9
votes
Accepted
Is including the key as AAD actually dangerous?
One potential issue with GCM is that it can potentially make the problems you get from repeating nonces worse; instead of allowing you to forge, and revealing the plaintext for the packets with the ...
- 150k
8
votes
Recovering private key from Secp256k1 signatures
In ECDSA, each signature has its own ephemeral key $k$. If $k$ is generated properly, then no amount of signatures will help you recover the private key. "Proper" generation here means ...
- 87.7k
7
votes
Accepted
In Bitcoin, given half the 52-character private key in WIF format, is it possible to reconstruct the whole private key?
We must first wonder if the preconditions hold, in particular 1; that is:
In Bitcoin, given half the 52-character private key in WIF format, is it possible to reconstruct the whole private key?
The ...
7
votes
Accepted
Recovery public key from secp256k1 signature and message
You can usually derive two public keys. However, sometimes (very rarely), you can get four public keys.
With some details:
There is an elliptic curve. In Bitcoin, this is secp256k1. Each curve point ...
- 87.7k
6
votes
Accepted
Public-private algorithm where it is not possible to recover public key from private key?
RSA as initialy described (R.L. Rivest, A. Shamir, and L. Adleman, A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, in CACM, 1978) has this property that it is impossible to ...
- 144k
5
votes
Is including the key as AAD actually dangerous?
I think the realistic answer is that we don't know if it's dangerous. In cryptography, anything we don't know the security properties of needs to be treated by default as if it's insecure.
To my ...
- 11.1k
5
votes
Is including the key as AAD actually dangerous?
As a concrete example of a recent discussion where a similar question was considered, the IRTF draft for AES-GCM-SIV was at one point revised because of possible attacks on protocols that (...
- 14.6k
5
votes
Accepted
Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?
What you describe is Chosen-Plaintext Attack (CPA) and AES and secure block ciphers are designed to be secure against this.
Having $2^{16}$ chosen-plaintext under one key doesn't help you to extract ...
- 49.3k
4
votes
Recovering private key from Secp256k1 signatures
So, let me recall a few details about ECDSA:
An ECDSA signature is a pair of integers $(r,s)$.
In order to generate a signature for a given message $m$, a given hash function $H$, curve parameters $(\...
- 7,759
3
votes
Accepted
Partial key recovery from linear equations
Firstly consider the simple case where we know that there is only a simple x-or relation between two key bits. $k_i \oplus k_j = 1$ and $i \neq j$ and call it $R1$. If we consider the x-or table we ...
- 49.3k
3
votes
Accepted
Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)
It is impossible for computationally bounded adversaries
What you are looking for is impossible in modern stream ciphers. If ever one finds to break a stream cipher in this way, you will see in the ...
- 49.3k
3
votes
Accepted
Possible to directly calculate the Recovery ID from a msg, signature and public key in ECDSA/secp256k1?
Unfortunately I don't think that is possible without just testing which one works. That is because $[s]R$ and $[-s](-R)$ are the same curve point, and both $R$ and $-R$ have the same x-coordinate $r$, ...
- 1,583
3
votes
Accepted
Is there any symmetric encryption algorithm cannot guess the key when encryption and decryption value are known?
Within the modern concept of cryptographic security of symmetric cipher, resistance to key-recovery under CCA and CPA is a must, because for most of modern encrypted communication, plaintext is almost ...
- 9,692
3
votes
Accepted
How should I implement a secure recovery of encryption?
Usually, you have one important key (the master key).
This can be your private bitcoin key, your password database key, the drive encryption key, or really whatever.
Normally you encrypt this key, ...
- 46.3k
3
votes
Does this PBKDF2-SHA1 payload hint at a cryptographic security issue?
So lets take a look at this in hex:
626B3A C6AAF309F16C41A755679810A2732D9D 00000000000000000000000000000000 10270000 EBDB5836
This is ...
- 94k
3
votes
Accepted
Recovery of blowfish encryption key?
