Questions tagged [attack]
A cryptographic attack tries to theoretically and/or practically attack the security properties of a cipher and/or algorithm.
435
questions
0
votes
1
answer
1k
views
Fault encryption attack on RSA [duplicate]
How to recover plaintext, if we know public key(RSA), correctly encrypted text and text encrypted with faulty public key, where one bit is changed?
- 235
3
votes
3
answers
3k
views
When is a cipher considered broken?
We've all read how some people claim AES is broken because there was supposedly a way to get the plain text from a cipher text faster than brute-force. But is this the definition?
Is a cipher broken ...
- 956
4
votes
1
answer
301
views
AES as Integer Program
I read that AES can be broken by solving a Linear Integer Program (IP).
From a given encrypted text, how can one construct this IP?
How big is the system?
- 143
2
votes
1
answer
144
views
What aspect of elliptic curve encryption paradigms makes them especially susceptible to quantum based attack algorithms?
This was a statement made during a talk at today's DFN-CERT conference but unfortunately it wasn't explained further. Can anyone shed light on why elliptic curves are susceptible to quantum based ...
- 121
-1
votes
1
answer
193
views
Attacking multi block MAC constructions
For variable-length messages, there are three different ways to generate the tags.
$Tag = MAC_k(\Sigma_i m_i)$.
$t_i = MAC_k(m_i)$ and $Tag = (t_1, ..., t_l)$.
$t_i = MAC_k(i||m_i)$ where $i$ is a ...
- 11
0
votes
1
answer
190
views
RSA: How effective is this keypair-trash attack [duplicate]
A question that could very well be part of xkcd's "what if?":
Let's say Monica made a piece of software that sends all RSA keypairs to a central database after they're not used anymore. Something ...
3
votes
0
answers
120
views
Pollard's Rho - Restricting the random function to the exponents
Pollard's Rho is usually constructed using a function $f:G \rightarrow G$ which behaves 'random enough' in order to detect a collision with Floyd's cycle detection trick. It is easy enough to observe, ...
- 75
1
vote
1
answer
82
views
Can one deduce the symmetric key size used to encrypt a given a piece of ciphertext?
Assume an attacker captures a piece of ciphertext encrypted with a symmetric key.
He knows all the details of the algorithm used to encrypt except for the size of the key used in this case.
Can he ...
- 113
9
votes
3
answers
3k
views
SHA-1 collisions - what about practical attacks?
I understand the theoretical problem with hash collision but when it comes to practice, I get very confused.
Suppose a attacker would like to forge a certificate (or any kind of structured piece of ...
- 347
3
votes
0
answers
230
views
Timing Attack on OpenSSL by Brumley
I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003).
In this paper on page 4, Brumley ...
- 31
3
votes
2
answers
522
views
What, cryptographically speaking, is a "long message"?
I have read about long message attacks on some cryptographic hash functions. However, I don't quite understand what is being referred to as a "long message".
Also, do long message attacks only apply ...
- 101
2
votes
1
answer
1k
views
What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
This page on Twist security mentions a combined attack and a twist rho attack, applicable in particular to NIST P-224 curve with cost $2^{58.4}$ something, with no mention precise definition of ...
- 138k
8
votes
1
answer
3k
views
Understanding Twist Security with respect to short Weierstrass curves
I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves.
That section claims ...
- 6,894
4
votes
1
answer
6k
views
A simple attack on DESX in time $2^{120}$ [duplicate]
Let $\mathcal{M}$ be our message space and $\mathcal{K}$ our key space. Now, let $\mathrm{E} : \mathcal{K} \times \mathcal{M} \to \mathcal{M}$ be a block cipher. Define the block cipher $\mathrm{EX}((...
- 192
1
vote
1
answer
624
views
RSA CRT modulo reduction
I am working on RSA CRT and there is a point that I don't understand :
So we have $n=pq$ and $c = m^e \bmod n$ an encrypted message.
To decrypt $c$ with RSA CRT, we have to compute :
$d_p = d \bmod ...
- 2,826
1
vote
1
answer
4k
views
Possible Digital Signature Hack?
I am starting to learn more about cryptography and I just read more about how asymmetric keys can make a digital certificate, and I would like if someone could explain me why the following case can't ...
- 113
4
votes
0
answers
137
views
Implementation Attacks on Hashes
So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc.
What implementation attacks are there against hashes or hashed based functions (...
- 189
4
votes
1
answer
2k
views
Is there a generic attack on encrypted CRC32 when used as a MAC?
