Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

Filter by
Sorted by
Tagged with
1
vote
1answer
268 views

Is the same message with repeated AES-GCM leaking plain text over time?

The same message results in different cipher text every time AES-GCM is applied. If an attacker collects repeated messages over time, will he be able to extract the plain text if enough cipher text is ...
8
votes
1answer
500 views

What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used ...
2
votes
1answer
156 views

Krack WPA2 decrypt only some small pieces of packets

I have gone through the paper (PDF) available at krackattacks.com. However, from what I understood you force a key reinstallation causing you a nonce reuse over 2 blob of data. As it is a keystream, ...
1
vote
0answers
19 views

Can we protect PRESENT from the Statistical Saturation Attack if we change the permutation layer to a random permutation layer?

This is continuation-question based on: If PRESENT had different permutations s would that protect it against Statistical Saturation Attack? Can we protect PRESENT from Statistical Saturation Attacks ...
16
votes
4answers
9k views

How can C rand() be exploited if a secure seed is used?

I've just started doing a research project on CSPRNGs and I would like to know what kind of vulnerabilities a regular PRNG has with a secure seed. For example, if I generate a random number using ...
4
votes
1answer
429 views

If PRESENT had different permutations s would that protect it against Statistical Saturation Attack?

The block cipher PRESENT is vulnerable to the Statistical Saturation Attack for up to 15 rounds (PDF) and a simple example is here. So my questions are, if some (or all) of the permutations were ...
5
votes
1answer
335 views

Is the RSA signature attack from Desmedt and Odlyzko practical?

I would like to understand how the attack from the Desmedt and Odlyzko on RSA signatures (and subsequents works) can be made practical. This attack describes a way to forge the signature on a new ...
4
votes
1answer
1k views

Bleichenbacher's Attack on high public exponent RSA keys?

Why can't Bleichenbacher's Attack work for RSA public exponents with values equal to 65537 and above? Does the fact that 65337 is a prime number have any relevance to it?
3
votes
3answers
189 views

Why are processes requiring (almost) as much work as brute force considered an “attack” on a hash function?

In the literature on attacks against hash functions, I frequently come across algorithms requiring $2^n$ work described as being preimage or collision "attacks" on a hash function with only marginally ...
1
vote
1answer
95 views

Is it Possible to Generate a Duplicate DH Session Key from 2 Pairs of DH Keys?

This might sound pointless at first, but I want to know if it's computationally feasible to generate the same resulting session key in 2 different DH key exchanges. The purpose would be for a man-in-...
1
vote
0answers
320 views

what is scyther code for this protocol? [closed]

I wrote the following protocol. I wrote the code. I do not know how to write the rest of the code. please guide me. usertype SessionKey; usertype TimeStamp; hashfunction H1; macro sessionkey = H();...
0
votes
1answer
105 views

Are “deterrent” algorithms like NFS and Coppersmith's algorithm actually used in practice?

It seems like there are a lot of algorithms in number theory which I would classify as "deterrent" algorithms -- for example the various number field sieves for factoring, Coppersmith's algorithm for ...
-2
votes
2answers
530 views

Relationship between a key stream having a high entropy and whether it is cryptically secure in a stream cipher

Hi i am trying to build a key stream generator for my homemade stream cipher.The key stream output has a close to maximum entropy value and a large periodicity. What does it take for this generator to ...
4
votes
1answer
2k views

How to attack Merkle-Hellman cryptosystem if the first element in the superincreasing series is too small?

In An Introduction to Mathematical Cryptography Jeffrey Hoffstein et al. claim that "It turns out that if $r_1$ is too small, then there are easy attacks, so we must insist that $r_1>2^n$." Here $...
5
votes
3answers
1k views

What are the dangers of using CPU clock drift for generating random data?

From what I understand, a physical source of true randomness could be achieved with a multi-core processor, by using clock drift between two or more cores. However, a processor is easier to ...
11
votes
4answers
2k views

What is the malicious potential of a key-substitution-attack?

What is the idea behind a key-substitution-attack? We start from a given pair of message $m$ and signature $s(m)$. The signature can be verified by anybody in possess of the public key $y$: $v(m, s, ...
3
votes
0answers
156 views

Is the “Pico” alternative to passwords vulnerable to man-in-the-middle?

