Questions tagged [attack]
A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.
435
questions
2
votes
1
answer
173
views
What happens if the Edwards curve isn't quadratic twist secure?
On this webpage, Daniel Bernstein offers that the curve must be quadratic twisted secure. This means that if the curve has $\#E$ points on $Z_p$ where $\#E=p+1-t$, then the quadratic twist curve has $\...
- 482
2
votes
1
answer
828
views
Can you please explain how Manger's attack against RSA OAEP works?
I searched but found nothing except the original paper, and I can't wrap my head around it. Can you help me by giving an overview and then if possible, a short explanation of the algo?
- 21
2
votes
1
answer
94
views
Is generalized birthday attack only suitable for the problem with multiple solutions?
In David Wagner's article A Generalized Birthday Problem, he said and I quote:
Our algorithm works only when one can extend the size of the lists freely, i.e, in the special case where there are ...
- 367
3
votes
2
answers
4k
views
So is AES-256 more secure or less secure than AES-128 after all?
It seems there are attacks that work more effectively on AES-256 than AES-128, which makes it less secure in some cases. But the bigger key size should add some safety margin on the other hand, for ...
- 739
0
votes
1
answer
58
views
Domain Keys Identified Mail (DKIM)
If a company uses Domain Keys Identified Mail ("sender adds a special signature which includes author name / date signed by RSA Private Key. Receiver verifies the signature by looking up the ...
- 11
1
vote
2
answers
2k
views
Crack AES encryption via passphrase dictionary attack?
How easy would it be to crack a AES-256 encrypted file, that is protected by a passphrase?
I understand that the trying to brute force a AES-256 encryption key would be on the unfeasible side, even ...
- 13
30
votes
1
answer
5k
views
How was this 2048 bit number factored so fast?
I'm working on a CTF. The challenge is to get the contents of an encrypted message given the ciphertext and the 2048-bit RSA public key. I did finally get the flag after a few hours, but I'm still not ...
- 403
2
votes
0
answers
129
views
Howgrave-Graham lattice attack on NTRU
I am lookin for a good example to illustrate this attack on NTRU using low parameters but I failed to do that, The attack consist to use LLL reduction on A basis of NTRU Lattice, let us use the column ...
- 421
2
votes
1
answer
150
views
How to use sagemath to find nonlinear invariants of S-box?
I read a paper about a nonlinear invariant attack that is "Nonlinear Invariant Attack: Practical Attack on Full SCREAM, iSCREAM, and Midori64"
And I've found a website of sagemath : https://...
- 23
1
vote
0
answers
255
views
Vulnerability in DES3 when key can be chosen
In the question there are two functions encrypt basically does IV ⨁ DES3(P⨁IV) and encrypt_flag just encrypts the flag after being padded into a multiple of 8. IV is a random 8 byte number which is ...
- 201
2
votes
0
answers
110
views
The Primal and Dual attack security estimates in Kyber round 3 specification
In Kyber round 3 specification, the table 4 gave the security estimates of Primal and Dual attack with respect to Kyber 512, 768 and 1024 (see the figure below). However, using the python script given ...
- 171
1
vote
1
answer
110
views
Quadratic Equations to Describe SBox
I am using a 8 bit Sbox having 16 entries with a lookup table of 4x4 in cryptographic algorithm. Sbox is constructed on subgroup of galois field 2^8. I want to calculate number of quadratic equations ...
- 11
2
votes
1
answer
76
views
Choosing rings for PLWE
In [ELOS15], the authors give an attack on RLWE, and claim that "the hardness of Ring-LWE is...
dependent on special properties of the number field" chosen; whereas, responding to prior ...
- 381
7
votes
2
answers
1k
views
Is there a complete summarized list of attacks on Diffie-Hellman?
Is there a complete summarized list of attacks on Diffie-Hellman?
For RSA, there is this paper by Boneh, so I was wondering whether there is such a list for attacks on DHKE. I have been looking ...
- 201
0
votes
1
answer
90
views
Is it possible to alter the plaintext message without altering the ciphertext?
Is it possible to alter the contents of a plaintext message without altering the ciphertext? Altering the private key is allowed to accomplish this. If the answer is yes, how would I go about in doing ...
- 1
2
votes
1
answer
142
views
Dishonest verifier running a concurrent zero-knowledge protocol
Suppose Alice and Bob are engaged in the graph 3-colorability Zero-knowledge protocol in which Alice permutes a coloring $\varphi:V\rightarrow \{1,2,3\}$ for a graph $G(V,E)$, and then sends a ...
- 23
6
votes
2
answers
408
views
Examples of Weak Cryptography being exploited in the wild by cybercriminals?
