56

First, you do not break RSA through brute force. RSA is an asymmetric encryption algorithm, with a public/private key pair. The public key has a strong internal structure, and unravelling it yields access to the private key (basically, the main component of the public key is the modulus, which is a big composite integer, and the private key is equivalent to ...


11

The problem is a very old one going back at least as far as the late 1940's early 1950's and has been shown to exist with Quantum Key Exchange as well. You need to think of it in terms of entropy down to heat pollution where a coherent signal energy steps down due to inefficiency via various transducers to what is basically thermal noise where the noise ...


8

One potential issue with GCM is that it can potentially make the problems you get from repeating nonces worse; instead of allowing you to forge, and revealing the plaintext for the packets with the repeated nonces, it can become a key recovery issue. Here's one way it can happen; suppose the AAD is the 128 bit key, and you repeat the nonce with three ...


7

In my own knowledge, encrypted data can't be decrypted without knowing the key, but BitLocker breaks it. That description indicates you might have misunderstood something there. Bitlocker does not break anything* as Microsoft BitLocker uses recovery keys (read again: “keys”), not code! The related code for recovery is pretty similar to the usual decryption ...


7

In ECDSA, each signature has its own ephemeral key $k$. If $k$ is generated properly, then no amount of signatures will help you recover the private key. "Proper" generation here means either random uniform selection in the proper range, or an appropriate derandomization process such as the one described in RFC 6979. If the very same $k$ value is used in ...


6

Start by reading the paper. They have an entire section on defences: it is Section 11, Mitigation, pp.46-48. As far as software countermeasures for RSA specifically, they mention blinding as a good defence. Blinding is a standard defence against many kinds of side-channel attacks, and it is apparently effective against acoustic cryptanalysis as well. ...


6

Suppose you have two message-signature pairs, $(m_1, s_1), (m_2, s_2)$, where $s_i = m_i^d \bmod n$. Suppose we also know the public exponent $e$—it is usually $65537$, $3$, $5$, $17$, or some similar small integer. Then we know that $m_i = s_i^e \bmod n$, or in other words $s_i^e = k_in + m_i$ and it follows that $\gcd(s_1^e - m_1, s_2^e - m_2) = \gcd(k_1, ...


6

First of all, you cannot uniquely determine the keyword of a Playfair cipher, or even the key table constructed from it, simply because there are multiple equivalent key tables that will produce the same ciphertext (and multiple keywords that will produce each table). In particular, the following key tables are all equivalent: Original: Row shift: ...


6

RSA as initialy described (R.L. Rivest, A. Shamir, and L. Adleman, A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, in CACM, 1978) has this property that it is impossible to find the public key $(N,e)$ from the private key expressed as $(N,d)$. For modern parameters, pick random primes $p$ and $q$ in range $[2^{2047.5},2^{2048}]$, pick ...


5

As a concrete example of a recent discussion where a similar question was considered, the IRTF draft for AES-GCM-SIV was at one point revised because of possible attacks on protocols that (unjustifiably) assume that their AAD is confidential: The major change in this update is the use of nonce-specific POLYVAL keys. Previous versions of GCM-SIV did not do ...


5

I think the realistic answer is that we don't know if it's dangerous. In cryptography, anything we don't know the security properties of needs to be treated by default as if it's insecure. To my knowledge, GCM (and similarly HMAC) haven't been extensively analyzed from the perspective of having the key included as the message, either in whole or in part. ...


5

Does the length of the public key imply the length of the private key, or can they be unrelated? Yes. The sizes of public and private keys depend on the cryptosystem. Usually they are related somehow, but not necessarily. For example, you can store a short value as a private key, which is then used as a PRNG seed to generate the private key used in the ...


5

"Invertibility of the cryptographic primitive" is just a fancy way of saying "you can decrypt things encrypted with that key." All the first sentence means is "if you can recover the key, you can decrypt anything encrypted with that key." As the second sentence points out, there are conceivably attacks where you can decrypt things encrypted with a key but ...


5

You can usually derive two public keys. However, sometimes (very rarely), you can get four public keys. With some details: There is an elliptic curve. In Bitcoin, this is secp256k1. Each curve point has two coordinates $(X,Y)$; the coordinates are integers modulo a given prime integer $p$ (precisely, $p = 2^{256} - 4294968273$). The curve order (number of ...


5

What you describe is Chosen-Plaintext Attack (CPA) and AES and secure block ciphers are designed to be secure against this. Having $2^{16}$ chosen-plaintext under one key doesn't help you to extract the AES key. You have to go to the full-brute force to find the key. Since you have one target, you cannot get help from attacking many keys simultaneously. ...


