Questions tagged [dictionary-attack]
A dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or pass-phrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary.
3
votes
1answer
149 views
Performing a dictionary attack on RSA/ECB with no padding
I have the exponent $e=2^{16}+1$ and modulus $n$ (154 digit number) of an RSA public key along with the ciphertext (64 bytes) encrypted using the same key with RSA/ECB and no padding.
I am required ...
1
vote
1answer
73 views
Is forward search attack is the same as dictionary attack?
Currently, I started to learn about secure passwords in password file. The password file contains the hashed values for passwords. I know that the forward search attack for a password that if an ...
1
vote
1answer
104 views
How to prove that a rainbow table is complete?
Passwords that are hashed but not salted can be cracked using the rainbow table. I went through this and this which explains the logic behind rainbow table very well.
But I am missing something about ...
0
votes
2answers
177 views
Passphrases, Dictionary attacks and 'bit shift'
How much better would a passphrase be if you swapped the first letters of each word with a shift to the left:
"correct battery horse staple" becomes "borrect hattery sorse ctaple"
This would be ...
1
vote
0answers
59 views
Does a password that's cracked someone's account increase the chances of cracking someone else's account?
For every find in password that cracks someone's account, does that particular password have a higher probability of cracking someone else's account more than a brute force dictionary choice?
How ...
1
vote
1answer
197 views
Why does the Secure Remote Protocol have resistance of dictionary attack?
Assume that Eeve who masquerades as a legitimate host and convinces Carol to
make an authentication attempt. (Carol wants to handshake with Steve – a host)
Thus, Eve can get values $A = g^a, M1 = H(A,...
3
votes
1answer
2k views
What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?
I would like to seek confirmation/clarification of the following statements about IKE:
IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more ...
1
vote
1answer
832 views
XOR cipher with three different ciphertexts and repeated key, key length known. How do I find the plaintexts?
Let us say we have three different plaintexts (all alphabets, A-Z): $x$, $y$ and $z$, each of length $21$. Let the key, $a$, be also of length $21$.
Now, what we have is $x \oplus a$, $y \oplus a$ ...
3
votes
3answers
440 views
SRP-6 vulnerabilities when N is small
I'm one of the developers of an application which uses SRP-6 as the authentication mechanism. The authentication part of the code is very old and uses N with only 256 bits (all arithmetic is done in ...
2
votes
2answers
509 views
What is the entropy per Diceware word if a random symbol is inserted into a random position in the word?
On the Diceware page is this little gem:
For extra security without adding another word, insert one special character or digit chosen at random into your passphrase... Inserting a letter at random ...
1
vote
1answer
78 views
Problem with anonymously merging information from distributed sources
Some Background:
There is an entity with an identifier and some information. The identifier of this entity is a string with a known scheme/pattern(Which means the total number of such possible ...
3
votes
2answers
354 views
Does impersonating an SRP server give you enough information for an off-line dictionary attack?
In a comment to an answer I wrote to another question, CodesInChaos wrote that:
"Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search."
...
-1
votes
1answer
594 views
Obtaining a key that's using ice algorithm
I have a text file that has been processed by the SNOW steganography tool that uses ICE encryption. However, I do not know the key that would enable me to decrypt and retrieve the message hidden.
...
0
votes
1answer
393 views
Zero Knowledge auth schemes with weak secret
In Zero Knowledge auth schemes the public DH factor of each peer is encrypted with a potentially weak pre-shared secret and the resulting ciphertexts are exchanged over an insecure channel. Why is no ...
1
vote
1answer
657 views
What would be the most effective way to brute force a 16 char AES key?
I have a file that is encrypted in AES using a 16 char string. The string is (a-zA-Z0-9) and .,?!. Also, it only contains words ...
9
votes
1answer
1k views
How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?
I'm deploying a secure remote password protocol implementation and I'm wondering what the consequences are when the client generated verifier gets leaked to an attacker. I've read Thomas Wu's paper ...
15
votes
5answers
4k views
How can rainbow tables be used for a dictionary attack?
I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length.
The maximum length I can enforce is 14 characters. ...
2
votes
3answers
2k views
Dictionary attack on pass-phrases on common algorithms?
I don't yet perfectly understand the difference between brute-force and dictionary attack since this differentiates one attacking the key and another attacking password: apparently attacking passwords ...
