Hot answers tagged

11 votes

Stuck on a cryptanalytical research project

The fact that your attack only works when you're using "normal math" and not "cryptographical math" (by which I assume you probably mean modular arithmetic, or perhaps arithmetic ...
Ilmari Karonen's user avatar
11 votes
Accepted

Is it insecure to sign the value 0 with ElGamal?

Is it insecure to sign the plaintext 0 with ElGamal signature algorithm? It is insecure to verify the plaintext that hashes to 0 with the ElGamal signature algorithm, because anyone can generate such ...
poncho's user avatar
  • 146k
4 votes
Accepted

Bit flipping attack in hash function for message authentication

I believe a counter example could be derived as follows: Suppose that your encryption scheme is a one-time pad, then you have $E(K, M) = K \oplus M$. In your scheme, the output is $(M, E(K, H(M))) = (...
Sacha Servan-Schreiber's user avatar
4 votes
Accepted

Leaking key when adding small order point

You're correct. Guess and check subtraction works, alternatively you can multiply by 8 then 1/8 to get back the original point minus the small order component and subtract. (note:for cofactor=8) ...
Richard Thiessen's user avatar
4 votes
Accepted

Is this new bound for Wiener Attack well accepted?

Is this $\frac 1{\sqrt[4]{18}}N^\frac1 4$ bound well accepted in the cryptanalysis research community? I see no reason why there would be a doubt. However, the exact bound for Wiener's attack is not ...
fgrieu's user avatar
  • 140k
3 votes

how 0/n split prevent BEAST attack against TLS?

Well, in TLS 1.0 and a CBC mode ciphersuite, the IV for the next record would always be the last ciphertext block for the previous record. That is, the first encrypted block of each record would be: $...
poncho's user avatar
  • 146k
3 votes

Use of PRNG's vulnerability for attacking a cryptographic system

a PRNG which fails some of NIST tests (FFT, ApproximateEntropy and Serial) Assuming other tests pass, that fact taken in isolation has no practical consequence for most applications, which really are ...
fgrieu's user avatar
  • 140k
2 votes

Crack RSA with $e$ and $d$?

Since this is a CTF, I won't give quite a full solution, just try to unstuck the OP (who seemingly made significant progress). We are given $e$ and $d$. They must match $e\,d\equiv1\pmod{\operatorname{...
fgrieu's user avatar
  • 140k
2 votes

Stuck on a cryptanalytical research project

There is already a good answer. In addition, if you think actual cryptosystems used today are at risk but you believe "clock arithmetic" works makes me think actual (public key) ...
kodlu's user avatar
  • 21.9k
2 votes
Accepted

The second moment and fourth moment of $\mathcal{P}(V)$?

It's instructive to look at the proof of Lemma 1 where $\mathbf v$ is rewritten $\mathbf u=\mathbf xV$ where $\mathbf x$ is a uniform sample from $[-1,1]^n$. Thus $$\mathbb E(\langle \mathbf u,\mathbf ...
Daniel S's user avatar
  • 22.8k
2 votes
Accepted

CTF - DES Challenge

You seem to have gotten pretty far. Here are my musings. spoiler: some keys can be weak ...
J_H's user avatar
  • 262
2 votes
Accepted

RSA Oracle - CTF

Let $n$ be the derived modulus, $ct$ be the encrypted flag and $m$ the plaintext flag. You can derive $n$ using the method described here: Determine RSA modulus from encryption oracle You might want ...
limeeattack's user avatar
2 votes

A question about "attacks on MAC key space"

I read carefully this chapter but I still cannot understand this idea. Well, we assume that there is 1 correct key and $2^t - 1$ incorrect keys. When we test a key, the correct key will verify. We ...
poncho's user avatar
  • 146k
2 votes

A RSA crypto CTF chanllenge with known private key ,cipher text and modules factor n

I need to recover p and q so that i can complete this Challenge. There is a slight complication; we can recover $p$ and know that $q$ is one of three values, but we don't know which one it is. In any ...
poncho's user avatar
  • 146k
2 votes

"crandall" - unsolved CTF challenge - ASIS-quals-2023

That sounds like a fun challenge. Let us look at what this code snippet is doing. While it hasn't found a prime number p, it will go from $i = 512$ to $i = 256$ and ...
Lery's user avatar
  • 7,649
1 vote

What does it mean the "Distinguisher" in LWE decision version?

what does it mean the distinguisher in LWE problem in which the secret key changes constantly for each ciphertext and plaintext pair? this isn't true, so if you have a particular source that is ...
Mark's user avatar
  • 12.4k
1 vote

Breaking a 'Many' - Time Pad

Who says that there is a repeated word? It seems more logical that the ciphertexts lines themselves are using a repeated key stream. Appending the lines is not a good idea, put them in a list instead. ...
Maarten Bodewes's user avatar
  • 92.3k
1 vote
Accepted

"crandall" - unsolved CTF challenge - ASIS-quals-2023

update: author said coppersmith bound overlooked for 3 vs 2 primes so it's probably unsolvable
akonzu's user avatar
  • 57
1 vote

Nonce reuse in GMAC without ciphertext (only AAD)

However, I'm wondering if the same risks are present if an adversary has access to: Ciphertext and corresponding MAC of one message Small amount of plaintexts and MACs of different messages If there ...
poncho's user avatar
  • 146k
1 vote

A question about "attacks on MAC key space"

Firstly I thank to Poncho for your kind reply. But now I have a guess like this (maybe it is not author's intention): At first I think a number of keys corresponding to a number of outputs is the ...
hellobc's user avatar
  • 11
1 vote

CTF - AES Padding Oracle

I wonder if u solve this problem or not, I can obtain my script to u, just replace some minor part to make sure this script can work properly to solve your problem. If you'd like to know how this ...
sbk6401's user avatar
  • 11
1 vote

Best practices on implementing a password manager

Similar to bit warden, the AES/CBC 256 with PKCS7 padding and shared master password with Argon2 ID KDF is used to encrypt the whole DB, each password and TOTP secrets, all with randomly generated ...
1 vote
Accepted

Double Ratchet Algorithm: Active Man in the Middle Attack without Root-Key or Ratchet-Key

At double ratchet, if an attacker has compromised a message key, it is going to be able to calculate the next message keys until the next diffie hellman ratchet step. Look at the KDF(key derivation ...
Richard Thiessen's user avatar
1 vote

Cost of attacking textbook RSA signature of $b$-bit hash of the message

To run the Desmedt and Odlyzko attack you need a set of signatures whose hashes have prime factorisations are supported on a set of primes with fewer set elements than the number of signatures. For a ...
Daniel S's user avatar
  • 22.8k
1 vote
Accepted

In textbook RSA with low public exponent, how big does a random message needs to be?

For $e$ of moderate size (say $e=17$), Coppersmith's theorem makes it possible to go significantly beyond message size $n/e$. Take for example a message $M$ of size $m=160$ bits and a modulus of $n=...
Mehdi Tibouchi's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible