Skip to main content

Questions tagged [key-recovery]

A means of recovering cryptographic keys when the usual means for obtaining them is unavailable.; the ability to uncover the secret key to a cryptographic message.

Filter by
Sorted by
Tagged with
1 vote
1 answer
69 views

Is there any notion of key-recovery attacks security (perhaphs using games) that is equivalent to IND-CPA?

I am talking about Symmetric Cryptography only in the following. We know that Semantic Security (in the presence of eavesdropper) implies security against message recovery (in the presence of ...
Alessio Proietti's user avatar
1 vote
1 answer
45 views

Proof that semantic security implies key-recovery security

I'm trying to prove that semantic security implies key-recovery security. There is already a question that addresses this, but it doesn't explain the setup of the security reduction, which is what I'm ...
cmplx96's user avatar
  • 113
4 votes
1 answer
2k views

In Bitcoin, given half the 52-character private key in WIF format, is it possible to reconstruct the whole private key?

Given the following two preconditions: It is almost impossible to reconstruct a bitcoin private key if an attacker only has one half of the private key as well as the public key. It is almost ...
Ohumeronen's user avatar
2 votes
1 answer
90 views

in NTRU, can g be recovered given f and h?

The NTRU key generation involves polynomials and their arithmetic in polynomial rings, which is a bit different from arithmetic in modular integers. In the NTRU cryptosystem, the public key $h$ is ...
Tobsec's user avatar
  • 23
0 votes
0 answers
229 views

HMAC-SHA256 key length against key recovery attack

I have trouble finding information on the security strength of HMAC-SHA256 against key recovery attacks with respect to the key size. To fit a certain application I must use a 128-bits key with a HMAC-...
dragonfire2000's user avatar
1 vote
0 answers
110 views

Which cryptographic attack here is feasible on RSA? [duplicate]

I'm new to cryptography, so please don't bash me. I'm trying to learn to recover a RSA private key. As you can see from my profile I'm a cybersecurity professional, which is only now trying to learn ...
Sir Muffington's user avatar
1 vote
0 answers
85 views

Question about Security of Multi-Signature Scheme

I am a developer trying to follow best practice guidance as established by the IETF for my applications. I was researching standards for ECDSA key generation for some work that I have to do in the ...
librehash's user avatar
  • 145
3 votes
0 answers
773 views

Algorithm used to generate a BitLocker recovery key

I know exactly how a generated BitLocker recovery key works and I can write a code to brute-force it. How is the recovery key generated though? I could think of some answers: it is generated using an ...
abbas's user avatar
  • 175
2 votes
1 answer
298 views

Proving semantic security implies security from key-recovery attack

I am working on problem 2.11 from the book: A Graduate Course in Applied Cryptography by Dan Boneh and Victor Shoup. The problem reads as follows: Problem 2.11: Let $\mathcal{E} = (E, D)$ be a cipher ...
Tom Finet's user avatar
  • 125
0 votes
1 answer
705 views

Possible to directly calculate the Recovery ID from a msg, signature and public key in ECDSA/secp256k1?

Problem Let's say I receive a signature $(r,s)$, the corresponding public key and the message that was signed. I don't have access to the private key. I need to know what the ...
CoderApprentice's user avatar
2 votes
1 answer
136 views

How does Authentication-Key Recovery for GCM work?

In his Paper "Authentication weaknesses in GCM" Ferguson describes, how some bits of the error polynomial can be set to zero, thereby increasing significantly the chance of a forgery. Q: ...
MichaelW's user avatar
  • 1,497
1 vote
1 answer
94 views

Construction of key recovery attack in O(2^(n/2))

I have to construct a key recovery attack on symmetric key encryption using a publicly known permutation $\Pi$ in $O(2^\frac{n}{2})$ time using $2^\frac{n}{2}$ queries to an encryption oracle. The ...
Itsy's user avatar
  • 21
0 votes
0 answers
109 views

Finding the cleartext password given its MD5

Given powerful GPU and PC hardware, is it realistic to recover a password in a few hours given a cleartext's MD5? Max chars are 95, and the maximum length of the password is 15 characters.
prtqwsq's user avatar
0 votes
0 answers
1k views

Bitcoin Key Recovery Without Nonce Re-Use

There are a lot of questions in these forums regarding the recovery of private keys. But I'm here to postulate on something unique to a specific piece of research that I looked into recently. The ...
librehash's user avatar
  • 145
1 vote
1 answer
52 views

Recovering public key with small R parameter

I use for tests small toy 16-bit elliptic curve: Modulus prime p: 65167 a: 0 b: 7 order: 64879 G: (62171,14828) (generated by brichard19/ecdl on ...
Andrzej's user avatar
  • 59
1 vote
0 answers
129 views

Impossibility of recovering the key of a keyed pseudorandom permutation

I'm currently working on some cryptography homework, but I'm stuck on this particular question. Let $F$ be a pseudorandom permutation with identical key length and block length (both equal to the ...
Peiffap's user avatar
  • 111
1 vote
1 answer
444 views

Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)

When you know the Salsa20's keystream, how do you know the next keystream? In other words, can I infer the next keystream when I don't know the Key and IV of Salsa20, but the keystream is ...
YGK's user avatar
  • 13
1 vote
0 answers
125 views

Generating a recovery phrase for a RSA key-pair

What is an optimal way to associate a RSA key-pair with a recovery phrase/seed for access recovery purposes? I've seen a lot of cryptocurrency wallets provide this feature, however, I'm not looking to ...
NowsyMe's user avatar
  • 113
0 votes
0 answers
135 views

PIN & PUK protection for key

I'm trying to protect a key using a PIN code. However, if the user somehow loses the PIN code, I'd like to be able to allow recovery using a PUK (similar behaviour as for instance your SIM card on ...
Bram's user avatar
  • 155
1 vote
0 answers
68 views

Could a private key recovery via modulus fault attacks be optimised by being able to choose the faulty moduli?

The paper 'Why One Should Also Secure RSA Public Key Elements' describes an attack where an adversary can fully recover a private key by injecting faults into the modulus before exponentiation takes ...
Aaron K's user avatar
  • 11
3 votes
0 answers
684 views

How do I recover RSA primes from the modulus and the coefficient?

The RSA private key contains 2 primes (of about 4096 bits each), and I only know their product (called modulus) and the modular inverse (called coefficient). How do I recover the RSA primes from the ...
pts's user avatar
  • 223
1 vote
1 answer
525 views

Is there any practical use of reduced rounds of AES

There are lots of attacks which are on reduced block ciphers. There are practical attack on five rounds of AES-128five rounds aes broken in six minutes. I was just wondering if there is any practical ...
Radium's user avatar
  • 177
0 votes
1 answer
89 views

Would a non-envelop, prefix only, SHA2 built MAC be susceptible to key recovery attacks?

When aiming to build a MAC, classic literature discusses the use of Envelopes or key "Sandwich" to build MACs. These were proved to be as secure as HMAC in “Sandwich” Is Indeed Secure: How to ...
Alpha1983's user avatar
3 votes
1 answer
523 views

Partial key recovery from linear equations

I have searched for my question but I didn't find any relevant answer to my situation. I guess maybe it is too easy but I am a newbie in crypto and I can't figure out the answer. Here is the exercise: ...
Nesr's user avatar
  • 45
3 votes
1 answer
1k views

Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?

I presented our mathematician with an idea: If you have a black box that encrypts or decrypts AES with the same 128 bit key (you don't have any direct access to the key), and you control the input ...
Anton Vainer's user avatar
1 vote
1 answer
616 views

Show that CPA-security implies security against plaintext recovery

Consider the following experiment: $k = Gen(1^n)$ $m \stackrel{u}{\in} \{0,1\}^{l(n)}$ $c = Enc_k(m)$ $m' = B(1^n,c)$ Define the winning event as $m' = m$. I would like to show that if the ...
user1868607's user avatar
  • 1,243
2 votes
2 answers
661 views

Public-private algorithm where it is not possible to recover public key from private key?

Is there an asymmetric algorithm where it is not possible to extract a public key from private key? So far any algorithms I tried (dsa, rsa, ecdsa, ed25519) successfully recover their public keys from ...
Ulex's user avatar
  • 23
2 votes
1 answer
226 views

Can I implement key recovery without compromising security?

I'm no crypto expert but I'm trying to figure out if this is possible: I'm building an application that has access to very sensitive user data. I receive this data in plain text but I'm not allowed ...
grokling's user avatar
2 votes
1 answer
6k views

Recovery public key from secp256k1 signature and message [closed]

Regarding this article about a signature recovery However, with the signature and the message that was signed, and the knowledge of the curve, it is possible to generate two public keys So we can ...
bitaps.com's user avatar
-1 votes
1 answer
330 views

Is there any symmetric encryption algorithm cannot guess the key when encryption and decryption value are known?

I want symmetric encryption algorithms that cannot have their keys recovered when given plaintext and ciphertext. I tried XOR cipher algorithm, but when I've obtained ciphertext and plaintext, the key ...
Aymn Alaney's user avatar
4 votes
2 answers
8k views

Recovering private key from Secp256k1 signatures

I've seen many answers here and many articles that says we can recover the private key from reused R signatures. But, what if the r,s signatures are different in transaction of bitcoin then is there a ...
Harvy Sam's user avatar
0 votes
1 answer
137 views

Can high-entropy data be reconstructed from plaintext XORs in CTR nonce reuse?

(My interest is academic; I certainly have no intention of rolling my own crypto, especially the known-broken type!) I know that if the nonce gets reused in a CTR stream, the two cipher blocks can be ...
Therac's user avatar
  • 293
1 vote
1 answer
455 views

Cryptanalys of "bad" RC4 implementation

I need help of cryptanalyzing a "bad" RC4 implementation to recover an encrypted text of 13742 bytes. I don't know the key and this implementation does not utilize the drop-n routine. But, I know ...
Mekhalleh's user avatar
2 votes
1 answer
296 views

Does this PBKDF2-SHA1 payload hint at a cryptographic security issue?