4

There are two papers on conventional differential cryptanalysis of SEED. The last one penetrates only half of the cipher. Even though there are few third-party cryptanalysis papers, there is no indication that the cipher is weak. Fault attacks are quite irrelevant in the SSL setting. I would be more concerned with BEAST-like attacks, as SEED is a blockcipher,...


4

A fault injection attack is based on the fact that you have a healthy black box on which you can do queries, but you can mess with the black box, for example flipping random bits. In real life this could for example be a RFID chip which can be messed with using strong electronic fields. Attacks like these are generally: Very sophisticated in theory and ...


4

So, let me recall a few details about ECDSA: An ECDSA signature is a pair of integers $(r,s)$. In order to generate a signature for a given message $m$, a given hash function $H$, curve parameters $(\mathcal{C}, G, n)$ for $\mathcal{C}$ a curve, $G$ a base point of prime order $n$ of $\mathcal{C}$, a private key integer $d$ and a public key point $Q = d\...


3

So lets take a look at this in hex: 626B3A C6AAF309F16C41A755679810A2732D9D 00000000000000000000000000000000 10270000 EBDB5836 This is bk: in ASCII, then 16 bytes of ciphertext, followed by an all zero IV, then a iteration count in hexadecimals : 10,000 (0x2710 in little endian), followed by what I presume is a 4 byte checksum or key check value. So from ...


3

No, not unless the input for the key small enough to be brute forced or guessed. For any secure block cipher the key cannot be retrieved even if you have the input (block of plaintext) and output (block of ciphertext). And there are no known attacks on Blowfish that break the cipher significantly. So it really doesn't matter how the block cipher is used. ...


3

Let's presume the attackers are fully aware of how this information is being encrypted. The attackers know that (in your example) the plaintext is being encrypted with Enigma and then with RSA. When attempting a bruteforce attack, they will first test a key against the RSA encryption. At this point, the attackers can check whether the output data makes ...


3

In modern cryptography attackers are considered that are allowed to change the ciphertext. It's because of this fact, that the decryption always either outputs an error or the correct decryption. So you can verify your key guess by observing that the authenticated decryption succeeds. This is especially true for RSA(-OAEP) which must have this sort of ...


3

Usually, you have one important key (the master key). This can be your private bitcoin key, your password database key, the drive encryption key, or really whatever. Normally you encrypt this key, because you want to change it as infrequently as possible and encrypt it using some user input (e.g. a password) because of costly re-setups of the system. You ...


3

Within the modern concept of cryptographic security of symmetric cipher, resistance to key-recovery under CCA and CPA is a must, because for most of modern encrypted communication, plaintext is almost always partially guessable alongside ciphertext. Here, CCA and CPA are two general attack models (I'm simplifying): CCA: attacker can ask for decryption ...


2

As the others have stated in their answers, the answer to this interesting question is basically: Known Plaintext. Basically, the attacker must know some of the properties of the plaintext beforehand to decide if his decryption yielded a plausible result. The assumption that only ASCII letters are found in the plaintext already is knowledge about the ...


2

You suggest combining two encryption methods. In principle, either an attacker can figure out how to effectively split your encryption into two independent parts that can be cracked independently, or they can't. An infamous case is the encryption used for encyrpting DVDs: It's a 40 bit encryption, but it could be split into one 16-bit encryption, plus one 25-...


2

but how do they do to know that they got the right key since the text itself is encrypted with Enigma and has no word contained in the dictionary ? They usually don't. Of course you could combine several encryption algorithms in a way that you could find out if you cracked one level of encryption, like by adding a checksum which is only valid if the ...


2

There is a straightforward brute force method. For example, take the lowest $8$ bits of everything and check for valid values of $K_1$ and $K_2$, mod $2^8$. You will need about $2^{16}$ checks to get the lower $8$ bits of $K_1$ and $K_2$. Proceed then to values mod $2^{16}$, as you know the lower $8$ bits of $K_1$ and $K_2$, only bits $8\dots15$ of these ...


2

it simply tells a user to "calculate $y^*$", a calculation which itself appears to require several unknown values Nope, it has $y^* = y / g^V$, where at this point, you know $y$, $g$ and $V$. The original discrete log problem was given as $y = g^x$, and so you were given $y$ and $g$ In addition, $V = x \bmod z$, where $z$ is a smooth factor of $n$ (the ...


2

Let's start by explaining how Playfair works normally to encrypt a message. First, you create a 5x5 table by writing the keyword letter-by-letter across the top of the table, from left to right, skipping duplicate letters; you then fill in the remaining characters in alphabetical order after the keyword (combining i&j or j&k into a single box). ...


Only top voted, non community-wiki answers of a minimum length are eligible