Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

Filter by
Sorted by
Tagged with
1
vote
1answer
1k views

how does a time-memory trade off attack work?

I'm a student who learning cryptography, refer to this book "Applied Cryptanalysis - Breaking Ciphers in the Real World" (page 133). It helped me know about time-...
1
vote
1answer
170 views

What's the name of this cipher? And how can it be broken?

Assuming that: SHA-256 and SHA-512 are random and irreversible the output appended to some random and long enough secret is just as random as any other data and will produce values that are just as ...
5
votes
1answer
863 views

Generate 64 bit HMAC

Given $plaintext$ and its respective authentication $tag$ which is generated from HMAC-MD5 so that $|tag| = 128$ bits. If the application is constrained and can send only $64$ bits. Is it ok, if we ...
1
vote
1answer
559 views

Is it safe to send HMAC and plaintext in the same message?

If a certain protocol sends $plaintext$ and its corresponding HMAC then is such a protocol prone to key extraction attacks ? Intuitively , HMAC is $ciphertext$ generated from $plaintext$, (although ...
13
votes
1answer
2k views

Cracking a PRNG by observing ranks within groups of its output

Suppose that I am generating random numbers with Python's random module, so that there is a known random number generator (Mersenne Twister in this case). I've ...
4
votes
2answers
1k views

Key recovery when AES ECB is used for short but repeated messages

My question is based on the specification of the protocol LoRaWAN and especially on the part 6.2.5 Join-accept message. It is said that the join-accept message is encrypted using AES ECB. This is (...
2
votes
1answer
49 views

Attacks from releasing decrypted CCM payload before verifying tag

CCM specifies (Section 1.7) that no plaintext data should be released before the MAC is verified. Why is this recommendation given and what attacks are possible against CCM if data is treated like a ...
-4
votes
1answer
2k views

bruteforce on aes 256 cbc mode [closed]

i have a series of encrypted text , they encrypted by aes 256 bit cbc mode for every encrypted text there is an iv that i have them also and i know its algorithm is aes 256 bit cbc mode i can ...
0
votes
0answers
106 views

Why can't current quantum computers break RSA? [duplicate]

We have quantum computers and we also have Shor's algorithm. So: Why isn't RSA cracked yet? What are the current quantum computers lacking?
25
votes
6answers
4k views

Did a certain cryptography method get abandoned due to security flaws in the past?

I am researching how quantum computers affect current encryption methods (RSA and more). However, I remember learning in a course that there used to be a particular encryption method which was ...
1
vote
1answer
3k views

ECDSA non random k - Retrieve private key [closed]

At the moment I'm playing around with ECDSA. I know that I can retrieve the private key if the same K is used to sign two messages. I tried to use this script: Ruby Script to crack the private key. ...
5
votes
1answer
576 views

ECDSA key recovery - floating point values

I'm currently attempting to recover an ECDSA key. I have $m$, $m'$ and signatures $(r, s)$, $(r', s')$, and I know that $k$ is constant, the curve is NIST P-192 and the hash function of the. As such,...
1
vote
0answers
188 views

How to generate an El Gamal signature without knowing the private key x?

Let $x$ be the private key. Let $k$ be a random generated number $< p-1$, with $p$ the large prime. Let $g$ be the generator of $p$ the large prime. Let $r$ be the equality $r=g^k$ Let $m_e$ be an ...
0
votes
1answer
167 views

Digital signature with collision

Let's assume a digital signature scheme such that there's a probability of 0.2 for two random messages to have the same signature. How can I exploit this sheme? I'm having difficulties in finding an ...
4
votes
2answers
1k views

Security of the shared secret key for a smart meter (Linky)

Reading the specs of a new electricity smart meter (called Linky in France), I was surprised about the chosen encryption method (128 bits symmetric key AES), based on a single secret key (called CCC ...
2
votes
1answer
892 views

AES 128 bits with 12 bytes IV vector composed of a 4 bytes counter : safe?

I have a 128 bits AES cypher (GCM, Galois/Counter Mode) using a 12-byte initialization vector (IV) composed of: 8 constant bytes: 6 bytes (device ID) 2 bytes (zero) 4 bytes (incrementing frame ...
0
votes
1answer
36 views

DROWN - decrypting ServerVerify message is not enough?