I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break.
The ...
- 33
1
vote
0
answers
136
views
Attacks on Full TripleDES [closed]
I have been reading about attacks and many of them work on specific rounds of TripleDES but not on full TripleDES. Is there any attack except brute force that works on full TripleDES? (theoretical)
- 597
2
votes
0
answers
231
views
RSA: Common modulus attack problem [duplicate]
I understand in theory how the common modulus attack works (as described here: how to use common modulus attack?)
Though, I did not understand completely how it worked with a negative $s_i$. Since $...
- 559
4
votes
2
answers
444
views
Basic attacks on McEliece; finding S and P
Take a McEliece cryptosystem with public generator matrix $G' = S G P$ where $G$ is a generator of a secret code with known fast decoding (not necessarily a Goppa code over $\mathbb{F}_2$), $S$ is ...
- 328
1
vote
1
answer
2k
views
AES CBC MAC splicing attack
I'm trying to implement AES CBC MAC splicing attack in Python, the idea is:
given a message M, its tag Tm (MAC(M) = T), a new message N and its tag Tn we build a message such as: M||N = (M1, ..., Mn, ...
5
votes
1
answer
747
views
Are RSA or ECC vulnerable to an attack where the same (unknown) plaintext is encrypted with multiple public keys?
I'm not sure what this attack model is called - it's not known-plaintext and also not quite cipher-text-only. It is similar to this question except the general case (not just two keys) and using keys ...
- 223
4
votes
1
answer
5k
views
SHA-256 Partial Collision of initial 36 bits and more
I was lucky enough to, by brute force, have found two different messages, whose SHA-256 hashes collide in the first 9 hexadecimal characters, which are 36 bits, let'...
- 43
11
votes
1
answer
329
views
What informal indicators exist for estimating the computational infeasibility of cryptographic problems?
When assuming a block cipher primitive is secure, or a number theoretic problem is hard, this assumption is usually based on how far we are from breaking the primitive or solving the problem using ...
- 10.4k
1
vote
1
answer
98
views
Necessity of changing $p$ and $q$ when your private key is exposed?
Suppose your private key $d_1$ has been exposed. Instead of changing $p$ and $q$, instead you just choose a new public and private key (say $e_2$ and $d_2$) and use these instead. What kinds of ...
- 11
11
votes
1
answer
4k
views
Is MD5 second-preimage resistant when used only on FIXED length messages?
I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient.
I have read a lot about MD5 security for this ...
- 343
17
votes
1
answer
19k
views
The difference between these 4 breaking Cipher techniques?
I'm trying to understand the difference between the following and what they actually mean :
Known plaintext attack
Known ciphertext attack
Chosen ciphertext attack
Chosen plaintext attack
Any ...
- 445
6
votes
1
answer
177
views
Has a Two Key TDES encryption ever been successfully attacked?
Is there any known instance of a Two Key TDES ever being successfully attacked (in real life), when the key is used to encrypt less than $2^{20}$ words?
- 61
12
votes
2
answers
3k
views
How can I implement the elliptic curve MOV attack myself?
I understand and have implemented elliptic curve signatures in Python without the use of libraries like Sage, and would like to implement the MOV attack against certain weak types of elliptic curves.
...
- 121
2
votes
1
answer
414
views
Elliptic curve cryptography attack vector
I would expect a complicated answer for what seems like a simple question about Elliptic curve cryptography. I've read several entries here such as "Elliptic curve cryptography related key attacks" ...
- 121
6
votes
1
answer
776
views
Difference between actual attacks and theoretical attacks on SHA cryptographic series
Could anyone tell me what the difference is between a theoretical attack (Like the one done on SHA-1) and an actual, practical attack (Like the one done on SHA-0)? Is a theoretical attack a proposed ...
11
votes
1
answer
2k
views
Relation between attack and attack model for signatures
What is the relationship between an attack and an attack model?
For example, let $\Pi$ be the Lamport signature scheme. This signature has its security based on any one-way function. The Grover ...
- 2,661
11
votes
2
answers
3k
views
In textbook RSA with low public exponent, how big does a random message needs to be?
Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
- 138k
5
votes
0
answers
562
views
How hard is a known prefix hash preimage attack on SHA-2?
Suppose the attacker knows $X, Z$ such that
$H(X || Y) = Z$
If bit-length(Y) < 60 then a brute force attack is possible.
What if ...
- 1,867