43
votes
Accepted
How was this 2048 bit number factored so fast?
That number was so quick to factor because its factors are extremely close together, i.e., it factors as $\left(\lfloor\sqrt{n}\rfloor + 70\right)\left(\lfloor\sqrt{n}\rfloor - 68\right)$.
Some ...
- 12.4k
35
votes
Accepted
How can C rand() be exploited if a secure seed is used?
The ISO/IEC 9899:1990 edition of the C standard contains:
EXAMPLE The following functions define a portable implementation of rand and ...
- 138k
33
votes
Accepted
Did a certain cryptography method get abandoned due to security flaws in the past?
You could be thinking about the Merkle-Hellman knapsack cryptosystem. It was invented in 1978 and everything seemed well and good until it was completely broken six years later in 1984 by Shamir - it ...
- 7,438
28
votes
Accepted
How is encryption broken today?
Modern encryption can be broken in practice even when the algorithms are theoretically secure. There are a variety of ways this can happen:
Side channel analysis could have played a part.
The ...
- 19.5k
26
votes
Accepted
Why "1" in 51% attack on Blockchain network
From Bitcoin Wiki;
A majority attack (usually labeled 51% attack or >50% attack) is an attack on the network.
It is also called consensus attacks.
It is only to demonstrate that one needs the ...
- 47.6k
22
votes
Accepted
What does a "real" quantum computer need for cryptanalysis and/or cryptographic attack purposes?
For example: the 5-qubit quantum computer created at MIT by using the technique of ion traps succeeded in prime-factorizing 15. Does that mean that since it succesfully managed that, that it is a all-...
- 336
19
votes
Did a certain cryptography method get abandoned due to security flaws in the past?
This is a shot in the dark, but could you be thinking of the Needham-Schroeder protocol? It was published in 1978 [1], and an attack was published as much as 18 years later, in 1996 [2]. It is not an ...
- 545
18
votes
Did a certain cryptography method get abandoned due to security flaws in the past?
DES has not been mentioned in the previous two answers. Although it was known to be quite weak from very early on it was widely used for a couple of decades at least, until newer algorithms (3DES, AES,...
- 32k
17
votes
Accepted
Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?
One example is OCB2;
Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC by Rogaway. It is standardized in ISO/IEC 19772:2009. The author also provided a proof by ...
- 47.6k
15
votes
Accepted
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.
Can I recover that key?
No. This is what is referred to as a ...
- 488
14
votes
How can C rand() be exploited if a secure seed is used?
I once played this online game, it was an old-school MUD. You log in, chat, kill some goblins.
It had a casino. You go into the casino and you bet X gold, and there was a 40% chance you win double ...
- 241
14
votes
Accepted
What is a multi-target attack?
A multi-target attack is an attack on many users of a cryptosystem at once.
The attacker might be satisfied with breaking one user—for example, if there are a thousand human rights activists in a ...
- 47.9k
13
votes
Is there a downside to encrypting too much data with the same key?
Yes, but the answer is more or less embedded in the question here; you can only say that you encrypt too much data in case the secret key and / or plaintext becomes vulnerable.
Most modes of ...
- 91.7k
12
votes
Accepted
Does blinding work against side channel on RSA?
Blinding protects against some side-channel attacks in RSA: those that target variations in the timing or other side-channel information as a known function of $C$ (or $C^d\bmod n$ should that end up ...
- 138k
12
votes
Accepted
Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password?
Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password?
As usual in password-based cryptography, we'll consider that the password was chosen from ...
- 138k
11
votes
Many time pad attack (XOR)
A character is usually encoded as an ASCII. This means that it uses up one byte. That's a number from $0 - 255$. It can be represented as a hexadecimal $\text{0x00} - \text{0xFF}$. All your operations ...
- 677
11
votes
What are the dangers of using CPU clock drift for generating random data?
A TRNG is never used instead of a CSPRNG. They serve different purposes. A TRNG is used to seed a CSPRNG. A CSPRNG alone isn't enough to generate random data since it's reproducible. A hardware ...
11
votes
Accepted
Is the RSA signature attack from Desmedt and Odlyzko practical?
TL;DR: Yes, on narrow or some ad-hoc deterministic RSA padding, which must not be used.
The Desmedt and Odlyzko attack on RSA signatures [DO1985] assumes a deterministic RSA signature scheme with ...
- 138k
11
votes
Accepted
What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?
"Constant-time" is about not leaking information through timing-based side-channels. If you assume that there is no side-channel, then, in particular, there is no side-channel attack. It is ...
- 86.6k
11
votes
How does the ROCA attack work?
In the ROCA paper the authors define an integer $M$ (which they call a primorial) as follows:
$$M = \prod_{i=1}^{n} P_i = 2 * 3 * ... * P_n$$
Said another way, $M$ is the product of the first $n$ ...
- 4,012
11
votes
Accepted
Is it insecure to sign the value 0 with ElGamal?
Is it insecure to sign the plaintext 0 with ElGamal signature algorithm?
It is insecure to verify the plaintext that hashes to 0 with the ElGamal signature algorithm, because anyone can generate such ...
- 145k
11
votes
Stuck on a cryptanalytical research project
The fact that your attack only works when you're using "normal math" and not "cryptographical math" (by which I assume you probably mean modular arithmetic, or perhaps arithmetic ...
- 45.9k
10
votes
ECDSA key recovery - floating point values
This is not correct, the private key $d_A$ must always be an integer. Your mistake is that you are doing modular division e.g. $\frac{a}{b} \text{ mod } n$ incorrectly. You cannot simply divide the ...
- 4,012
10
votes
Can someone randomly guess the key to AES 256 bit encryption?
There are $2^{256}$ different AES keys, the chance that you hit the one right one on first try is thus $2^{-256}=\frac1{2^{256}}$.
To put this into perspective, here's a list of events that is ...
- 45.7k
10
votes
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, ...
- 47.6k
10
votes
Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?
Perhaps "Plaintext Recovery Attacks against SSH" qualifies?
Some readers might wonder at this point how we would be able to attack a variant of SSH that was already proven secure in [1]. ...
9
votes
Accepted
What is the malicious potential of a key-substitution-attack?
As is, the attack seems rather pointless. But one malicious potential is that because $\bar y$ allows to successfully verify a genuine message $(m,s)$, the verifier might grow trust in it and use $\...
- 138k
9
votes
Examples of Weak Cryptography being exploited in the wild by cybercriminals?
An example that literally made the headlines in France in March 2000 involves factorization of the 321-bit RSA modulus that was a safeguard to the security of most debit/credit cards issued by French ...
- 138k
9
votes
Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?
Perhaps we can count the first international standard on digital signature, ISO/IEC 9796:1991, which specified RSA and Rabin signature using a redundant padding of the message to sign. Security was ...
- 138k
8
votes
Which attacks are possible against raw/textbook NTRU encryption?
Without a well-designed padding system it may be possible to craft a ciphertext that the decryptor may or may not be able to decrypt properly. Whether the decryptor is able to do so will depend on the ...
- 145k
Only top scored, non community-wiki answers of a minimum length are eligible