Questions tagged [roca]
ROCA is an acronym for "Return of the Coppersmith Attack" — a vulnerability in the RSALib cryptographic software library thought to be used in millions of smart cards and other devices.
7 questions
0
votes
0
answers
90
views
ROCA with unknown M and g [duplicate]
Trying to upsolve "notsosmart - hxp CTF 2017"
https://2017.ctf.link/internal/challenge/5c8119ca-bfed-444a-968d-1cc9bff27bfb.html
This server code was given during the CTF, letting you get ...
- 59
40
votes
1
answer
6k
views
What is “Fast Prime”?
In this note, the manufacturer of a RSA key generation gizmo vulnerable to the new ROCA attack (see second section) explains that
it is common practice to employ acceleration algorithms in order to ...
- 49.5k
3
votes
1
answer
309
views
ROCA Implementation, Coppersmith Algorithm does not return roots
We are currently trying to reproduce the implementation of the ROCA-Paper. Therefore we calculated $M'$ from $M$ and $Order_M'$ from $Order_M$ to reduce the search space, but when we hand these values ...
- 49.5k
3
votes
0
answers
147
views
RSALib prime generation - derive number of primes
I'm working on factorizing a ~450 bit key that I know has been generated with RSALib and thus is vulnerable to ROCA. Now reading the original paper, I can see that the primes are generated in the ...
- 94.5k
3
votes
1
answer
236
views
Biased RSA moduli and ROCA
Say I can generate many 1024-bit RSA public keys $(N,e)$ with fixed public exponent $e = 65537$. They turn out to be heavily biased when computing $N \bmod x$ for small primes $x$. These congruences ...
- 49.5k
8
votes
1
answer
2k
views
How does the ROCA attack work?
I have been trying to understand the ROCA attack described here as the "First Attack" and I cannot follow the explaination.
I have been trying to generate a 512-bits key and crack it. As far as I can ...
- 49.5k
4
votes
2
answers
435
views
How ROCA get the polynomial used with coppersmith
I'm trying to understand the ROCA attack on RSA from Matus Nemec et al. but I'm stuck on how they goes from the constraint they have expressed has:
$$f(x) = x ∗ M' + (65537^{a'} \mod M') \pmod p$$
To ...
- 49.5k