# Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

435 questions
Filter by
Sorted by
Tagged with
138 views

### Encrypting two messages with the same content with different keys/IVs still secure if attacker knows they are the same?

I want to store two ciphertexts inside the same file. The data stored in each ciphertext is the same (except for padding), but the data was encrypted with different keys and IVs. Both ciphertexts were ...
• 25
323 views

### Key Committing AES-GCM

There is a handful of attacks against AEAD, and GCM in particular, which demonstrates that it is feasible for an attacker $\mathcal{A}$ to obtain a ciphertext $C$ which encrypts to multiple key/...
66 views

### An adversary does know the block cipher key and some bits of the message and the cipher (same length as key). Does this help him to find pairs? (ECB)

Given a $N$-bit AES or similar block cipher with his $N$-bit key $k$. We can encrypt a $N$-bit message $m$ to a $N$-bit cipher $c$ and decrypt it again. $$E(m,k) = c$$ $$D(c,k) = m$$ An adversary does ...
• 573
125 views

### About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?

Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$ with $$p=(p_1, p_2)$$ $$q=(q_1,q_2)$$ $$p_1,q_1 \in [0,s)$$ $$p_2,q_2 \in [0,s^2)$$ We want to find a path in between ...
• 573
111 views

### How to solve LWE/RLWE under partial information about $s$

For LWE/RLWE, it's difficult to find $s$ from $\left(A, b = As + e\right)$. But if the partial information of $s$ is leakaged, such as partial $s$ or parity of $s$, how easy would it become to solve ...
97 views

### Proving you're from the year 2069

Just a question I thought of while playing an amazing game about time travel (13 sentinals aegis rim). What are the most bullet-proof cryptographic methods for proving you've come from beyond a ...
• 335
132 views

### Proving that RSA CCA is possible

I'm reading from William Stalling's Cryptography & Network Security - 7th Edition To me the first line suggests $$(M^e\bmod n)\times(2^e\bmod n)=((2M)^e\bmod n)$$ which means that if we want to ...
• 103
1 vote
1k views

I understand the theory behind Hastad's broadcast attack. Namely if we have three encrypted messages with the exponent e=3: ...
• 153
1 vote
103 views

### What's the probability of cracking this cipher using partial information about the private key obtained from $k$ public keys?

For the following cipher, what is the probability of someone without the private key generating a valid public key, using only information from a list of $k$ public keys previously generated with the ...
• 139
387 views

### Is Ntru-Encrypt still secure in 2022

I'm going to use NTRU as post-quantum public-key encryption algo in my project. I've googled attacks on NTRU and found a lot of them but since I'm new to NTRU and don't understand the math used, and ...
• 31
740 views

### How can we prevent duplicate key attacks on digital signatures

A limitation digital signatures is that for a given signature σ of a message m corresponding to a public key pk, an adversary could generate a pk', sk' that produces a signature σ' for m, such that σ'...
1 vote
93 views

### How to find strength of a cryptographic hash function?

I am having an idea to create a cryptographic hashing algorithm. I found a mathematical function $f: x \rightarrow y$ . By using Merkle-Damgård construction wide pipe, I designed a hashing function. ...
1k views

### Help with RSA CTF question

I'm trying to solve a CTF problem relating to RSA encryption. I can run a challenge binary that will read a flag from a file, the flag will match the following RegEx: ...
553 views

### Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 vulnerable to Zombie POODLE/GOLDENDOODLE attacks?

I'm getting mixed reports on this one. I have a web host and multiple SSL scanning tools (including the one run by Qualsys SSL Labs), saying that the cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ...
• 121
1 vote
267 views

### Invalid point attack yields wrong results for low order points

I've recently tried to replicate the results of the question Ruggero asked and which Samuel Neves answered here: Understanding Twist Security with respect to short Weierstrass curves In my attempt to ...
386 views

### Invalid point attack on quadratic twist of Elliptic Curve when -1 is a quadratic residue

I'm replicating an invalid point attack on ECC using Short Weierstrass curves. For this I have written a "dumb" implementation that does not validate points are on the curve before going ...
5k views

### Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?

Are there moderns (post World War II) and famous protocols that were proven secure (in any model: game-based, UC...) but whose proof was wrong and could have led to real-world attacks? Note that: I'm ...
• 1,136
42 views

### How difficult is finding $i$ for sequence $s_{i} = g^{s_{i-1}} \mod P$ with $s_0 = g$ for given value $v\in [1,P-1]$

Assuming we found a constant $g$ and a prime $P$ which is able to produce all values from $1$ to $P-1$ with it's sequence $$s_{i} = g^{s_{i-1}} \mod P$$ $$s_0 = g$$ How many steps are needed to ...
• 573
81 views

### How difficult is finding $i$ in tetration $^{i}g = g\uparrow \uparrow i = \underbrace{g^{g^{\cdot\cdot\cdot^{g}}}}_i\equiv v \mod P$ for $v\in[1,P-1]$

EDIT: I messed up something (see comments at answer). This question contains some false statements EditEnd. For tetration modulo prime $P$ ^{i}g = g\uparrow \uparrow i = \underbrace{g^{g^{\cdot\cdot\...
• 573
1 vote
1k views

### Is it possible to find an AES key given part of the key, the ciphertext, initialization vector and mode of encryption?