As a theorist, I often motivate the need for strong cryptography via simplistic methods, such as "If this did not exist, your online bank transactions would be vulnerable". This is of course ...
- 11.6k
0
votes
1
answer
174
views
Why is $\phi(N) = (p^2 -1) (q^2 - 1)$ here?
I was reading a paper on attacks on RSA variants, and the paper equates $\phi(N) = (p^2-1)(q^2-1)$. Before, I have always seen $\phi(N) = (p-1)(q-1)$ and don't understand why it is different here.
I ...
1
vote
2
answers
494
views
Is it possible to unscramble a scrambled ed25519 SSH key?
Let's say I generate an ed25519 SSH key with ssh-keygen -t ed25519. Then I take the private key file and randomly scramble the order of base64 encoded characters. ...
- 13
5
votes
1
answer
185
views
Is there any correlation in between two AES with a key differ only by one bit? (ECB mode)
Given two AES (128bit, ECB mode) with almost equal keys $k_1,k_2$: 127 of the 128 key bits are equal. Is there any correlation in between the ciphers they build?
$$AES_1(m_i) = c_i$$
$$AES_2(m_i) = ...
- 573
2
votes
1
answer
207
views
basic question regarding two-time pad attack
Dan Boneh's Crypto 1 Course includes a lesson on stream ciphers with the following slide:
He asks the question:
And the answer he gives is $m \oplus p$, which is why this is insecure.
But I don't ...
- 133
3
votes
2
answers
324
views
In which case number field sieve/index calculus is faster for solving discrete logarithm?
Given the normal discrete logarithm problem:
$$a = b^c \mod{P}$$
with prime $P$ and numbers $a,b,c$
For which kind of $P,b$ the NFS/IC algorithm is faster than Baby-Step/Giant-Step+ Pollard's Rho ($\...
- 573
4
votes
1
answer
405
views
What is the largest parameter broken for NTRU?
The original secure parameters for NTRU shown below are from the original HPS98 paper. This is vastly different from the current secure suggested parameters in the NIST PQC round 3 submission.
...
- 237
1
vote
2
answers
326
views
Who provides prime numbers for cryptographic protocols?
I am currently writing a thesis about different cryptographic protocols like DH-Key exchange, TLS or IKE.
Most of them rely on a prime number earlier or later, so for security reasons I wondered if ...
- 11
2
votes
1
answer
221
views
Does Hinek and Lam's Paper prove that Common Modulus Attacks is possible with non-coprime public exponents?
We know that Common Modulus Attacks work with coprime public exponents $(e',s)$ such that $${e_1}s+{e_2}t=\gcd(e_1,e_2)=1$$
I am reading Hinek and Lam's Paper: Common Modulus Attacks on Small Private ...
- 159
1
vote
1
answer
119
views
Finding the private key for this signature scheme
Assume the signature scheme where $x$ is the private key and the public key $y = g^x \pmod{p}$. The signature works as:
Choose $h \in \{0, \dots, p-2 \}$ s.t.: $\mathcal{H}(m) + x + h \equiv 0 \pmod{...
- 89
1
vote
0
answers
76
views
Attacks on LWE when q is a power of 2
I am working on an LWE instance where q is a power of 2 and I'm wondering if there is any literature about attacks in this context, especially if there are any attacks which work significantly better. ...
- 63
0
votes
1
answer
141
views
Is there a problem with this specific RSA protocol?
So a protocol uses two random primes $P$ and $Q$ with the equivalent bit length of around 2048 bits, multiplies to form $N$. The encryption function in detail is:
$m^e \bmod\ N$
$(\text{512-bit-random-...
- 23
2
votes
1
answer
180
views
How to attack Oblivious Transfer from a malicious sender that can deviate from the protocol
I am looking at at the $1–2 \space \text{oblivious transfer}$ that is described here: https://en.wikipedia.org/wiki/Oblivious_transfer#:~:text=In%20cryptography%2C%20an%20oblivious%20transfer,Rabin.
I ...
- 155
5
votes
0
answers
1k
views
Can I alter encrypted data without decrypting it? [duplicate]
I didn't find a direct solution for it. Can I modify encrypted data without accessing it?
If there is an example, I would appreciate it.
- 151
1
vote
1
answer
244
views
AES 5 and 6 round SQUARE Attack
SQUARE attack on AES128 requires a single delta set for 4-round variant, or I assume single delta set is enough since keyspace is reduced to few keys which can be easily brute-forced. However, as we ...
- 96
4
votes
0
answers
71
views
On the current memory retain limits for the coldboot attack (2020)
ColdBoot attack is introduced by Halderman et. al in 2009
Lest we remember: cold-boot attacks on encryption keys
In their articles, they represent experimented that
We found that the dimensions of ...
