Hot answers tagged

43 votes
Accepted

How was this 2048 bit number factored so fast?

That number was so quick to factor because its factors are extremely close together, i.e., it factors as $\left(\lfloor\sqrt{n}\rfloor + 70\right)\left(\lfloor\sqrt{n}\rfloor - 68\right)$. Some ...
  • 11.9k
35 votes
Accepted

How can C rand() be exploited if a secure seed is used?

The ISO/IEC 9899:1990 edition of the C standard contains: EXAMPLE     The following functions define a portable implementation of rand and ...
  • 126k
33 votes
Accepted

Did a certain cryptography method get abandoned due to security flaws in the past?

You could be thinking about the Merkle-Hellman knapsack cryptosystem. It was invented in 1978 and everything seemed well and good until it was completely broken six years later in 1984 by Shamir - it ...
  • 7,338
28 votes
Accepted

How is encryption broken today?

Modern encryption can be broken in practice even when the algorithms are theoretically secure. There are a variety of ways this can happen: Side channel analysis could have played a part. The ...
  • 19.3k
26 votes
Accepted

Why "1" in 51% attack on Blockchain network

From Bitcoin Wiki; A majority attack (usually labeled 51% attack or >50% attack) is an attack on the network. It is also called consensus attacks. It is only to demonstrate that one needs the ...
  • 44.3k
22 votes
Accepted

What does a "real" quantum computer need for cryptanalysis and/or cryptographic attack purposes?

For example: the 5-qubit quantum computer created at MIT by using the technique of ion traps succeeded in prime-factorizing 15. Does that mean that since it succesfully managed that, that it is a all-...
19 votes

Did a certain cryptography method get abandoned due to security flaws in the past?

This is a shot in the dark, but could you be thinking of the Needham-Schroeder protocol? It was published in 1978 [1], and an attack was published as much as 18 years later, in 1996 [2]. It is not an ...
18 votes

Did a certain cryptography method get abandoned due to security flaws in the past?

DES has not been mentioned in the previous two answers. Although it was known to be quite weak from very early on it was widely used for a couple of decades at least, until newer algorithms (3DES, AES,...
  • 31.5k
17 votes
Accepted

Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?

One example is OCB2; Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC by Rogaway. It is standardized in ISO/IEC 19772:2009. The author also provided a proof by ...
  • 44.3k
15 votes
Accepted

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? No. This is what is referred to as a ...
  • 478
14 votes

How can C rand() be exploited if a secure seed is used?

I once played this online game, it was an old-school MUD. You log in, chat, kill some goblins. It had a casino. You go into the casino and you bet X gold, and there was a 40% chance you win double ...
13 votes
Accepted

SHA-1 collisions - what about practical attacks?

The question asks how a collision in a hash such as SHA-1 could become a practical concern, with focus on the case of a public-key certificate à la X.509. I'll first give an example involving ...
  • 126k
13 votes

Is there a downside to encrypting too much data with the same key?

Yes, but the answer is more or less embedded in the question here; you can only say that you encrypt too much data in case the secret key and / or plaintext becomes vulnerable. Most modes of ...
  • 86.5k
12 votes
Accepted

Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password?

Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password? As usual in password-based cryptography, we'll consider that the password was chosen from ...
  • 126k
11 votes

Many time pad attack (XOR)

A character is usually encoded as an ASCII. This means that it uses up one byte. That's a number from $0 - 255$. It can be represented as a hexadecimal $\text{0x00} - \text{0xFF}$. All your operations ...
11 votes

What are the dangers of using CPU clock drift for generating random data?

A TRNG is never used instead of a CSPRNG. They serve different purposes. A TRNG is used to seed a CSPRNG. A CSPRNG alone isn't enough to generate random data since it's reproducible. A hardware ...
11 votes
Accepted

What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

"Constant-time" is about not leaking information through timing-based side-channels. If you assume that there is no side-channel, then, in particular, there is no side-channel attack. It is ...
11 votes

How does the ROCA attack work?

In the ROCA paper the authors define an integer $M$ (which they call a primorial) as follows: $$M = \prod_{i=1}^{n} P_i = 2 * 3 * ... * P_n$$ Said another way, $M$ is the product of the first $n$ ...
  • 3,952
11 votes
Accepted

Does blinding work against side channel on RSA?

Blinding protects against some side-channel attacks in RSA: those that target variations in the timing or other side-channel information as a known function of $C$ (or $C^d\bmod n$ should that end up ...
  • 126k
10 votes
Accepted

A simple attack on DESX in time $2^{120}$

It is vulnerable to a sort of meet-in-the-middle attack since you don't really have to brute force $k_1$. Given a plaintext-ciphertext pair, $P$ and $C$, you can calculate $C' = E(k_2', P \oplus k_3')...
10 votes

ECDSA key recovery - floating point values

This is not correct, the private key $d_A$ must always be an integer. Your mistake is that you are doing modular division e.g. $\frac{a}{b} \text{ mod } n$ incorrectly. You cannot simply divide the ...
  • 3,952
10 votes
Accepted

Is the RSA signature attack from Desmedt and Odlyzko practical?

TL;DR: Yes, on narrow or some ad-hoc deterministic RSA padding, which must not be used. The Desmedt and Odlyzko attack on RSA signatures [DO1985] assumes a deterministic RSA signature scheme with ...
  • 126k
10 votes

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, ...
  • 44.3k
10 votes

Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?

Perhaps "Plaintext Recovery Attacks against SSH" qualifies? Some readers might wonder at this point how we would be able to attack a variant of SSH that was already proven secure in [1]. ...
9 votes

Can someone randomly guess the key to AES 256 bit encryption?

There are $2^{256}$ different AES keys, the chance that you hit the one right one on first try is thus $2^{-256}=\frac1{2^{256}}$. To put this into perspective, here's a list of events that is ...
  • 44.8k
9 votes
Accepted

What is a multi-target attack?

A multi-target attack is an attack on many users of a cryptosystem at once. The attacker might be satisfied with breaking one user—for example, if there are a thousand human rights activists in a ...
9 votes

Examples of Weak Cryptography being exploited in the wild by cybercriminals?

An example that literally made the headlines in France in March 2000 involves factorization of the 321-bit RSA modulus that was a safeguard to the security of most debit/credit cards issued by French ...
  • 126k
9 votes

Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?

Perhaps we can count the first international standard on digital signature, ISO/IEC 9796:1991, which specified RSA and Rabin signature using a redundant padding of the message to sign. Security was ...
  • 126k
8 votes
Accepted

Understanding Twist Security with respect to short Weierstrass curves

The twist attack is best explained in Fouque et al's paper. While the (quadratic) twist of the curve $E : y^2 = x^3 + ax + b \in \mathbb{F}_p$ is indeed of the form $E^t : y^2 = x^3 + d^2ax + d^3b \in ...
  • 11.9k
8 votes

Which attacks are possible against raw/textbook NTRU encryption?

Without a well-designed padding system it may be possible to craft a ciphertext that the decryptor may or may not be able to decrypt properly. Whether the decryptor is able to do so will depend on the ...
  • 134k

Only top scored, non community-wiki answers of a minimum length are eligible