Category
17 articles in this category.
Elliptic curve security does not come from the size of the field. It comes from one number: the largest prime factor of the group order. When that order is smooth, Pohlig-Hellman splits the discrete log into tiny subgroups and solves it in a flash. This guide runs the real attack on a toy curve and recovers the private key.
13 min read
RSA is unbreakable only when its primes are chosen well. If two keys share a prime, one GCD factors both in microseconds, and if a prime p has a smooth p-1, Pollard's method factors it without any search. This guide runs both real attacks against real 1024-bit keys and recovers the private keys.
11 min read
A server that only tells you whether decrypted padding was valid hands you the whole plaintext. This guide runs the real CBC padding-oracle attack against full AES-128, recovers a secret message one byte at a time, and explains why POODLE and Lucky 13 made authenticated encryption the rule.
16 min read
Encrypting with DES twice looks like it should double the key to 112 bits. A meet-in-the-middle attack shows it barely adds one bit of real security, which is why 3DES uses three passes. Learn the attack with runnable Python against real DES.
12 min read
Using a plain hash as a MAC, with tag = H(secret || message), is a classic mistake. A length-extension attack appends your own data and forges a valid tag without ever knowing the secret. Learn the attack on SHA-256, with runnable Python, and why HMAC exists.
11 min read
DSA and ECDSA stake everything on a secret random nonce that must never repeat. Sign two messages with the same nonce and the private key drops out with a little algebra. This guide runs the real attack against real DSA and secp256k1, the same flaw that broke the PS3 and drained Bitcoin wallets.
12 min read
Every TEA key has three twins that encrypt identically, because flipping the top bits of two key words cancels in the round function. That one-bit quirk shrank TEA's key to 126 bits and let hackers forge a hash to break the original Xbox. This guide runs the real thing against real TEA.
12 min read
WEP bolted RC4 onto a 3-byte IV sent in the clear, and that choice was fatal. The Fluhrer-Mantin-Shamir attack recovers the shared key from the first byte of thousands of weak-IV packets. This guide runs the real attack against real RC4 and recovers the key byte by byte.
14 min read
DES never fell to clever math. It fell to a loop: try a key, encrypt a known block, compare, repeat. This post runs that exact loop against real DES, the same one EFF's Deep Crack ran over all 2⁵⁶ keys in 1998.
18 min read
Every hash function is vulnerable to a generic birthday attack. MD5 is vulnerable to something worse: a real, structural flaw that produces full 128-bit collisions far faster than any generic attack should allow. Both are demonstrated here, live and verified.
16 min read
RC4's second keystream byte is zero twice as often as it should be. Encrypt the same secret enough times, under any keys at all, and that one flaw hands the secret's second byte straight to anyone watching the ciphertexts.
12 min read
Diffie-Hellman's security rests on the discrete logarithm problem being hard. For a small prime, it isn't. Baby-step giant-step trades a brute-force search of size p for one of roughly √p, and that's the whole reason real DH needs huge safe primes.
11 min read
ElGamal's private key is just another discrete logarithm. The same baby-step giant-step technique that breaks Diffie-Hellman over a small prime recovers ElGamal's private key too, and from there decrypts any captured ciphertext directly.
11 min read
A low public exponent like e=3 is efficient and, by itself, still safe. Broadcast the same message to three recipients using e=3 with no padding, and the Chinese Remainder Theorem recovers it with no private key at all.
10 min read
Sharing one RSA modulus across multiple key pairs looks like a harmless shortcut: skip prime generation, reuse n. If the same message ever gets encrypted under two of those keys, no private key is needed to read it back.
13 min read
RSA's security assumes factoring n back into p and q is infeasible. That assumption quietly breaks if the key generator picks p and q too close together. Fermat's 1643 factoring method recovers them both in seconds.
13 min read
Small private exponents make RSA decryption and signing faster. Michael Wiener showed in 1990 that a d small enough to help performance is also small enough to recover from the public key alone, via continued fractions.
12 min read
