Questions tagged [attack]
A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.
435
questions
0
votes
0
answers
118
views
Which cryptographic attacks can AES 128-bit withstand?
Most of the articles and forums are stating that the Brute Force attack can test the strength of an encryption algorithm. However, I am looking for those attacks that AES can withstand for the testing ...
- 31
0
votes
1
answer
312
views
How to solve high exponent attack for same message in RSA
I know Håstad's broadcast attack when e = 3, but what if e = getPrime(randint(350))?
- 1
1
vote
1
answer
730
views
Attack against $\operatorname{DESA}_{k,k_1} (x) \underset{\text{def}}= \operatorname{DES}_k(x)⊕k_1$
Problem 5.16 in this pdf, from the book: Christof Paar, Jan Pelzl, Understanding Cryptography
5.16. This is your chance to break a cryptosystem. As we know by now, cryptography is a tricky business. ...
- 135
7
votes
1
answer
581
views
Why does the Bombe not consider the Ringstellung when determining stecker pairs?
I am doing research on the Bombe Machine, and I read that when the Bombe tries to find the stecker (plugboard) partners of letters, it only needs to use the rotor types and arrangement and also the "...
- 301
4
votes
1
answer
99
views
Why are the indicator drums of a Bombe machine labelled from A to Z clockwise?
I am researching the Bombe Machine, having just completed a project on the Enigma Machine. I visited The Rutherford Journal - The Turing Bombe, and it claimed that
The scales on the three ...
- 301
6
votes
1
answer
786
views
Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password?
A malicious actor wants to decrypt ciphertext that was encrypted with a password. He also possesses the hash (bcrypt/PBKDF2) of that password. Does he have any significant practical advantage in ...
- 63
0
votes
0
answers
99
views
Is Joux's multicollision attack applicable for truncated SHA256?
Joux presents an elegant way to generate k-way multi-collisions with about as much effort as generating a single collision: https://www.iacr.org/archive/crypto2004/31520306/multicollisions.pdf
...
- 11
3
votes
2
answers
1k
views
XOR cipher with fixed key and known relation among plaintexts
I have three messages, each known to be XOR-encoded, with the same key used for each message of this XOR cipher.
Encoded message 1: $e_1\,=\,00100111010$
Encoded message 2: $e_2\,=\,01001110110$
...
- 31
1
vote
2
answers
204
views
Inside attack (attack from participants) in secret sharing
I have considered a $(t,n)$ secret sharing scheme with $n$ secret, say $a1,a2....an$. It's third party secure, but it has inside adversaries. While reconstructing secrets, a group of $t$ qualified ...
- 11
1
vote
2
answers
425
views
Secret sharing scheme WITHOUT Shamir Secrete Sharing
I am planning to use the following XOR scheme to divide a secret into only 2 shares (I do not want to use Shamir Secret Sharing for different reasons that are beyond the scope of this post).
Here's ...
- 31
2
votes
1
answer
250
views
Can MFA codes be predicted if you know what their values were at a previous time?
I use an app on my phone that, after scanning a QR code on a website, gives me 6-digit codes which change every 30 seconds. These codes can be used for Multi-Factor Authentication (MFA) on some ...
- 123
0
votes
0
answers
160
views
Can someone explain the timing attack on RSA with Montgomery multiplication?
I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle.
I understood that there is a additional ...
4
votes
1
answer
279
views
Breaking ciphertext using a quantum computer when the public key is not available
As we know about Shor's algorithm on quantum computers it is possible to crack RSA / ECC easily if we have enough qubits.
Is it possible to crack RSA / ECC on a quantum computer if we only have ...
- 75
4
votes
1
answer
168
views
Find prime $p$ such that $a^x\equiv b\pmod p$ for many $x\in[1,p)$
Given haphazard large integers $a$ and $b$ (like few thousand bits), can we efficiently find (and how) some integer triplet $(p,x,k)$ with
$p$ a large prime (like a thousand bits)
$a^x\equiv b\pmod p$...
- 138k
1
vote
0
answers
40
views
is there an effective attack against rsa by knowing the coefficient $u$ of the private key? [duplicate]
consider that an attacker has the public key $(n, e)$, where $n$ is $1024$ bits long, the $32$ largest bits of $p$ (where $n = p \cdot q$), as well as $u = p^{-1} \pmod q$. Is there an attack that ...
- 11
3
votes
2
answers
351
views
Things already known to adversary before planning an attack
This is a very basic and practical question. Since I started reading cryptography recently, these things keep bugging me.
What are the things that an adversary is usually aware of before planning an ...
- 65
0
votes
0
answers
84
views
An insecure signature with message recovery, Dan Boneh
Someone can help me to resolve this questions from the book of Dan Boneh (University of Standford)
- 1
1
vote
0
answers
59
views
Can Trivium ciphertext be decrypted by an adversary if the key is known, but the IV is not?
