series of triangle reflections be used for cryptography?
(I guess no but why is this the case? Any way to make it possible?)
Out of a given equilateral triangle T1 (with his 3 vertices A,B,C lying in a finite Field $\mathbb F_N^D $) another equilateral ...
- 573
4
votes
1
answer
117
views
Would being able of factoring integers efficiently have some consequences over Elliptic Curve Cryptography?
Let's assume you can factor integers in a very efficient manner. Would that endanger the security of e.g. elliptic curve cryptography, or is there no link between the two ? You can often read that ...
user97492
0
votes
1
answer
306
views
Eavesdropping attack on text-book RSA encryption with public nonce
Consider the following scenario: Alice has a secret key and public key pair for text-book RSA (denoted $\text{sk}$ and $\text{pk}$ respectively). Bob has an authentic copy of $\text{pk}$. The ...
1
vote
0
answers
51
views
Can the salt be derived based on the other components of encrypted data?
I'm using python.cryptography's Fernet with PBKDF2 passphrase hashing to encrypt a piece of data (the value) that is stored, encrypted, in a database. The hashed passphrase is not stored in the ...
- 111
0
votes
1
answer
52
views
How does knowing the factors of the key help me decrypt?
I recently started learning about cryptography and its Quantum aspect and I came across Shor's Algorithm (which solves the following problem: "Given an integer N, find its prime factors").
I ...
- 3
0
votes
0
answers
63
views
What are the main attacks that can be done against a ZK Σ-protocol like Schnorr's identification scheme?
I heard about the "Chess Grandmaster Problem", Eavesdropping attacks and Man-in-the-middle.
Can they be applied in any way to a ZK protocol?
I'm not looking for long examples, just what are ...
- 131
2
votes
1
answer
304
views
kleptography SETUP attack in ecdsa
I'm trying to implement kleptography SETUP attack of ecdsa with python.
Just a simply script to verify the algorithm. However i can't get the right output as the paper said. Where is the problem? Can ...
- 41
0
votes
0
answers
87
views
MAC Security - MAC verification queries
In the applied cryptography book by Boneh and Shoup, Chapter 6 on MACs, it is stated that an adversary that is also capable of requesting the challenger for verification queries (in addition to ...
- 1,066
4
votes
2
answers
169
views
What would be the requirements for a new-age cipher standard?
While nowhere near being broken, AES has known attacks like reading from the substitution table, memory-based attacks, etc.
If we keep getting better at breaking ciphers and we eventually get close to ...
0
votes
1
answer
360
views
rsa attack with plain text, cypher text , public key
starting from the fact that there are different attacks on RSA, based on the starting situation, for example there are different studies, on attacks that find the private key having the freedom of an ...
- 101
0
votes
1
answer
209
views
Chinese remainder theorem in ECDSA for parameters in secp256k1?
It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions.
https://tls.mbed.org/public/WSchindler-...
- 3
2
votes
1
answer
1k
views
breaking RSA with linear padding using Hastads attack with e>=11
I have been playing around with Hastad's broadcast attack on RSA with linear padding.
Using the implementation and the test function from here: https://github.com/0n5/CTF-Crypto/blob/master/RSA/...
- 55
0
votes
1
answer
136
views
Can I copy digital signature for malicious purpose?
I am reading Cryptography. I have multiple questions to ask.
I signed my QR code with my private key so that people can verify it's mine. QR code has data which is public. I have this QR code on my ...
0
votes
1
answer
282
views
How to generate large integer private key for creating CTF challenges?
I am trying to create a RSA CTF challenge, exposing $n$, $e$, $c$, and $d$.
I have set $e=65537$ and $n = p * q$ where $p$ and $q$ are large primes each with 300 digits.
I have determined $c=m^e \mod ...
- 103
1
vote
0
answers
75
views
Impact of partitioning oracle attacks on file encryption?
I've just learned about partitioning oracle attacks recently, and I would like to clarify some things that are a little foggy to me right now.
According to this thread,
The aim is the recovery of a ...
- 421
2
votes
2
answers
1k
views
Time Complexity of Exhaustive Search Algorithm
I have the sets $S_1=\{2,10,20,6\}$ and $S_2=\{25,26,20\}$ and I want to find which numbers sum to make 32. This is very easy by inspection; 6 and 26. It seems similar to the Knapsack problem, but I ...
- 51
3
votes
1
answer
133
views
Factorization of polynomial in GF(2^128) used in GCM
It is widely known, that using a GCM nonce twice or even more often can be used to disclose the authentication key H. I understand, why this is theoretically possible. However, I have no feeling about ...
- 1,477
1
vote
1
answer
324
views
Why using same nonce (IV) twice voids confidentiality of plain text or even key?
I understand roughly (without details of GF algebra) the scheme of GCS/GMAC:
IV is to be put into Counter-0, so initializing counters.
It is known, that using a IV twice can not only reveal the plain ...
- 1,477