Questions tagged [attack]
A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.
435
questions
1
vote
0
answers
270
views
How to solve a simple case of a RLWE problem
I've been reading up on the Ring Learning with Errors problem and the proposed attacks, in relation to homomorphic encryption. Some of the literature has been quite difficult to understand - what I ...
- 11
3
votes
1
answer
177
views
Does knowing that the exponent is in a certain range help solving discrete log?
given:
$c=g^i \bmod P$
$g$ generator for group with group size $\varphi(P)$
$g,P,\varphi(P)$,c is known by the attacker
He wants to know $i$.
Now the attacker also knows $j,k$ with $j<i<k$
$k-j$...
- 573
-1
votes
1
answer
742
views
How do discrete logarithm with modulo a prime and a non-prime compare?
Let
$c_N = g^i \mod N$ and $N=p \cdot q$
and
$c_P = f^j \mod P$ and $P$ a prime
We assume $N,P$ has the same bit-length. $P$ is the best type of prime you can choose (e.g. safe prime). $N$ is a ...
- 573
1
vote
0
answers
51
views
Why, in general, are proofs of possession (POPs) "clearly" not sufficient for substantiating the knowledge of secret key (KOSK) assumption?
In Ristenpart, Yilek - The Power of Proofs-of-Possession: Securing Multiparty Signatures against Rogue-Key Attacks they have the statement:
In general, such proofs of possession (POPs) are clearly ...
- 165
0
votes
2
answers
161
views
The opponent possesses a string of ciphertext and has access to the encryption machinery as black box. What is the name of this attack?
a quick example:
The encryption function:
y = E(x) = (13x + 9)(mod 27), when the letters A–Z are taken to be the numbers 0–25 and the Space (punctuation) is the number 26.
The opponent has the ...
- 1
1
vote
1
answer
64
views
Randomization attack in voting protocols
I'm looking into coercion-resistant voting schemes and one of the key elements of coercion-resistance is resistance to randomization attacks.
Juels et al. define a randomization attack as one where ...
- 629
2
votes
1
answer
127
views
How "Resending Message Attack" works?
In the second chapter of Bruce Schneier's book Applied Cryptography, 2nd Edition, 1996, we find this in section 2.7.1 Resending the Message as a Receipt:
...
- 23
1
vote
1
answer
473
views
Cipher Block Chaining - How do you change the plaintext of all blocks?
I've just read about CBC encryption and decryption and was wondering how you can change every plaintext block?
Let's say you have an initialization vector, 3 ciphertext blocks, know each block-cipher-...
- 113
1
vote
1
answer
827
views
How does the CBC Padding Oracle Attack work in General?
Right now we don't have a single generalized question asking how the CBC padding oracle attack works. We have e.g. this one and this one but the former is distracted by the concrete values being ...
- 45.7k
1
vote
1
answer
259
views
Probabilistic padding to avoid Håstad’s Broadcast Attack
Can someone explain why probabilistic padding like OAEP is particularly useful for avoiding Håstad’s Broadcast Attack? I don't really get the reason why.
- 11
7
votes
1
answer
405
views
How safe is a prime with $P=2 \cdot Q \cdot R \cdot S \cdot t+1$ for discrete logarithm? How to enhance/compare?
To get some certain properties for my use case I need a prime $P$ which has the form:
$P=2\cdot Q \cdot R \cdot S \cdot t+1$
with $Q,R,S,t$ primes as well.
Why that form - Use case
Together with ...
- 573
1
vote
1
answer
83
views
Does a different exponent and base but same key help to resolve discrete logarithm?
E.g.:
$k = N^a \mod P$
The attacker knows the prime $P$ and $N$, which is also a prime and
(1.) prime root of $P$ or
(2.) has a cycle size of $s$, so $1 = N^s \mod P$, (and for $\forall s'<s$, $...
- 573
0
votes
0
answers
75
views
Unique numbers with $P^aQ^bR^c \mod N$ for each combination of $a,b,c$ possible? Would it be safer than separate form (like $T^a \mod P$ for each)?
Main question: Is the computation of $a,b,c$ in $P^aQ^bR^c \mod N$ (much) harder than in $T_p^a \mod P$, $T_q^b \mod Q$, $T_r^c \mod R$ ?
(assuming the first form exists)
$P^aQ^bR^c \mod N$
With $P^...
- 573
0
votes
1
answer
52
views
How much more secure is $c = mg_1^r + g_2(g_1(g_1^r-1)/(g_1-1)) \mod p$ compared to just $c = mg_1^r \mod p$ (dis. log), all known but $r$?