No, not unless the input for the key small enough to be brute forced or guessed. For any secure block cipher the key cannot be retrieved even if you have the input (block of plaintext) and output (...
- 94k
2
votes
Accepted
ECDSA pubkey recovery issue
The signature validation logic from RFC7091 is effectively:
$$r \stackrel{?}= abs( h^{-1}sP - h^{-1}rQ )$$
where $r, s$ are values from the signature, $h$ is the message hash (converted into an ...
- 150k
2
votes
Accepted
Can high-entropy data be reconstructed from plaintext XORs in CTR nonce reuse?
A block cipher in CTR mode is just a stream cipher. You have a stream of bits that are indistinguishable from random (assuming good things about the block cipher) and you xor that stream with your ...
- 1,894
2
votes
Accepted
How does Authentication-Key Recovery for GCM work?
They so that by taking an authenticated message, and applying a carefully crafted difference to the message, you can ensure half the bits of the authentication tag will be preserved.
You can repeat ...
- 11.9k
2
votes
Accepted
in NTRU, can g be recovered given f and h?
Clearly, equation (5) in your question determines $g$ uniquely up to the possible addition of a multiple of $q$. But $g$ also has the property of having small coefficients (much smaller than $q/2$ in ...
- 2,569
2
votes
Recovering public key with small R parameter
It is error in my recovery procedure, or signing should be bad for nonce which generate small $r$ parameter?
The issue happens because the recovery procedure is a simplified version of the standard ...
- 144k
2
votes
Accepted
Is there any notion of key-recovery attacks security (perhaphs using games) that is equivalent to IND-CPA?
I don't think an equivalence proof can exist, unless you significantly change the key recovery definition. I don't think this is unexpected, since it seems natural that key recovery is harder than ...
- 4,817
1
vote
Accepted
Proof that semantic security implies key-recovery security
This is not correct, because your premise is not correct.
There exist ciphers that are semantically secure, but insecure against the key recovery attack. The natural example is the one-time pad. If ...
- 25.5k
1
vote
Accepted
Proving semantic security implies security from key-recovery attack
I belive that there isn't a way to know how much $\hat{k}$. And even if we did it isn't correct to assume that $Pr[\hat{b}=1|b=0]=\frac{x}{|K|}$.
To handle the analysis when $b=0$ try fixing $c$ and ...
- 76
1
vote
Construction of key recovery attack in O(2^(n/2))
Well, you said that this was a "practice problem"; hence you're supposed to learn from it, so I won't give you the answer.
I will give you a hint: you have $E_k(M) = \Pi(M \oplus K) \oplus K$...
- 150k
1
vote
Is there any practical use of reduced rounds of AES
There is not much use for reduced-round AES as a block cipher per se. AES has been carefully designed to provide appropriate security margins and 20 years of cryptanalysis show that they are just ...
- 632
1
vote
Would a non-envelop, prefix only, SHA2 built MAC be susceptible to key recovery attacks?
None of these constructions will lead to key recovery unless the underlying hash function is spectacularly broken in the sense of preimage resistance, which pretty much none of them are (archived).
...
- 49.2k
1
vote
Accepted
Show that CPA-security implies security against plaintext recovery
Your solution is almost correct. Just don't forget to consider the following two cases: 1) $m_0$ and $m_1$ may be the same, then $A$ will have to guess the secret bit $b$ blindly; 2) $B$ may return ...
- 2,735
1
vote
Can I implement key recovery without compromising security?
Delegating the decryption of encrypted data is exactly what proxy re-encryption (PRE) was designed to allow. In particular, there is a variant called time-based PRE that limits the delegation to a ...
- 444
1
vote
Cryptanalys of "bad" RC4 implementation
This post answers my first questions: RC4 Keystream Reconstruction
Because I integrate others informations to this problem.
The RC4 algorithm has some well-known vulnerabilities but it is not ...
- 39
Only top scored, non community-wiki answers of a minimum length are eligible