- 47.5k
1
vote
0
answers
26
views
Are there any mutual-distance bounding protocols in RFID context?
Distance-bounding algorithms are a classical solution for the Relay Attack, wherein a verifier can determine an upper bound on its distance from the prover.
However, recent literature is discussing ...
1
vote
1
answer
412
views
Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)
When you know the Salsa20's keystream, how do you know the next keystream?
In other words, can I infer the next keystream when I don't know the Key and IV of Salsa20, but the keystream is ...
- 13
1
vote
1
answer
157
views
Which RSA keys are actually attacked In practice?
I understand that it is important to check how hard it is to attack RSA keys, but I assume at some key size attackers would not even try. Real attacks are carried out by exploiting mistakes in the ...
- 1,108
0
votes
1
answer
69
views
Security of a custom AES-based attack model
Provided that:
$AES(plaintext, key)$ is the standard AES block cipher for a 128 bits block.
$\oplus$ is the standard XOR operation.
$K$ is a constant 128 bits pseudorandom value, which is used as the ...
- 3
1
vote
0
answers
385
views
Breaking vulnerable ElGamal encryption
In a ctf, I encountered this problem:
...
0
votes
1
answer
79
views
May an adversary be fooled by a random-looking input that in reality is fixed?
I want to prove the EUF-CMA-security of a signature scheme. It is a variation on an established scheme, therefore I would ideally like to reduce the new-scheme-security to the old-scheme-security.
the ...
- 15
1
vote
1
answer
107
views
When attacking keyed algorithms, how is it known when the output is correct?
I've been reading a little bit about cryptanalysis, and I'm wondering how attacking algorithms that work on keys is performed.
It's obvious how algorithms like MD5 are attacked, in pseudocode:
...
- 13
1
vote
1
answer
373
views
Cracking RSA with small plaintext
I read a CTF writeup about cracking 4 primes RSA numbers from here:
Given $p, q, r,$ and $p+q+r$ are prime numbers.
The challenge encrypts the flag with a modulus $N=(p∗q∗r)∗(p+q+r)$
and gives the ...
- 113
18
votes
0
answers
481
views
The aftermath and considerations of the new record of 30750-Bit Binary Field Discrete Logarithm - 2020
Granger et al. recently published a paper about breaking a record for discrete logarithm on the Binary field
Computation of a 30 750-Bit Binary Field Discrete Logarithm, Robert Granger and Thorsten ...
- 47.5k
6
votes
1
answer
536
views
What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI
What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI (Crypt32.dll)
Could someone provide details?
- 47.5k
0
votes
0
answers
326
views
Understanding birthday attacks on 256 bit hashing and 512 bit hashing [duplicate]
Does it make a difference against birthday attacks if the algorithm that I am using is 512 bit hashing?
6
votes
1
answer
980
views
Iterations of pollards kangaroo attack on elliptic curves
I want to understand the Pollard kangaroo attack on elliptic curves. I found this Pollard's kangaroo attack on Elliptic Curve Groups Q/A pretty helpful, but not complete. The posts provides a pretty ...
- 2,120
2
votes
0
answers
696
views
MOV-attack on ecc: Time complexity and example
There already is this pretty big post about the MOV-attack. It states, that the discrete logarithm problem on elliptic curves can be transformed to a discrete logarithm problem over a finite field. ...
- 2,120
3
votes
0
answers
220
views
Pollard Rho Optimization
One of the most important attacks on Elliptic Curve cryptography is Pollard's Rho method. The effect on security can be seen on SafeCurves.
This attack is pretty old and there has been a bunch of ...
- 2,120
3
votes
0
answers
646
views
Curve25519 Attacks and Security
Curve25519 is a pretty secure way to exchange a key. In the original Paper and on SafeCurves a lot of attacks and security aspects are mentioned:
Attacks:
Brute force: This one is theoretically ...
- 2,120
2
votes
1
answer
2k
views
Pohlig Hellman and small subgroup attacks
While studying Curve25519 I read about the small subgroup attack in chapter 3. So far i know, that you need a point with a small subgroup to do such an attack. Curve25519 has a basepoint with prime ...
- 2,120
0
votes
1
answer
187
views
Proof by reduction for for digital signature scheme $S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$
Let $(Gen,S,V)$ be a secure signature scheme (existentially unforgeable under a chosen message attack) with message space${\{0,1\}}^n$. Generate two signing/verification key ...
- 41
1
vote
2
answers
655
views
Adversary for attack on one variant of ElGamal
I came by the following question:
Consider the following variant of ElGamal encryption. Let $p= 2q+ 1$,
let $G$ be the group of squares modulo $p$ so $G$ is a subgroup of
$Z_p^*$ of order $q$, and ...
- 41