To encode a message $m$ to a cipher $c$ you can use the only hard solvable problem of computing the discrete logarithm with a generator $g$ in base over a prime $p$.
$c = mg_1^r$ mod p
If an ...
- 573
0
votes
1
answer
875
views
Example of product cipher more secure than its components
Can anyone give me an example of a product cipher which more secure than its components.
Here is how the explanation should proceed.
There is cipher C1 which can be attacked with the technique A1, ...
- 334
1
vote
1
answer
490
views
How you find the unpadded short plaintext using RSA?
I am currently trying to understand how you find the unpadded short plaintext when you are using RSA. Please help with explaining the process and so I can understand this topic more.
- 11
1
vote
0
answers
4k
views
RSA encryption extremely large public exponent
I'm trying to do learn a bit about RSA by doing CTF's and now I am doing one problem probably more than 7 hours so I would really appreciate a hint here from an expert.
I have an encrypted message $c$...
- 111
1
vote
0
answers
262
views
Weak/Vulnerable AES Implementations [closed]
I'm trying to complete a cryptography CTF challenge in which I have a cipher I'm supposed to attain the original plaintext from. I have reason to believe it's been encrypted using AES, but I'm unaware ...
- 163
0
votes
0
answers
238
views
Prove that a given signature scheme is secure under random message attacks
This is a follow up to my previous question.
Consider the following signature scheme:
$\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $e : ...
- 617
0
votes
0
answers
199
views
Prove that a signature scheme is RUF-NMA and not EUF-CMA
I am working on the following exercise:
Now, assume the following signature scheme:
$\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $e : G ...
- 617
0
votes
1
answer
83
views
LWE: does using only a small subspace of the plaintext space influence the security of the encryption scheme?
Regarding LWE schemes where the encryption is performed this way:
for $m \in \mathbb{Z}_t$, compute $c = LWE_{\mathbf{s}}^{t/q}(m) = \{ \mathbf{a}, \mathbf{a \cdot s} + m\cdot q/t + e\} \in \mathbb{Z}...
- 408
1
vote
1
answer
329
views
Is chosen ciphertext attack used to obtain a key? [duplicate]
I don't understand what the goals are of a Chosen Ciphertext Attack.
What I've read from Wikipedia is that it is an attack one can use to obtain the key that the crypto algorithm uses.
However, I ...
- 111
0
votes
2
answers
3k
views
Can Shamir’s Trick crack the cryptographic strength of ECDSA?
Recently stumbled upon a discussion in the forum
What is Shamir’s Trick used for?
Are there any such examples?
0
votes
1
answer
315
views
Caculating Correlation for CPA attack on AES
I am having some trouble understanding how to calculate the correlation coefficient for CPA attack on AES.
In the article Study of Deep Learning Techniques for Side-Channel Analysis and Introduction ...
7
votes
2
answers
2k
views
Is there a feasible preimage attack for any hash function (no matter how deprecated) today?
Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack?
All hashes that are nowadays considered 'broken' (...
- 1,397
1
vote
0
answers
621
views
show that G' is not a secure PRG even if G is
Hello I'm trying to show that the function G'(s) = G(s) || G(G(s)) is not a secure PRG even if G is.
My first question is that in this case, how do I know what G ...
- 111
8
votes
1
answer
213
views
How complex must round constants be to resist slide attacks?
A key schedule that generates round keys by XORing a round constant with the key is linear and can be vulnerable to related key attacks, but let's ignore that for now. Constants are necessary to avoid ...
- 15.1k
0
votes
1
answer
64
views
Associative Multivariate Permutation
Popular multivariate schemes are constructed by having a several easy-to-invert functions/maps as parivate key, and their composition as the public key.
When signing, the hash, or a padded form of ...
- 9,001
1
vote
0
answers
408
views
Need tips on how to break Fiat-Shamir sigma-protocol (programming challenge)
I'm completely stuck on an university programming challenge and I need some tips to get me out of the valley I'm in, you don't need to give the full answer if you do not wish to.
What we have:
Fiat ...
- 23
2
votes
1
answer
2k
views
One-round feistel network (DES) attack
I can't find out how to break 1 round of feistel network (obtaining the key).
I understand why this equation takes place:
$R_1 \oplus L_0 = f(R_0, k_1)$
EDIT: The function f looks like this:
But ...
- 123
2
votes
1
answer
705
views
Interlock Protocol for Preventing Man-in-the-Middle (MitM) Attack
Trying to turn bookish knowledge to practical:
Alice sends half of the encrypted data to eve, eve eavesdrop and tries to decrypt the data and fails as eve has only half of the encrypted block. So, ...
- 247
4
votes
1
answer
1k
views
Why is Diffie-Hellman Insecure If Order of the Generator Has Only Small Prime Factors?