Suppose that the adversary is able to recover the key of Trivium cipher. But the associated IV is unknown to him. Will he be able to decrypt the ciphertexts without any complexity?
- 73
1
vote
1
answer
304
views
RSA CTF Guidance
There's a great cryptography based ctf site that I've been going through. There's this one question around RSA that has been puzzling me for over a week now.
Please don't tell me the answer, I'm only ...
- 11
2
votes
1
answer
2k
views
Short padding + known prefix RSA attack
Suppose I have a message in the form of:
$m = \text{prefix} \mathbin\| \text{secret} \mathbin\| \text{padding}$
We have:
$e=3$
$n$
$n_\text{padding}$ (length of the random padding, <$1/4$ of $m$)...
- 421
0
votes
1
answer
312
views
AES 5-round Square attack, how to choose plaintexts?
I know that we need to generate a delta-set (with 256 plaintexts).
During the attack, we guess 4 bytes of round 5 key and 1 bytes of round 4 key, which allows us the byte at one position of the state ...
- 103
3
votes
0
answers
521
views
RSA calculate $d$ using Chinese Remainder Theorem with $d_p$, $d_q$ and $e$
Suppose for a RSA system I have the following variables given:
modulus $n$, expononent $e$, $d_p$ and $d_q$Where, $d_p = d\bmod(p-1)$ and $d_q = d\bmod(q-1)$,
Is it possible to find the private ...
0
votes
1
answer
179
views
KRACK - Is all-zero key installed by the acces point?
I don't really understand (and I think it's not described in the official paper) how the encryption can work when the encryption key is set to 0 by a KRACK attack on a device using wpa_supplicant 2.4 ...
- 3
1
vote
1
answer
240
views
Key at start or end of HMAC
In the book Information Security Principles and Practice, the author explains why HMAC should be used for integrity with a symmetric key with the message, to prevent a MiTM to replace both the message ...
- 11
4
votes
1
answer
293
views
If I allow arbitrary initial hash values for SHA-256, what would be the weaknesses?
The initial hash values (IV) of SHA256 are fixed. However, let's say I modify the SHA256 hash function to allow the attacker to use arbitrary IVs rather than fixed IVs. What kind of weaknesses would ...
- 153
0
votes
2
answers
103
views
How is asymmetric cryptography safe if one of the keys is public?
Let's suppose $A$ is sending a message $m$ to $B$ using asymmetric cryptography.
To guarantee the authenticity of a message, $A$ encrypts $m$ with $A$'s private key: $E(m, k_A) = m_A$.
Then, $A$ ...
- 447
1
vote
1
answer
162
views
averaging attack at Google's RAPPOR
I am reading the paper - "RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response".
I don't understand how the averaging attack works.
I searched for "average attack" but couldn't find a ...
- 47
2
votes
2
answers
142
views
Is there a term for cryptographic attacks where you can verify decryption without assuming any known structure on the plaintext?
The questions https://security.stackexchange.com/questions/1696/if-someone-breaks-encryption-how-do-they-know-theyre-successful and https://security.stackexchange.com/questions/119887/how-to-know-if-a-...
- 163
1
vote
0
answers
170
views
Primal and dual attack against NTRU
I am looking at the primal attack against schemes in the second round of the NIST Post-Quantum Standardization Project. The cost of primal attack usually comes from an estimate described in NewHope ...
- 167
0
votes
0
answers
222
views
Another cut-and-paste attack on CBC mode
I am trying to see specific cases of attacks in the CBC mode, in particular, I am investigating some attacks such as Example of a cut-and-paste attack on CBC. Here I have posted something similar and ...
- 131
2
votes
1
answer
145
views
How can an adversary use Mac(.) with a new key to compute a tag although this is not a query to Mac oracle?
I am having some troubles understanding the power of an adversary in attack against a MAC.
In chapter 4 in Introduction of Modern Cryptography by Jonathan Katz and Yehuda Lindell, specifically in the ...
- 33
1
vote
0
answers
607
views
How to find/determine the Polybius Square Key and Additive Key, if only the Cipher Text is known, in Nihilist Cipher?
I was solving a Crypto Challenge in a CTF, and I got a Nihilist Cipher Encoded String. Luckily the additive key was given as a hint, and for the polybius Square key, I kinda bruteforced or I just got ...
- 31
3
votes
3
answers
3k
views
Example of a cut-and-paste attack on CBC
I am reading the cryptography book by Stamp and there is a cut-and-paste attack on $ECB$ and this is easy to follow because $ECB$ is relatively simple, the problem is that I would like to see an ...
- 131
1
vote
1
answer
477
views
Is it possible to perfom quadratic residues attack on elgamal cryptosystem?
I understand how this attack work on mental poker, but i am unable to see how can i apply it in Elgamal.
- 13
1
vote
0
answers
50
views
How large a product out of 3 close-by factors need to be to avoid factorization?