Maybe someone has already heard about "Pico" by Frank Stajano. In short: It is a model for an alternative for using passwords for authentication and seems to be very interesting. Regarding the paper, ...
-1
votes
1answer
101 views

Preventing predictable modifications to AES encrypted data

I'm fairly new to cryptography and am trying to find out best practice for this situation. Let's say I have some code which is going to be used to pass around an encrypted e-mail address. I encrypt it ...
7
votes
1answer
546 views

How does the sponge construction avoid the weaknesses present in Merkle–Damgård hash function?

How are the weaknesses of the Merkle–Damgård construction (i.e. the Herding attack, multicollisions, length extension, expandable messages) avoided in the sponge construction?
3
votes
1answer
410 views

4th Root of RSA Modulus Attack algorithm

I am trying to solve here a task but I have no clue on how to approach it. The last few days I tried to find a way but I have no clue :( Maybe someone of you could give me a hint on how to do it. The ...
1
vote
1answer
4k views

Can you help me understand the RSA Broadcast Attack?

I am currently working on a broadcast attack on RSA. This is what I have: 17 ciphertexts $C_i$ and corresponding moduli $N_i$ for a single common message $m$. Public key $e = 17$ The first part (of ...
0
votes
2answers
711 views

Recover key given partial key, IV and cipher text using CBC mode

Given a known IV and a small part of the key (not enough to use brute force) is there are any way to break CBC encryption with only one cipher text?
3
votes
1answer
159 views

BEAST Attack: from guessing to decoding

I understood the XOR trick that allows an attacker to guess a block of a previously sent message from the client to the server: the attacker forces the client to send the message $\tilde{m} = c_n \...
2
votes
3answers
2k views

Can someone randomly guess the key to AES 256 bit encryption?

Is it possible that someone can randomly input a key to AES 256 bit encryption and it is correct? What are the chances of this happening? Is it even possible or not?
18
votes
2answers
3k views

How is encryption broken today?

There are often articles in the news that state that a certain country or hacker has been able to decrypt/hack highly protected systems: Some examples are the Lockheed Martin RQ-170 Sentinel that was ...
1
vote
1answer
131 views

What is definition of adversary ? And what they do?

Currently I am writing my last assignment about secret sharing. But I don't get clearly about adversary. I know this seems so basic understanding in secret sharing. But I couldn't get references that ...
0
votes
1answer
127 views

Password-Managers: what is the IND-CDBA attack logic?

In the work of Paolo Gasti and Kasper B. Rasmussen On The Security of Password Manager Database Formats, they describe two attack forms: IND-CDBA and MAL-CDBA. While I understand the MAL-CDBA attack ...
4
votes
2answers
184 views

How to find collisions in a secret-prefix Merkle–Damgård given an adversary that can choose the IV?

I am given the following Merkle–Damgård construction: Let $f \colon (\{0,1\}^n \times \{0,1\}^b) \to \{0,1\}^n$ be a compression function. Fix a string $\mathrm{IV}\in\{0,1\}^n$, and for $M \in (\{0,...
2
votes
0answers
64 views

Simultaneous collision for MD5 and SHA1? [duplicate]

I know that both MD5 and SHA1 are considered cryptographically broken now that collisions can reasonably be computed. The question I have is: What is the likelihood that a collision could be found for ...
1
vote
1answer
87 views

TLS-conformant ciphertexts and SSLv2-conformant ciphertexts for Blechenbacher attack for DROWN attack

This is regarding the published paper on the DROWN attack (https://drownattack.com/drown-attack-original-report.pdf) It was mentioned in the paper that for TLS, RSA PKCS#1 v1.5 is used to encapsulate ...
9
votes
2answers
2k views

Is there a downside to encrypting too much data with the same key?

Is there a downside to encrypting too much data? If so, what? I'm guessing things like too much data encrypted with the same key, possibly leaking information due to a collision encrypting non-...
1
vote
1answer
203 views

What is the prp-advantage of a $2^{80}$-time adversary attacking AES-256?

