# Questions tagged [attack]

A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.

435 questions
Filter by
Sorted by
Tagged with
1k views

### Fault encryption attack on RSA [duplicate]

How to recover plaintext, if we know public key(RSA), correctly encrypted text and text encrypted with faulty public key, where one bit is changed?
3k views

### When is a cipher considered broken?

We've all read how some people claim AES is broken because there was supposedly a way to get the plain text from a cipher text faster than brute-force. But is this the definition? Is a cipher broken ...
• 956
301 views

### AES as Integer Program

I read that AES can be broken by solving a Linear Integer Program (IP). From a given encrypted text, how can one construct this IP? How big is the system?
• 143
144 views

### What aspect of elliptic curve encryption paradigms makes them especially susceptible to quantum based attack algorithms?

This was a statement made during a talk at today's DFN-CERT conference but unfortunately it wasn't explained further. Can anyone shed light on why elliptic curves are susceptible to quantum based ...
• 121
193 views

### Attacking multi block MAC constructions

For variable-length messages, there are three different ways to generate the tags. $Tag = MAC_k(\Sigma_i m_i)$. $t_i = MAC_k(m_i)$ and $Tag = (t_1, ..., t_l)$. $t_i = MAC_k(i||m_i)$ where $i$ is a ...
• 11
190 views

### RSA: How effective is this keypair-trash attack [duplicate]

A question that could very well be part of xkcd's "what if?": Let's say Monica made a piece of software that sends all RSA keypairs to a central database after they're not used anymore. Something ...
120 views

### Pollard's Rho - Restricting the random function to the exponents

Pollard's Rho is usually constructed using a function $f:G \rightarrow G$ which behaves 'random enough' in order to detect a collision with Floyd's cycle detection trick. It is easy enough to observe, ...
1 vote
82 views

### Can one deduce the symmetric key size used to encrypt a given a piece of ciphertext?

Assume an attacker captures a piece of ciphertext encrypted with a symmetric key. He knows all the details of the algorithm used to encrypt except for the size of the key used in this case. Can he ...
• 113
3k views

### SHA-1 collisions - what about practical attacks?

I understand the theoretical problem with hash collision but when it comes to practice, I get very confused. Suppose a attacker would like to forge a certificate (or any kind of structured piece of ...
230 views

### Timing Attack on OpenSSL by Brumley

I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003). In this paper on page 4, Brumley ...
• 31
522 views

### What, cryptographically speaking, is a "long message"?

I have read about long message attacks on some cryptographic hash functions. However, I don't quite understand what is being referred to as a "long message". Also, do long message attacks only apply ...
• 101
1k views

### What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?

This page on Twist security mentions a combined attack and a twist rho attack, applicable in particular to NIST P-224 curve with cost $2^{58.4}$ something, with no mention precise definition of ...
• 138k
3k views

### Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
• 6,894
6k views

• 2,826
1 vote
4k views

### Possible Digital Signature Hack?

I am starting to learn more about cryptography and I just read more about how asymmetric keys can make a digital certificate, and I would like if someone could explain me why the following case can't ...
• 113
137 views

### Implementation Attacks on Hashes

So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc. What implementation attacks are there against hashes or hashed based functions (...
• 189
2k views

### Is there a generic attack on encrypted CRC32 when used as a MAC?

I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break. The ...
1 vote
136 views

### Attacks on Full TripleDES [closed]

I have been reading about attacks and many of them work on specific rounds of TripleDES but not on full TripleDES. Is there any attack except brute force that works on full TripleDES? (theoretical)
• 597
231 views

I understand in theory how the common modulus attack works (as described here: how to use common modulus attack?) Though, I did not understand completely how it worked with a negative $s_i$. Since $... 4 votes 2 answers 444 views ### Basic attacks on McEliece; finding S and P Take a McEliece cryptosystem with public generator matrix$G' = S G P$where$G$is a generator of a secret code with known fast decoding (not necessarily a Goppa code over$\mathbb{F}_2$),$S$is ... • 328 1 vote 1 answer 2k views ### AES CBC MAC splicing attack I'm trying to implement AES CBC MAC splicing attack in Python, the idea is: given a message M, its tag Tm (MAC(M) = T), a new message N and its tag Tn we build a message such as: M||N = (M1, ..., Mn, ... 5 votes 1 answer 747 views ### Are RSA or ECC vulnerable to an attack where the same (unknown) plaintext is encrypted with multiple public keys? I'm not sure what this attack model is called - it's not known-plaintext and also not quite cipher-text-only. It is similar to this question except the general case (not just two keys) and using keys ... • 223 4 votes 1 answer 5k views ### SHA-256 Partial Collision of initial 36 bits and more I was lucky enough to, by brute force, have found two different messages, whose SHA-256 hashes collide in the first 9 hexadecimal characters, which are 36 bits, let'... • 43 11 votes 1 answer 329 views ### What informal indicators exist for estimating the computational infeasibility of cryptographic problems? When assuming a block cipher primitive is secure, or a number theoretic problem is hard, this assumption is usually based on how far we are from breaking the primitive or solving the problem using ... • 10.4k 1 vote 1 answer 98 views ### Necessity of changing$p$and$q$when your private key is exposed? Suppose your private key$d_1$has been exposed. Instead of changing$p$and$q$, instead you just choose a new public and private key (say$e_2$and$d_2$) and use these instead. What kinds of ... 11 votes 1 answer 4k views ### Is MD5 second-preimage resistant when used only on FIXED length messages? I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient. I have read a lot about MD5 security for this ... • 343 17 votes 1 answer 19k views ### The difference between these 4 breaking Cipher techniques? I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ... • 445 6 votes 1 answer 177 views ### Has a Two Key TDES encryption ever been successfully attacked? Is there any known instance of a Two Key TDES ever being successfully attacked (in real life), when the key is used to encrypt less than$2^{20}$words? 12 votes 2 answers 3k views ### How can I implement the elliptic curve MOV attack myself? I understand and have implemented elliptic curve signatures in Python without the use of libraries like Sage, and would like to implement the MOV attack against certain weak types of elliptic curves. ... • 121 2 votes 1 answer 414 views ### Elliptic curve cryptography attack vector I would expect a complicated answer for what seems like a simple question about Elliptic curve cryptography. I've read several entries here such as "Elliptic curve cryptography related key attacks" ... 6 votes 1 answer 776 views ### Difference between actual attacks and theoretical attacks on SHA cryptographic series Could anyone tell me what the difference is between a theoretical attack (Like the one done on SHA-1) and an actual, practical attack (Like the one done on SHA-0)? Is a theoretical attack a proposed ... 11 votes 1 answer 2k views ### Relation between attack and attack model for signatures What is the relationship between an attack and an attack model? For example, let$\Pi$be the Lamport signature scheme. This signature has its security based on any one-way function. The Grover ... • 2,661 11 votes 2 answers 3k views ### In textbook RSA with low public exponent, how big does a random message needs to be? Assume RSA with a public modulus$N$of$n$bits, a small odd public exponent$e$, plaintext$M$a random non-negative integer less than$2^m$for some integer parameter$m$, with$M\mapsto C=M^e\bmod ...
• 138k
Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...