# Tag Info

44

That number was so quick to factor because its factors are extremely close together, i.e., it factors as $\left(\lfloor\sqrt{n}\rfloor + 70\right)\left(\lfloor\sqrt{n}\rfloor - 68\right)$. Some algorithms, like Fermat's, which work best the closer together the factors are, will find this factorization instantly.

34

The ISO/IEC 9899:1990 edition of the C standard contains: EXAMPLE     The following functions define a portable implementation of rand and srand. static unsigned long int next = 1; int rand(void) // RAND_MAX assumed to be 32767 { next = next * 1103515245 + 12345; return (unsigned int)(next/65536) % 32768; } void srand(unsigned int ...

33

You could be thinking about the Merkle-Hellman knapsack cryptosystem. It was invented in 1978 and everything seemed well and good until it was completely broken six years later in 1984 by Shamir - it was a complete and total break, i.e. the cryptosystem became unusable overnight. That said I don't know if the knapsack cryptosystem was ever "popular" in the ...

29

These aren't "attacks" in and of themselves, they are simply a way to classify attacks depending on how many assumptions they make. For instance, if an attack requires plaintext-ciphertext pairs to recover the key, but they don't have to be any particular pairs, that attack is categorized as a known-plaintext attack. However if another attack required the ...

28

Modern encryption can be broken in practice even when the algorithms are theoretically secure. There are a variety of ways this can happen: Side channel analysis could have played a part. The accepted answer to the linked question is excellent and provides some very good examples. Exploitation of implementation bugs could have played a part. Malware ...

22

For example: the 5-qubit quantum computer created at MIT by using the technique of ion traps succeeded in prime-factorizing 15. Does that mean that since it succesfully managed that, that it is a all-purpose quantum computer which could be used for cryptanalysis and/or cryptographic attacks? No, not even close. Attacking e.g. RSA requires a lot more than ...

19

This is a shot in the dark, but could you be thinking of the Needham-Schroeder protocol? It was published in 1978 [1], and an attack was published as much as 18 years later, in 1996 [2]. It is not an encryption method, though, but a protocol. In fact, the original paper does not even specify an encryption method to be used, but uses encryption symbolically. ...

18

DES has not been mentioned in the previous two answers. Although it was known to be quite weak from very early on it was widely used for a couple of decades at least, until newer algorithms (3DES, AES, but also e.g. RC4) displaced it. Nowadays it can be broken in hours with dedicated hardware or with at most a few thousand dollars of cloud computing time. ...

17

Right now, the best published attack against MD5's preimage resistance (first preimage, actually, but it applies to second preimage resistance as well) finds preimages in cost $2^{123.4}$ average cost, which is slightly better than the generic attack (average cost of $2^{128}$), but still way beyond the technologically feasible. The attack rebuilds the ...

16

I hope I got your point and try to answer your question. Actually, if I understand you right, then what you call an attack actually means an adversary acting in a specific attack model. To clarify this, we need to review the security models for digital signature schemes and when we have discussed this we can clarify issues. Basically, we have to discuss ...

15

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? No. This is what is referred to as a known plaintext attack, and secure block ciphers are designed to prevent exactly this kind of attack. This answer on the Mathematics Stack Exchange goes into more ...

13

The question asks how a collision in a hash such as SHA-1 could become a practical concern, with focus on the case of a public-key certificate à la X.509. I'll first give an example involving executable code signing. I'll assume an attacker in a position to write bootstrap code (like, the supplier of a development toolchain, or someone who compromised that ...

13

It is all pairings... this is a rather complex matter. I recommend reading Ben Lynn's PhD dissertation; it is about as nice an introductory text on pairings as you can get. The definition is rather mind-twisting: You first define divisors, which are rather formal objects. It is the free group of the curve points: for each curve point $P$, you define a ...

13

Yes, but the answer is more or less embedded in the question here; you can only say that you encrypt too much data in case the secret key and / or plaintext becomes vulnerable. Most modes of operation define how much data can be encrypted. This could mean real limits to the amount of data (approx. $2^{36}$ bytes or 64 GiB for AES-GCM) or it may be ...

12

I once played this online game, it was an old-school MUD. You log in, chat, kill some goblins. It had a casino. You go into the casino and you bet X gold, and there was a 40% chance you win double your bet. Obviously in the long run, the casino will always win, right? But here's the thing. I knew the game was written in C++, and I knew the rand() ...

12

Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password? As usual in password-based cryptography, we'll consider that the password was chosen from a relatively small set, small enough that password enumeration by an adversary can generate passwords including the one of a target user with fair probability, ...

