Questions tagged [dictionary-attack]
A dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or pass-phrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary.
23
questions
1
vote
2
answers
468
views
Crack AES encryption via passphrase dictionary attack?
How easy would it be to crack a AES-256 encrypted file, that is protected by a passphrase?
I understand that the trying to brute force a AES-256 encryption key would be on the unfeasible side, even ...
- 13
1
vote
1
answer
73
views
Could PAKE via smooth projective hash function protect agaist replay attacks?
I came across some password-based authenticated key exchange (PAKE) protocols that are based on the smooth projective hash function (SPHF) in the standard model. And I checked some related works, and ...
- 323
6
votes
1
answer
769
views
Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password?
A malicious actor wants to decrypt ciphertext that was encrypted with a password. He also possesses the hash (bcrypt/PBKDF2) of that password. Does he have any significant practical advantage in ...
- 63
0
votes
0
answers
174
views
Argon2id benchmarks
Recently I've decided to publish a simple app that I am using for maintaining and storing sensible encrypted data on the cloud.
https://www.microsoft.com/store/apps/9NSGBQSJ2HD6
The hashing is done ...
- 101
1
vote
0
answers
81
views
Why isn't Kerberos using temporary keys to avoid dictionary attacks?
In the Kerberos protocol, the user sends his ID, the server (Or ticket granting server) ID and a nonce value. The Key Distribution Center uses a key (I assume symmetrical) derived from the client's ...
- 121
3
votes
1
answer
896
views
Performing a dictionary attack on RSA/ECB with no padding
I have the exponent $e=2^{16}+1$ and modulus $n$ (154 digit number) of an RSA public key along with the ciphertext (64 bytes) encrypted using the same key with RSA/ECB and no padding.
I am required ...
- 45
1
vote
1
answer
389
views
Is forward search attack is the same as dictionary attack?
Currently, I started to learn about secure passwords in password file. The password file contains the hashed values for passwords. I know that the forward search attack for a password that if an ...
- 13
2
votes
2
answers
459
views
How to prove that a rainbow table is complete?
Passwords that are hashed but not salted can be cracked using the rainbow table. I went through this and this which explains the logic behind rainbow table very well.
But I am missing something about ...
- 143
0
votes
2
answers
466
views
Passphrases, Dictionary attacks and 'bit shift'
How much better would a passphrase be if you swapped the first letters of each word with a shift to the left:
"correct battery horse staple" becomes "borrect hattery sorse ctaple"
This would be ...
1
vote
0
answers
66
views
Does a password that's cracked someone's account increase the chances of cracking someone else's account?
For every find in password that cracks someone's account, does that particular password have a higher probability of cracking someone else's account more than a brute force dictionary choice?
How ...
- 11
1
vote
1
answer
301
views
Why does the Secure Remote Protocol have resistance of dictionary attack?
Assume that Eeve who masquerades as a legitimate host and convinces Carol to
make an authentication attempt. (Carol wants to handshake with Steve – a host)
Thus, Eve can get values $A = g^a, M1 = H(A,...
- 21
4
votes
1
answer
4k
views
What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?
I would like to seek confirmation/clarification of the following statements about IKE:
IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more ...
- 141
2
votes
1
answer
1k
views
XOR cipher with three different ciphertexts and repeated key, key length known. How do I find the plaintexts?
Let us say we have three different plaintexts (all alphabets, A-Z): $x$, $y$ and $z$, each of length $21$. Let the key, $a$, be also of length $21$.
Now, what we have is $x \oplus a$, $y \oplus a$ ...
3
votes
3
answers
604
views
SRP-6 vulnerabilities when N is small
I'm one of the developers of an application which uses SRP-6 as the authentication mechanism. The authentication part of the code is very old and uses N with only 256 bits (all arithmetic is done in ...
2
votes
2
answers
865
views
What is the entropy per Diceware word if a random symbol is inserted into a random position in the word?
On the Diceware page is this little gem:
For extra security without adding another word, insert one special character or digit chosen at random into your passphrase... Inserting a letter at random ...
user7024
1
vote
1
answer
92
views
Problem with anonymously merging information from distributed sources
Some Background:
There is an entity with an identifier and some information. The identifier of this entity is a string with a known scheme/pattern(Which means the total number of such possible ...
- 111
3
votes
2
answers
444
views
Does impersonating an SRP server give you enough information for an off-line dictionary attack?
In a comment to an answer I wrote to another question, CodesInChaos wrote that:
"Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search.&...
- 44.3k
-1
votes
1
answer
933
views
Obtaining a key that's using ice algorithm
I have a text file that has been processed by the SNOW steganography tool that uses ICE encryption. However, I do not know the key that would enable me to decrypt and retrieve the message hidden.
...
- 1
0
votes
1
answer
422
views
Zero Knowledge auth schemes with weak secret
In Zero Knowledge auth schemes the public DH factor of each peer is encrypted with a potentially weak pre-shared secret and the resulting ciphertexts are exchanged over an insecure channel. Why is no ...
- 103
1
vote
1
answer
981
views
What would be the most effective way to brute force a 16 char AES key?
I have a file that is encrypted in AES using a 16 char string. The string is (a-zA-Z0-9) and .,?!. Also, it only contains words ...
10
votes
1
answer
2k
views
How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?
I'm deploying a secure remote password protocol implementation and I'm wondering what the consequences are when the client generated verifier gets leaked to an attacker. I've read Thomas Wu's paper ...
- 325
15
votes
5
answers
5k
views
How can rainbow tables be used for a dictionary attack?
I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length.
The maximum length I can enforce is 14 characters. ...
- 283
2
votes
3
answers
3k
views
Dictionary attack on pass-phrases on common algorithms?
I don't yet perfectly understand the difference between brute-force and dictionary attack since this differentiates one attacking the key and another attacking password: apparently attacking passwords ...
- 693