I am somewhat confused with something I read in Dan Boneh's slides discussing the advantage of a $2^{80}$-time adversary attacking AES-256; according to Boneh, the assumption is that this advantage is ...
3
votes
1answer
81 views

Deriving user keys from ID

The "normal idea" is to generate a key per user, send them to the users (securely, of course), and store them in a database. But what if I use a keyed hash (like Blake2b) with a server key and then ...
3
votes
1answer
865 views

Attacking a blackbox PRNG

Every single PRNG attack I could find during my research depends on knowing the PRNG algorithm(s) as well as having definite output. Suppose you have the following scenario: nothing is known about ...
5
votes
1answer
449 views

Slide attack: creating an actual attack on the Simon Cipher

I have been reading the Simon Cipher paper. It has the line: "The SIMON key schedules employ a sequence of 1-bit round constants specifically for the purpose of eliminating slide properties and ...
1
vote
1answer
522 views

RSA factorization challenge

I'm in a teacher-like position and would like my students to practice certain classes of RSA attacks. However I don't really know how to go about it and how to sensibly choose the parameters such that ...
12
votes
1answer
280 views

Why doesn't Wang's attack work on SHA-1?

Wang's (et al) differential attack works on MD5, MD4, RIPEMD and HAVAL. Why doesn't it work on SHA-1?
9
votes
1answer
1k views

How can I attack a Triple-Block cipher with 2 keys (like 3DES) with a cost of ≤ 2⁵⁶

I am trying to solve something and I have but I have no idea anymore. Maybe anyone of you has an idea/solution/hint. Given is a block cipher $F$ with key length $n$. It looks like this: $$c = ENC_{k1}...
0
votes
1answer
228 views

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good?

How long would it take on average to perform a timing attack on HMAC over brute forcing a 32bit tag if the hash is good? For example, let's take the hash: 79b7cdc3 to calculate the first byte you ...
1
vote
2answers
3k views

Is it possible to break AES-128 ECB if you are given a ciphertext and a small portion of the key?

If you are given the ciphertext and the first half bytes (8 bytes) of the encryption key (key is 16 bytes in total), can you use this to break AES-128 ECB encryption and determine the last 8 bytes of ...
1
vote
2answers
184 views

Preventing attack in RSA modified version

I have the following modified version of RSA apparently proposed by Shamir. To check the original version of RSA check the first scheme in this other question. The modified version goes as follows:...
0
votes
1answer
1k views

Are block ciphers vulnerable to “key reuse” and/or “bit-flipping” attacks?

I know that almost all stream ciphers are vulnerable to “key reuse” and “bit-flipping” attacks. Because AES also uses $XOR$ in its algorithm, is it possible for block ciphers – like AES – to be ...
17
votes
1answer
2k views

What does a “real” quantum computer need for cryptanalysis and/or cryptographic attack purposes?

The cryptographic world has been buzzing the word "quantum" for a while now (even the NSA is currently preparing itself for a post-quantum crypto world) and quantum-related hardware engineering is ...
1
vote
0answers
50 views

How can I match each encrypted message with the public key used to encrypt them for a common encryption attack RSA

I have five encryption mods ($n_1$ through $n_5$) with the same encryption exponent ($e$) and the same message encrypted using the five public keys giving $E_1$ through $E_5$ that were not given in a ...
2
votes
1answer
97 views

How any attack on a cipher carried out? Are these practical or only theoretical?

I have been reading about successful attacks on AES and other ciphers. One such mention is here (see excerpt below): AES was published under the name Rijndael in 1998. Refereed cryptanalytic ...
1
vote
1answer
842 views

how does a time-memory trade off attack work?

I'm a student who learning cryptography, refer to this book "Applied Cryptanalysis - Breaking Ciphers in the Real World" (page 133). It helped me know about time-...
1
vote
1answer
168 views

What's the name of this cipher? And how can it be broken?

Assuming that: SHA-256 and SHA-512 are random and irreversible the output appended to some random and long enough secret is just as random as any other data and will produce values that are just as ...
5
votes
1answer
722 views

Generate 64 bit HMAC

Given $plaintext$ and its respective authentication $tag$ which is generated from HMAC-MD5 so that $|tag| = 128$ bits. If the application is constrained and can send only $64$ bits. Is it ok, if we ...
1
vote
1answer
466 views

Is it safe to send HMAC and plaintext in the same message?

If a certain protocol sends $plaintext$ and its corresponding HMAC then is such a protocol prone to key extraction attacks ? Intuitively , HMAC is $ciphertext$ generated from $plaintext$, (although ...
11
votes
0answers
2k views

Cracking a PRNG by observing ranks within groups of its output

Suppose that I am generating random numbers with Python's random module, so that there is a known random number generator (Mersenne Twister in this case). I've ...