« first day (2293 days earlier)      last day (2378 days later) » 

defalt
defalt
11:01 AM
32
Q: How does a nonce reset allow for decryption?

Fynn MazurkiewiczI'm sure that by now most InfoSec-lovers have heard about KRACK. If you haven't, check out this great explaination by a fellow StackExchanger. It's a new attack on WPA2 which allows for decryption and forging of packets in certain (and certainly quite a lot of them) scenarios by abusing a flaw...

wifi vulnerability wpa2 nonce krack
 
defalt
defalt
11:24 AM
Can anyone answer this question mathematically?
 
SEJPM
SEJPM
12:11 PM
@defalt nonce reset = nonce reuse = same keystreams = 2-time pad attack
1
Q: How to attack the Two Time Pad?

yammI encrypt 2 random keys with the same 'one' time pad. You can get both encrypted keys. You don't know anything besides the size. Is there a way to attack the two time pad in this scenario? And what if I would encrypt 1000 random keys. is there a way to attack the 'one' time pad? PS. I have rea...

one-time-pad
 
defalt
defalt
12:44 PM
@SEJPM Does this answer also answer that question mathematically?
4
A: Can I use AES CTR mode to encrypt files with same key and nonce?

PolynomialYou must not do this. AES in CTR mode turns it into a stream cipher, such that AES is turned into a cryptographic pseudorandom number generator (PRNG) which generates a sequence of pseudorandom bits to be used as a keystream. This output keystream is simply xor'ed with the plaintext stream to pr...

 
SEJPM
SEJPM
@defalt yes
@defalt the linked crypto.se answers are also quite good
 
defalt
defalt
@SEJPM But still the attacker only gets M1 ⊕ M2. What else he can calculate from M1 ⊕ M2?
 
SEJPM
SEJPM
@defalt if he knows or can guess either he can recover the other
f.ex. if M1 is some standard HTTP header
or if eg you can force specific traffic for M1
 
defalt
defalt
Is it possible to calculate Keystream K using this C1 = M1 ⊕ K provided now attacker knows both C1 and M1?
 
SEJPM
SEJPM
@defalt yes, K=M1 ⊕ C1
 
defalt
defalt
12:59 PM
so that's how KRACK exploit is decrypting the traffic without ever knowing the TEMPORAL ENCRYPTION KEY of WPA2 CCMP..Decrypting messages in this way looks slow because guessing either message not always works
 
SEJPM
SEJPM
@defalt well yes, it's not super effective but if you know enough about traffic there's a decent amount of data that you can recover
 
defalt
defalt
In this video by that founder, i don't think he was following the above method to decipher the encrypted traffic
 
SEJPM
SEJPM
1:18 PM
@defalt linux and android have a more severe version of the bug that resets the key to all-zero meaning you can fully predict the stream (IIRC)
 
defalt
defalt
Key(TEK) ⊕ CTR = Keystream..does it reset that key(TEK) also along with the counter(CTR)?
 
SEJPM
SEJPM
@defalt As I haven't actually read the paper, I'm not 100% sure, I suggest you read the paper for all the details :)
 
defalt
defalt
@SEJPM yeah i should have done it earlier..thanks for sharing your time..I'm going to explain about this attack in my next seminar
 
SEJPM
SEJPM
@defalt good luck, have fun :)
 
Evinda
Evinda
1:54 PM
Hey @SEJPM
I am reading about the algorithm that computes the Jacobi symbol and I have a question.
I have a question about the part: if gcd(a,n)>1, this is detected by b becoming 0 at some point , while $c \geq 3$.
Whenever b=0, we have that $gcd(b,c)=c \geq 3$ and thus $gcd(a,n) \geq 3 \Rightarrow gcd(a,n)>1$. But given any $a$ such that $(a,n)>1$ does it follow that b=0? @SEJPM
 
 
1 hour later…
SEJPM
SEJPM
3:01 PM
@Evinda I'm sorry, I was debugging something else and totally forgot about your question
 
Evinda
Evinda
A ok.. no problem :) @SEJPM
 
SEJPM
SEJPM
@Evinda if $\gcd(a,n)>1$, then $b$ will hit 0 sooner or later
this is mainly due to line 10
 
Evinda
Evinda
How can we prove it? Because I don't see why b will get 0 :/ @SEJPM
 
SEJPM
SEJPM
@Evinda for starters, let's simplify the algorithm by removing all steps that use s
and don't change b
now consider b<c
(which always holds)
you then essentially eliminate all powers of 2 from b
in each iteration
and then you compute c mod b
if we didn't have the previous steps inside the while loop, this would be the euclidean algorithm to computing the gcd
Euclidean algorithm
In mathematics, the Euclidean algorithm, or Euclid's algorithm, is an efficient method for computing the greatest common divisor (GCD) of two numbers, the largest number that divides both of them without leaving a remainder. It is named after the ancient Greek mathematician Euclid, who first described it in Euclid's Elements (c. 300 BC). It is an example of an algorithm, a step-by-step procedure for performing a calculation according to well-defined rules, and is one of the oldest algorithms in common use. It can be used to reduce fractions to their simplest form, and is a part of many other number...
which will terminate if one of the variables is 0
now if we have gcd=1, the algorithm will just jump out in line 8 before getting b=0
also note that at the end of the loop the old b (which is now odd) gets the new c
so c will always be odd
and if b is even, then gcd(b,c)=gcd(b/2,c) if c is odd
@Evinda I hope this answers your question :)
 
Evinda
Evinda
3:37 PM
@SEJPM you mean that we have b=1 if gcd(b,c)=1? if so, why?
 
Evinda
Evinda
4:21 PM
You mean that if gcd(b,c)=1 then at some iteration the line 8 is executed and otherwise if gcd(b,c)>1 then because of the line 8 at some iteration b will get equal to 0? If so, why is it like that? I haven't understood it? @SEJPM
 
 
2 hours later…
SEJPM
SEJPM
6:09 PM
@Evinda if b<c then gcd(b,c)=gcd(b,c-b)=gcd(b,c mod b)
so at some point you get gcd(a,n)=gcd(b,c)=...=gcd(0,k)
if k=1 then line 8 kicks in in the previous iteration
(because then you'd compute c mod 1 and line 8 catches that)
 
Evinda
Evinda
6:23 PM
at the given algorithm, the gcd does not appear, does it? So if gcd(b,c)>1 then c mod b will get 0 at some iteration? @SEJPM
 
SEJPM
SEJPM
@Evinda it implicitely / as a by-product computes the gcd and yes to your second question
 
Evinda
Evinda
@SEJPM could you maybe explain to me how we see this that when gcd(b,c)>1 that c mod b will get the value 0?
 
SEJPM
SEJPM
@Evinda then at some stage c will be a multiple of b
so c mod b = 0
 
Evinda
Evinda
Why will c be a multiple of b at some iteration? @SEJPM
 
SEJPM
SEJPM
6:39 PM
@Evinda because if you strip the additional steps, you essentially get down to a gcd algorithm
which will either find b=1 at some point (if a and n are co-prime)
or find b=0 (if they're not)
 
Evinda
Evinda
7:01 PM
@SEJPM By picking $a=5 \cdot 7 \cdot 13 \cdot 19$ and $b=13 \cdot 53 \cdot 59$, I found that we get that b=0.
 
Evinda
Evinda
7:16 PM
I think that I got... I will think about it again. Thank you :) @SEJPM
 
SEJPM
SEJPM
7:29 PM
:)
 

« first day (2293 days earlier)      last day (2378 days later) »