In this post from security SE, Tom Leek mentioned that, for Diffie-Hellman to be secure order of the group $g$ should have a prime factor at least $2k$ bits long, where $k$ is the security parameter.
...
- 1,384
2
votes
0
answers
144
views
Non-exact substitution cyphers
Picture a simple substitution cypher of text with length $N$(spaces optional):
Plain : ATTACK AT DAWN
Encrypted: ELLETI EL HEPG
Another way to represent the encrypted text is with an $N \times N$ ...
- 129
1
vote
1
answer
181
views
To find nonlinear invariant of S box
I read a paper about a nonlinear invariant attack that is Y.Todo et. al's "Nonlinear Invariant Attack: Practical Attack on Full SCREAM, iSCREAM, and Midori64"
In this paper's Appendix A., they said ...
- 129
1
vote
1
answer
1k
views
Determine RSA modulus from encryption oracle
Suppose we have an RSA encryption oracle $E(m)$ which basically just calculates $m^e \mod n$ for a given message $m$. Here $e=65537$ is known but $n$ is not. Can we determine the value of $n$ without ...
- 133
1
vote
1
answer
8k
views
Hash Collision Probabilities
Please give help! how can I calculate the probability of collision? I need a mathematical equation for my studying.
Assume, I am using SHA256 to hash 100-bits. Thus:
SHA256 {100} = 256-bits (hash ...
- 95
2
votes
1
answer
2k
views
ECDSA with common nonce?
I'm new to cryptography, and I've searching about ECDSA because I'm trying to solve a CTF.
I've already check this site and Google, and I think I'm in the right path, but probably I am missing ...
- 123
9
votes
3
answers
16k
views
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.
Can I recover that key?
If, how big does the list of plaintext ...
- 201
2
votes
1
answer
661
views
Recovering plaintext from AES-128 given round key 10 and ciphertext
I'm working on an old CTF challenge where AES-128 was used on a 16 byte block. I have the round 10 key and the ciphertext. What techniques exist for obtaining the plaintext?
- 49
0
votes
1
answer
895
views
Are the Common modulus attack, Common Factor Attack, and Wiener's attack different?
Is there a difference between:
Common modulus attack
Common Factor attack
Wiener's attack
or are these just a different name for the same attack?
- 305
1
vote
1
answer
2k
views
Difference between eavesdropping and traffic analysis
I was wondering what is the conceptual difference between these two passive attacks on a network. I was reading about them on Wikipedia and they seem quite similar to me. Is there a difference?
2
votes
2
answers
4k
views
Fault attack on RSA-CRT
I am trying to understand fault attack on RSA-CRT, and I found some example, which I don't know how to solve it.
I know public modulus $N$, public exponent $e$, a value of faulty signature (where ...
- 121
2
votes
1
answer
3k
views
Attack on RSA when I know $e$, ciphertexts $c_1, c_2$ of the same message $m$ with 2 coprime modules?
I know that the same message $m$ was sent to two people resulting in ciphertexts $c_1, c_2$. The public keys are $n_1$ and $n_2$, $gcd(n_1, n_2) = 1$. And $e=3$ in both cases. How can I retrieve the ...
- 201
1
vote
2
answers
181
views
RSA: Should the generation of random data used for primes include zero
When generating random data that is later tested for primality, should the random data include the value 0x0?
I would have thought that primes that do not include zero's are a subset of the set of ...
1
vote
1
answer
485
views
Is forward search attack is the same as dictionary attack?
Currently, I started to learn about secure passwords in password file. The password file contains the hashed values for passwords. I know that the forward search attack for a password that if an ...
- 13
3
votes
1
answer
283
views
Can perfect forward secrecy introduce vulnerabilities?
Is it always a win or could PFS algorithms introduce new attack vectors or weaken the level of secrecy vs not being used?
- 131
4
votes
2
answers
530
views
What is the name of an attack where the compromise of one key compromises the whole system?
Consider the following: A whole system depends on the security of one private key and if this key is, for any reason, compromised, the whole system will be compromised.
What's a suitable name for ...
- 205
0
votes
1
answer
526
views
Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k
I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
2
votes
2
answers
560
views
How to prove that a rainbow table is complete?
Passwords that are hashed but not salted can be cracked using the rainbow table. I went through this and this which explains the logic behind rainbow table very well.
But I am missing something about ...
- 155
1
vote
1
answer
49
views
what can attackers do between two end hosts
I have one question that I couldn't come up with a nice solution.
So let's have this analogy, I have a box full of money and I want to deliver to this my friend. Here if we think of a potential ...
- 13