For encryption a prime $P = 2 \cdot Q \cdot R \cdot S +1$ was used.
An adversary want to solve the discrete log problem $m \equiv g^i \bmod P$. For this he want to use the Pholig-Hellmann algorithm.
...
- 573
1
vote
1
answer
213
views
Given generator $g$ with prime order $k$ in $\bmod P$. Does increasing $P = 2 \cdot c \cdot k +1$ decrease security? Increasing $g$ increase security?
An adversary wants to find $a$ in
$$m \equiv g^a \bmod P$$
He knows prime $P = 2 \cdot c \cdot k +1$ with it's primes $c,k$, value $m$ and $g$. And he also knows that $g$ only has an order of $k$, ...
- 573
1
vote
1
answer
117
views
Attack on envelop mac
As I am reading the Paper: MDx-MAC and building fast MACs from hash
functions
I am having trouble understanding the Attack on the Envelope Method (4.3). In particular, I am not sure what chaining ...
- 113
4
votes
2
answers
2k
views
Is direct RSA encryption of AES keys secure?
I am wondering: If we take this scheme/procedure and each of it seems very secure (to me at least), is it truly secure or is there a vulnerability hidden in the process?
This is the scheme:
Bob has ...
- 87
1
vote
0
answers
83
views
attacks and defenses on multi party Diffie-Hellman protocol
I tried to create a 4 partied Diffie-Hellman implementation for 4 people using its cyclic group property.
However, I am not sure regarding those 2 issues, and would appreciate if you could elaborate ...
- 11
4
votes
1
answer
544
views
Is double encryption really a bad idea? Are meet-in-the-middle attacks practical at all?
Meet-in-the-middle attacks are used to justify that attacks on ECC and double encryption will have complexity of $O(\sqrt{n})$ for ECC and $O(2^{n+1})$ for double encryption complexity instead of $O(n)...
2
votes
1
answer
48
views
Security implications of not concatenating a 1 to the IV when using GCM
When using GCM, The padding string $0^{31}||1$ is appended to the IV. I know that this is done to avoid the repetition of $E_K(0^n)$ which is used as key for the GHash. But what would be the security ...
- 35
1
vote
0
answers
58
views
Why is this attack complexity equal that exact number of bit operations?
in the this paper,section 3,autors attack hamsi-256. Im trying to make a parametrized version, so i need to understand how do they estimate the complexity of attack in bit operations,that reads as ...
- 55
9
votes
2
answers
3k
views
What is a multi-target attack?
What exactly is a multi-target attack? How does the attack work on different cryptographic schemes (block ciphers, hash functions, elliptic curves)? How can it be avoided?
- 6,404
4
votes
1
answer
268
views
Any speed up methods for finding the index of a random value produced by the Inversive congruential generator?
The Inversive congruential generator produces random values with:
$$x_{n+1} = a\cdot x_{n}^{-1} + b \mod P$$
(special case if $x_n=0$ -> $x_{n+1}=b$)
starting with an initial value $x_0$
With well ...
- 573
1
vote
0
answers
56
views
Is the 51% attack the only technical reason no country will ever adopt Bitcoin as a state currency? [closed]
Is the 51% attack the only technical reason no country will adopt Bitcoin as a state currency?
Let's suppose a country with a GDP size less than 300 Billion USD adopt the Bitcoin as an official ...
- 111
3
votes
1
answer
176
views
Attacking any one in many public keys
The problem of finding private key from public key is typically studied in the one-key setup: what's the expected cost of breaking one key (e.g. by factoring a public modulus, or solving a discrete ...
- 138k
1
vote
0
answers
98
views
What if an AES Whitebox 1024-bit (or larger key) is created? Does it increase complexity consistently?
Following the Chow et al paper and Muir's tutorial, I was able to implement the AES algorithm using tables embedding keys of 128, 192 and 256-bit sizes, later extended to 1024, 2048 and 4096-bit sizes....
3
votes
1
answer
249
views
Why is the Domingo-Ferrer cryptosystem not used in practice?
The Domingo-Ferrer cryptosystem is a fully homomorphic cryptosystem. It works fast enough. I have only seen known-plaintext attacks. Is this a reason not to use it in practice? Or are there more ...
- 33
1
vote
1
answer
291
views
Attacking Double DES (OFB Mode) given the initialization vector and not much else? [closed]
I'm given a Plaintext/Ciphertext pair, a Ciphertext to break, and the IV. One thing of note is that the same IV is used for both DES Encryptions, so $$C = E_{K_2}(E_{K_1}(P, IV), IV)$$ I have limited ...
- 41
2
votes
0
answers
88
views
Complexity of AES key reconstruction from state 1 output and plaintext
Assuming that I am able to read the plaintext as well as the output of round 1 of an AES-128 encryption: Is it possible (if yes: how?) to obtain the RoundKey with a lower complexity than brute-force ...
- 121