56
votes
Accepted
How to check that you got the right key when brute forcing an encryption?
First, you do not break RSA through brute force. RSA is an asymmetric encryption algorithm, with a public/private key pair. The public key has a strong internal structure, and unravelling it yields ...
- 86.6k
10
votes
Accepted
How does Microsoft's BitLocker Recovery Code work?
In my own knowledge, encrypted data can't be decrypted without knowing the key, but BitLocker breaks it.
That description indicates you might have misunderstood something there. Bitlocker does not <...
- 17.8k
9
votes
Accepted
Is including the key as AAD actually dangerous?
One potential issue with GCM is that it can potentially make the problems you get from repeating nonces worse; instead of allowing you to forge, and revealing the plaintext for the packets with the ...
- 145k
7
votes
How to find the keyword of the Playfair cipher, given the plaintext and the ciphertext?
First of all, you cannot uniquely determine the keyword of a Playfair cipher, or even the key table constructed from it, simply because there are multiple equivalent key tables that will produce the ...
- 45.9k
7
votes
Recovering private key from Secp256k1 signatures
In ECDSA, each signature has its own ephemeral key $k$. If $k$ is generated properly, then no amount of signatures will help you recover the private key. "Proper" generation here means ...
- 86.6k
7
votes
Accepted
Recovery public key from secp256k1 signature and message
You can usually derive two public keys. However, sometimes (very rarely), you can get four public keys.
With some details:
There is an elliptic curve. In Bitcoin, this is secp256k1. Each curve point ...
- 86.6k
6
votes
Accepted
Public-private algorithm where it is not possible to recover public key from private key?
RSA as initialy described (R.L. Rivest, A. Shamir, and L. Adleman, A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, in CACM, 1978) has this property that it is impossible to ...
- 138k
5
votes
Is including the key as AAD actually dangerous?
I think the realistic answer is that we don't know if it's dangerous. In cryptography, anything we don't know the security properties of needs to be treated by default as if it's insecure.
To my ...
- 11k
5
votes
Is including the key as AAD actually dangerous?
As a concrete example of a recent discussion where a similar question was considered, the IRTF draft for AES-GCM-SIV was at one point revised because of possible attacks on protocols that (...
- 14.4k
5
votes
Understanding ransomware – What makes plain-text-attacks or brute-forcing so hard?
Does the length of the public key imply the length of the private key, or can they be unrelated?
Yes.
The sizes of public and private keys depend on the cryptosystem. Usually they are related ...
- 32k
5
votes
Accepted
Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?
What you describe is Chosen-Plaintext Attack (CPA) and AES and secure block ciphers are designed to be secure against this.
Having $2^{16}$ chosen-plaintext under one key doesn't help you to extract ...
- 47.5k
4
votes
Recovering private key from Secp256k1 signatures
So, let me recall a few details about ECDSA:
An ECDSA signature is a pair of integers $(r,s)$.
In order to generate a signature for a given message $m$, a given hash function $H$, curve parameters $(\...
- 7,609
3
votes
Accepted
Is there any symmetric encryption algorithm cannot guess the key when encryption and decryption value are known?
Within the modern concept of cryptographic security of symmetric cipher, resistance to key-recovery under CCA and CPA is a must, because for most of modern encrypted communication, plaintext is almost ...
- 9,001
3
votes
Does this PBKDF2-SHA1 payload hint at a cryptographic security issue?
So lets take a look at this in hex:
626B3A C6AAF309F16C41A755679810A2732D9D 00000000000000000000000000000000 10270000 EBDB5836
This is ...
- 91.7k
3
votes
Accepted
Recovery of blowfish encryption key?
No, not unless the input for the key small enough to be brute forced or guessed. For any secure block cipher the key cannot be retrieved even if you have the input (block of plaintext) and output (...
- 91.7k
3
votes
How to check that you got the right key when brute forcing an encryption?
Let's presume the attackers are fully aware of how this information is being encrypted. The attackers know that (in your example) the plaintext is being encrypted with Enigma and then with RSA.
When ...
- 348
3
votes
How to check that you got the right key when brute forcing an encryption?
In modern cryptography attackers are considered that are allowed to change the ciphertext. It's because of this fact, that the decryption always either outputs an error or the correct decryption. So ...
- 45.7k
3
votes
Accepted
How should I implement a secure recovery of encryption?
Usually, you have one important key (the master key).
This can be your private bitcoin key, your password database key, the drive encryption key, or really whatever.
Normally you encrypt this key, ...
- 45.7k
3
votes
Accepted
Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)
It is impossible for computationally bounded adversaries
What you are looking for is impossible in modern stream ciphers. If ever one finds to break a stream cipher in this way, you will see in the ...
- 47.5k
3
votes
Accepted
Possible to directly calculate the Recovery ID from a msg, signature and public key in ECDSA/secp256k1?
Unfortunately I don't think that is possible without just testing which one works. That is because $[s]R$ and $[-s](-R)$ are the same curve point, and both $R$ and $-R$ have the same x-coordinate $r$, ...
- 1,573
2
votes
How to check that you got the right key when brute forcing an encryption?
As the others have stated in their answers, the answer to this interesting question is basically: Known Plaintext.
Basically, the attacker must know some of the properties of the plaintext ...
- 302
2
votes
How to check that you got the right key when brute forcing an encryption?
You suggest combining two encryption methods. In principle, either an attacker can figure out how to effectively split your encryption into two independent parts that can be cracked independently, or ...
- 1,108
2
votes
How to check that you got the right key when brute forcing an encryption?
but how do they do to know that they got the right key since the text itself is encrypted with Enigma and has no word contained in the dictionary ?
They usually don't.
Of course you could combine ...
- 1,538
2
votes
How to find the keyword of the Playfair cipher, given the plaintext and the ciphertext?
Let's start by explaining how Playfair works normally to encrypt a message.
First, you create a 5x5 table by writing the keyword letter-by-letter across the top of the table, from left to right, ...
- 3,718
2
votes
Accepted
Using Pollard's lambda in a key-recovery attack on DH
it simply tells a user to "calculate $y^*$", a calculation which itself appears to require several unknown values
Nope, it has $y^* = y / g^V$, where at this point, you know $y$, $g$ and $V$.
The ...
- 145k
2
votes
Accepted
ECDSA pubkey recovery issue
The signature validation logic from RFC7091 is effectively:
$$r \stackrel{?}= abs( h^{-1}sP - h^{-1}rQ )$$
where $r, s$ are values from the signature, $h$ is the message hash (converted into an ...
- 145k
2
votes
Accepted
Can high-entropy data be reconstructed from plaintext XORs in CTR nonce reuse?
A block cipher in CTR mode is just a stream cipher. You have a stream of bits that are indistinguishable from random (assuming good things about the block cipher) and you xor that stream with your ...
- 1,864
2
votes
Accepted
Partial key recovery from linear equations
Firstly consider the simple case where we know that there is only a simple x-or relation between two key bits. $k_i \oplus k_j = 1$ and $i \neq j$ and call it $R1$. If we consider the x-or table we ...
- 47.5k
2
votes
Recovering public key with small R parameter
It is error in my recovery procedure, or signing should be bad for nonce which generate small $r$ parameter?
The issue happens because the recovery procedure is a simplified version of the standard ...
- 138k
2
votes
Accepted
How does Authentication-Key Recovery for GCM work?
They so that by taking an authenticated message, and applying a carefully crafted difference to the message, you can ensure half the bits of the authentication tag will be preserved.
You can repeat ...
- 11.7k
Only top scored, non community-wiki answers of a minimum length are eligible