The following details are given: Partial Key: ...
1 vote
287 views

### RSA blind signature attack but without public exponents

I been trying to solve a particular challenge where we have to sign an admin message. At first it seems a classic RSA blind signature attack but eventually they didnt give out the public exponents(e,n)...
• 13
856 views

### How can I decrypt an RC4 encrypted text when knowing the first 8 characters of the plain text secret?

I'm having difficulty decrypting a secret message as a part of a CTF and I was wondering how could I decrypt an encrypted text that has been encrypted with pycrypto RC4 and when the first 8 characters ...
613 views

### What attacks exist on ECDSA if there are more than 10 million signatures?

I am aware that there are weaknesses in ECDSA when reusing NONCE and I am aware that there is a lattice attack on ECDSA. Are ...
• 3
1 vote
244 views

### Is there a benefit to "double encryption" when it comes to attacks analyzing attempted decryption results?

This is a beginner's question related to general security, but it fits cryptography exchange because it's more specific to the action of cryptographic attacks and how they work. Assume the following ...
• 189
1 vote
104 views

### How does an attacker decrypt a hash function by looking for linearity?

Reading the selected answer to Designing a hash function from first principles rather than depending on heuristics is very insightful. The section on "nonlinearity" suggests that making ...
• 171
1 vote
146 views

### SHA-256 Hash Crack

Suppose, If a SHA-2 hash does get broken completely with hardly any power, where would it get reported and is there currently a bounty on it?
1 vote
206 views

### What is a differential attack on a hash function? How would one attack a SHA algorithm and what would achieve?

Currently, I have been assigned to attack a reduced version of SHA-1. What are we trying to achieve? How do we attack it?
1 vote
328 views

### Using Shor's algorithm to access RSA messages without factoring

Most of the time people forgot that the real aim of the adversary against encryption is accessing the message. For example, in the RSA case, we talk about the factoring of the modulus to reach the ...
• 47.6k
5k views

### Why "1" in 51% attack on Blockchain network

In many sources, included Wikipedia, we read: Any pool that achieves 51% hashing power can effectively overturn network transactions, resulting in double-spending. My question is: Why do we talk ...
• 243
1 vote
96 views

### Revealing original message length having random padding

If I have a message that has a fixed unknown length $L$, and we add to it's TLS encryption a random sized padding $0\leq n \leq N$ so the sent message if $L+n$. I'm also able to make the target re-...
• 153
1 vote
416 views

### Cracking secret key, n, and m by hand with the Diffie-Hellman key exchange brute force

Problem: You see Michael and Nikita agree on a secret key using the Diffie-Hellman key exchange. Michael and Nikita choose $p = 97$ and $g = 5$. Nikita chooses a random number n and tells Michael that ...
• 103
456 views

### Short Nonces in ECDSA signature generation

Recently I noticed that my device generates short-sized Nonces. Approximately $2 ^ {243} - 2^{244}$. Could it turn out that there will be a small leak of ...
1k views

### Can a series of triangle reflections be used for cryptography?

(I guess no but why is this the case? Any way to make it possible?) Out of a given equilateral triangle T1 (with his 3 vertices A,B,C lying in a finite Field $\mathbb F_N^D$) another equilateral ...
• 573
117 views

### Would being able of factoring integers efficiently have some consequences over Elliptic Curve Cryptography?

Let's assume you can factor integers in a very efficient manner. Would that endanger the security of e.g. elliptic curve cryptography, or is there no link between the two ? You can often read that ...
306 views

### Eavesdropping attack on text-book RSA encryption with public nonce

Consider the following scenario: Alice has a secret key and public key pair for text-book RSA (denoted $\text{sk}$ and $\text{pk}$ respectively). Bob has an authentic copy of $\text{pk}$. The ...
1 vote
51 views

### Can the salt be derived based on the other components of encrypted data?

I'm using python.cryptography's Fernet with PBKDF2 passphrase hashing to encrypt a piece of data (the value) that is stored, encrypted, in a database. The hashed passphrase is not stored in the ...
• 111
52 views

### How does knowing the factors of the key help me decrypt?

I recently started learning about cryptography and its Quantum aspect and I came across Shor's Algorithm (which solves the following problem: "Given an integer N, find its prime factors"). I ...
63 views

### What are the main attacks that can be done against a ZK Σ-protocol like Schnorr's identification scheme?

I heard about the "Chess Grandmaster Problem", Eavesdropping attacks and Man-in-the-middle. Can they be applied in any way to a ZK protocol? I'm not looking for long examples, just what are ...
304 views

### kleptography SETUP attack in ecdsa

I'm trying to implement kleptography SETUP attack of ecdsa with python. Just a simply script to verify the algorithm. However i can't get the right output as the paper said. Where is the problem? Can ...
• 41
87 views

### MAC Security - MAC verification queries

In the applied cryptography book by Boneh and Shoup, Chapter 6 on MACs, it is stated that an adversary that is also capable of requesting the challenger for verification queries (in addition to ...
• 1,066
169 views

### What would be the requirements for a new-age cipher standard?

While nowhere near being broken, AES has known attacks like reading from the substitution table, memory-based attacks, etc. If we keep getting better at breaking ciphers and we eventually get close to ...
360 views

### rsa attack with plain text, cypher text , public key

starting from the fact that there are different attacks on RSA, based on the starting situation, for example there are different studies, on attacks that find the private key having the freedom of an ...
• 101
209 views

### Chinese remainder theorem in ECDSA for parameters in secp256k1?

It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions. https://tls.mbed.org/public/WSchindler-...
• 3
1k views

I have been playing around with Hastad's broadcast attack on RSA with linear padding. Using the implementation and the test function from here: https://github.com/0n5/CTF-Crypto/blob/master/RSA/...
• 55
136 views

### Can I copy digital signature for malicious purpose?

I am reading Cryptography. I have multiple questions to ask. I signed my QR code with my private key so that people can verify it's mine. QR code has data which is public. I have this QR code on my ...
282 views

133 views

### Factorization of polynomial in GF(2^128) used in GCM

It is widely known, that using a GCM nonce twice or even more often can be used to disclose the authentication key H. I understand, why this is theoretically possible. However, I have no feeling about ...
• 1,477
1 vote