11

A TRNG is never used instead of a CSPRNG. They serve different purposes. A TRNG is used to seed a CSPRNG. A CSPRNG alone isn't enough to generate random data since it's reproducible. A hardware entropy source alone isn't enough to generate random data because all entropy sources have biases. For any purpose that's related to security or cryptography, a ...

11

"Constant-time" is about not leaking information through timing-based side-channels. If you assume that there is no side-channel, then, in particular, there is no side-channel attack. It is nevertheless a rather bold assumption. There is a large variety of possible side-channels, and lab demonstrations of attacks have been done exploiting, among others, ...

11

In the ROCA paper the authors define an integer $M$ (which they call a primorial) as follows: $$M = \prod_{i=1}^{n} P_i = 2 * 3 * ... * P_n$$ Said another way, $M$ is the product of the first $n$ primes. What the authors observed is that the factors of a vulnerable RSA modulus $N$ have the following form: $$p = k*M + (65537^a \text{ mod } M)$$ The $65537 ... 11 Blinding protects against some side-channel attacks in RSA: those that target variations in the timing or other side-channel information as a known function of$C$(or$C^d\bmod n$should that end up to be available). As noted in the question, blinding is pointless against the most basic (Simple) Power Analysis attack, which determines the bits of the ... 10 A character is usually encoded as an ASCII. This means that it uses up one byte. That's a number from$0 - 255$. It can be represented as a hexadecimal$\text{0x00} - \text{0xFF}$. All your operations must be done character by character. From now on by "message", "key" and "cipher" i mean a single$0-255$number.$$message1 \oplus key = cipher1 \\ message2 \... 10 This is not correct, the private key$d_A$must always be an integer. Your mistake is that you are doing modular division e.g.$\frac{a}{b} \text{ mod } n$incorrectly. You cannot simply divide the integers and then reduce by the modulus. The correct way to do this is to compute the modular inverse of$b$i.e.$b^{-1} \text{ mod } n$and then compute$a*b^{-...

10

TL;DR: Yes, on narrow or some ad-hoc deterministic RSA padding, which must not be used. The Desmedt and Odlyzko attack on RSA signatures [DO1985] assumes a deterministic RSA signature scheme with appendix that, for RSA key $(N,e,d)$, signs messages $M$ with signature $S=(H(M))^d\bmod N$ for some public function $H$ with $H(M)<2^k$ and $k\ll\log_2(N)$, ...

10

What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, you need to execute $2^{128}$ AES operations, today's top computers can reach $2^{63}$ around one hour. However, reaching $2^{128}$ is beyond classical ...

9

It is vulnerable to a sort of meet-in-the-middle attack since you don't really have to brute force $k_1$. Given a plaintext-ciphertext pair, $P$ and $C$, you can calculate $C' = E(k_2', P \oplus k_3')$ for candidate values $k_2'$ and $k_3'$. Then, you can determine $k_1' = C' \oplus C$. So, you only need to brute force the two keys $k_2$ and $k_3$, making ...

9

An example that literally made the headlines in France in March 2000 involves factorization of the 321-bit RSA modulus that was a safeguard to the security of most debit/credit cards issued by French banks. The incident is known as "YesCard". It started to surface publicly circa 1998. An individual factored the modulus used¹ to verify the issuer-...

8

Without a well-designed padding system it may be possible to craft a ciphertext that the decryptor may or may not be able to decrypt properly. Whether the decryptor is able to do so will depend on the private key. The concern is that an attacker may be able to craft a string of ciphertexts, listen in to whether they decrypt properly, and finally deduce the ...

8

Orin Kerr & Bruce Schneier have a recent paper out titled Encryption Workarounds, where they group the techniques to indirectly attack theoretically-secure encryption. I think their break-down into abstract categories is helpful, as it's freer of the technical "how", and you can miss the forest for the trees. Think of all the possible ways to get what ...

8

There are $2^{256}$ different AES keys, the chance that you hit the one right one on first try is thus $2^{-256}=\frac1{2^{256}}$. To put this into perspective, here's a list of events that is roughly a billion times more likely to all happen (copied from Thomas Pornin's answer on Information Security SE): The computer spontaneously catches fire ...

8

As is, the attack seems rather pointless. But one malicious potential is that because $\bar y$ allows to successfully verify a genuine message $(m,s)$, the verifier might grow trust in it and use $\bar y$ instead of $y$ in order to verify other messages. If we assume this, practical issues could arise: That the attacker can somewhat find $(\bar m,\bar s)$ (...

Only top voted, non community-wiki answers of a minimum length are eligible