Blockchain first 16 encrypted bytes, IV, and iter_count – all encoded in Base64: Yms6xqrzCfFsQadVZ5gQonMtnQAAAAAAAAAAAAAAAAAAAAAQJwAA69tYNg== Does it looks like “...
seji17's user avatar
  • 21
2 votes
1 answer
1k views

Recovery of blowfish encryption key?

Is it possible to recover key used for blowfish encryption, if I have encoded and decoded string as well as initialization vector tables (bfp and ks0-3)? I don't know the length of the key.
unknown123's user avatar
2 votes
1 answer
2k views

ECDSA pubkey recovery issue

I try to recover public key from the given message $m$ and pair $(r, s)$ using curve that satisfies standard RFC7091. I am using algorithm from one of secp256k1 implementation but it seems that not ...
dvbozhko's user avatar
5 votes
3 answers
1k views

Is including the key as AAD actually dangerous?

In a recent answer, Maarten mentioned including the key is a bad idea as well. This got my curious. Is there any scientific / cryptographic analysis whether including the key in the ...
SEJPM's user avatar
  • 46.1k
0 votes
1 answer
140 views

CCA-2 key recovery attack to an homomorphic scheme?

It is known that homomorphic encryption schemes are not secure against CCA attacks. This is because in the security game, the attacker may use homomorphic evaluation to cheat in the the challenges and ...
Tal-Botvinnik's user avatar
4 votes
1 answer
328 views

Using Pollard's lambda in a key-recovery attack on DH

I've become interested in writing an exploit for the OpenSSL vulnerability here (CVE-2016-0701). Running through the bullets describing the attack, I can follow up to the last bullet point. Reviewing ...
jtim's user avatar
  • 43
5 votes
2 answers
32k views

How to find the keyword of the Playfair cipher, given the plaintext and the ciphertext?

I know how the Playfair cipher works. I would like to know how to find the keyword of the Playfair cipher, given some ciphertext and the corresponding plaintext. For example: encrypted: ...
Brian Brown's user avatar
0 votes
1 answer
624 views

How to detect what crypto-method is used by Filecoder.Q?

I have 2 different images, one original, and one locked by a malware detected by eset as "Win32/Filecoder.Q". How to detect the encryption method that is used and the key, that is not using any ...
Denis Balan's user avatar
9 votes
2 answers
4k views

How does Microsoft's BitLocker Recovery Code work?

I don't trust Microsoft BitLocker because it is closed source, which makes it so people can't audit it. But now I'm really interested in how its recovery code works. In my own knowledge, encrypted ...
Hartman's user avatar
  • 269
6 votes
2 answers
364 views

How should I implement a secure recovery of encryption?

I want to create a system to host as securely as possible encrypted data in a way that not even the system can know the content of the data, but that it could be recovered. I would like to know how ...
Nestor Mata Cuthbert's user avatar
42 votes
6 answers
6k views

How to check that you got the right key when brute forcing an encryption?

How do you know when you have the right key when brute-forcing? Let's say that they test the right key. They then have to check that the decrypted text makes sense. To do so, they can test whether ...
user avatar
2 votes
1 answer
818 views

Understanding ransomware – What makes plain-text-attacks or brute-forcing so hard?

Say I have four files. Two are completely unencrypted, while the other two are the exact same files other than that they have been encrypted with (apparently) the same public key (via a ransomware ...
Excille's user avatar
  • 29
6 votes
1 answer
4k views

RSA public key recovery from signatures

Is it possible (how) to recover public (512 bit long) RSA key from multiple signatures having corresponding plain texts. Padding is not randomized. I need it to verify any future message comming from ...
Glushiator's user avatar
3 votes
1 answer
1k views

What does “invertibility of the cryptographic primitive” mean?

source: http://www.cosic.esat.kuleuven.be/publications/thesis-152.pdf ,page 32 Note that key recovery implies invertibility of the cryptographic primitive (because due to the Kerckhoffs’ ...
laycat's user avatar
  • 198
15 votes
3 answers
1k views

Can we ensure the security of a crypto-algorithm and -implementaton against acoustic cryptanalysis?

Like people always say: “Attacks only get worse…” — which is why I'm asking early. I have been reading the paper “RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis” published December 18, ...
e-sushi's user avatar
  • 18k
4 votes
2 answers
4k views

Determine the Key given ciphertexts and plaintexts?

Given two sets of plaintexts and their corresponding ciphertexts, how does one determine the key $K$? The ciphertexts are: $$C_1= (P_1 \oplus K_0) + K_1$$ and $$C_2= (P_2 \oplus K_0) + K_1$$ $K = ...
eagle93's user avatar
  • 41
6 votes
2 answers
1k views

Cryptanalysis and weaknesses of SEED cipher

I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've ...
Polynomial's user avatar
  • 3,527