I have read this article, but I can't understand why after decrypting ServerVerify, the client needs to send the export grade PMS again... When exploiting these flaws the attacker will send its ...
0
votes
1answer
238 views

DROWN Attack - Which is the SSLv2 vulnerability exploited?

In order to get the session key used in TLS communication, an attacker must capture X TLS handshakes based on RSA key encryption, and switch to a server supporting SSLv2 protocol, and sharing the same ...
2
votes
1answer
4k views

Triple DES with 2 keys

Suppose triple DES is performed by choosing two keys $K_1$ and $K_2$ and computing $C = T (T (T (L, K_1), K_2), K_2)$. How to attack this modified version with a meet-in-the-middle attack, in which ...
1
vote
1answer
601 views

Is double AES-CBC encryption with the same key and IV unsafe?

If some plaintext encrypted twice with the same AES function (CBC-mode), same IV and same key, is it possible to retrieve either the key or the plaintext?
9
votes
1answer
2k views

Algorithm for Boneh and Durfee attack on RSA

I am trying to understand various attacks on RSA and I believe that they only way to fully understand the algorithm is to implement it. I am trying to implement the code in this paper (pdf) (Private ...
3
votes
1answer
244 views

Attacks on schemes based on elliptic curves when the transmitted points are not on the curve

Some elliptic curve schemes require to send a curve point during the normal execution of the protocol. For example, ElGamal encryption and ElGamal signature require this. On the other hand, ECDSA does ...
3
votes
1answer
155 views

Known Plaintext Attack against 3-round SPECK48/96

I am attempting to break 3-round SPECK48/96 using a known-plaintext attack, provided with 10 PT-CT pairs. Here is a diagram: I have seemed to almost figure this out, but I cannot figure out how the ...
0
votes
2answers
167 views

What is the strength and attack vectors of this simple scheme?

Let's say that Alice wants to communicate some secret value $S$ to Bob through a public channel in a way that other people don't know what the value was. To do this, Alice publishes that secret value ...
5
votes
1answer
155 views

Could a strong round function be immune to slide attacks

An excerpt from the wikipedia article on slide attacks states: ...The only requirements for a slide attack to work on a cipher is that it can be broken down into multiple rounds of an identical F ...
2
votes
1answer
654 views

Reversing a hash of known hashing algorithm

I am sure this is a very easy thing to do but I am not sure how to go about solving a problem like this, So there is this hash function which operates on a message which is in the form of a byte array ...
3
votes
1answer
208 views

Anonymity problem after voting with blind signatures

In a distributed voting system (all the messages are public, but signed and maybe encrypted/blinded), having: $d$, $e$, $N$ — registrar key params $m$ — msg $r$ — random blinding factor $m'$ — ...
8
votes
2answers
453 views

Which attacks are possible against raw/textbook NTRU encryption?

In the same fashion that these questions about attacks to textbook RSA and ECC, I was wondering what are the immediate drawbacks of applying NTRU Encryption directly, without any padding scheme, such ...
1
vote
1answer
12k views

Many time pad attack (XOR) [duplicate]

The question is quite similar to Many time pad attack and I was trying to rely on the top answer, but still am a bit confused, so any explanation and help will be much appreciated. Assume I have a ...
0
votes
1answer
632 views

Collusion Attack CP-ABE

Suppose that there are Alice with attributes $A$ and $C$ and Bob with attributes $B$ and $D$. I have a ciphertext with this policy: $A\ \operatorname{AND}\ B$. Why don't users collude ? If Alice ...
0
votes
1answer
1k views

Decrypting messages crypted with one time pad (used more than once)

I have a stream cipher with a key (that is unknown to me) that is used more than once. Messages are ciphered in this way: ciphered_message = message XOR key Let'...
1
vote
1answer
181 views

Attacks on MICKEY 2.0 Stream Cipher

I would like to know if there are any known attacks, besides from side-channel attacks (differential fault attack, correlation power analysis, template attack), against MICKEY 2.0 or MICKEY-128 2.0. ...
2
votes
1answer
596 views

RSA private key finding method

Bob uses RSA with $p=83$ and $q=103$. His public key is $e=445$. Alice claims that she can calculate Bob's private key without using the definition $d=e^{−1}\bmod φ(n)$? But how?
4
votes
3answers
100 views

What are possible caveats when generating a group for use as parameters for Diffie-Hellman key exchange?

As reusing a widely used group for Diffie-Hellman key exchanges might lead to far easier third-party key discovery through precomputation for that specific group, I would like to know what can ...
3
votes
1answer
337 views

Best attack on double DES followed by XOR with third key

What is the best attack here? $E_k(m)=DES_{k1}(DES_{k2}(m)) \oplus k3$
4
votes
1answer
1k views

How does the Flickr length extension attack work?

I am currently reading about the length extension attack on Flickr (pdf) but not understanding what's going on there. ...
1
vote
1answer
136 views

Cycling hashing in PBKDF's and their limitations in strength?

I hope this question isn't too similar to one that's already been asked. I also want to point out I know part the answer already, AFAIK: I just want some expert input on this. Let's model a hash that ...
3
votes
1answer
381 views

Practical attack on an impractical implementation of Rijndael (AES?)

My understanding of the cryptanalysis of AES, is based on what I've read on Wikipedia and my intuition, I have nothing but self-taught education on the subject. So I want you to imagine: I have only ...
7
votes
5answers
2k views

Does frequent key change weaken encryption?

Following scenario: We are using OTR for communication between Alice and Bob which means after each successfull message exchange a re-keying happens for both parties leading to new AES-keys for the ...
4
votes
2answers
595 views

Do we have anyway of knowing if avoiding self-permutation in RC4 makes it any stronger?

OK, so lots of questions get asked about RC4 but I want to make mine specific and hopefully answerable. RC4 Design as I'm sure anyone reading this knows, uses self permutation in stage 1 of the KSA. ...
0
votes
1answer
6k views

RSA Attack, known public key and ciphertext. Can decrypt the message m?

I'm stuck with this problem: Assume Alice and Bob are using RSA to communicate each other. Given Bob's public key $(217,7)$, Alice send the ciphertext $c=53$ to Bob through RSA encryption. Now, Eve ...
2
votes
0answers
187 views

Cost of attack on DSA with attack on DLP

Are there any (recent) estimates of cost of attack on DSA by solving the discrete logarithm? I'm especially interested in attacks that use Pollard's rho algorithm. Are there any optimized ...
2
votes
1answer
849 views

Attack on textbook RSA with small messages

We learned in class that if Alice wants to send a small message $m$, such that $m < N^{\frac{1}{e}}$, so we can break the system using $e$-th square of $m^e$. But what if Alice knows this flaw and ...
1
vote
1answer
103 views

What happens when domain parameter $q$ in DSA is not prime number

Suppose that attacker creates domain parameters $(p,q,g)$ where $q$ is not prime number (but $q$ still divides $p-1$) and that signer generates new key pair using these domain parameters. How exactly ...
9
votes
1answer
487 views

Are there any long term RC4 bias based exploits?

The RC4 cipher possibly exhibits low level bias in it's long run PRNG keystream. I'm specifically excluding short term bias attacks which I'm defining as outputs < 1024 bytes. Are there any real ...
5
votes
1answer
1k views

How long does it take to decrypt an RSA/ECB encrypted message?

I am working on assignment where I have specific scenarios and I am little bit struggling with this one. Alice sends and email to Bob.For this e-mail, she uses the following method of encryption: ...
3
votes
3answers
794 views

One Time Pads and reuse of the decrypted message?

How is it insecure when Alice encrypts a message with a One-Time-Pad to Bob, and Bob then uses the decrypted message from Alice as the next One-Time-Pad? For example: Alice sends Bob a message ...
4
votes
1answer
632 views

RSA 1024 bit forge a new matching signature from a chosen message

I have an RSA signature scheme with 1024-bit key where I know the following: Public modulus $N$ Public exponent $e=3$ A lot of signatures Summary: To compute a signature, an MD5 hash is calculated ...
1
vote
0answers
57 views

ephemeral-ephemeral ECDH and MITM attack [duplicate]

ephemeral-ephemeral ECDH is it susceptible to MITM attack ? if yes, can you please give me a detailed answer ( Workflow that can be followed by the attacker) and how we can prevent this attack (static-...
2
votes
1answer
2k views

Shared modulus attack on RSA

Consider a scenario in which a group of people use a common modulus $n$ in the textbook RSA crypto system, where $n=pq$, $p$ and $q$ are large distinct prime numbers. Is there any chance for an ...

1
3 4
5
6 7