Category Archives: CTFs

Blinding Attack on RSA Digital Signatures

This blog primarily focuses on Blinding Attack- an elementary vulnerability in RSA cryptosystem used to forge Digital Signatures. The working and properties of Digital Signatures will be described before directly jumping onto the attack. In the end, we discuss ways to prevent this attack.

Digital Signature using RSA

RSA is a kind of “Trapdoor One-way Function“. Wikipedia describes a one-way function as a function that is easy to compute on every input, but hard to invert given the image of a random input. Here, “easy” and “hard” are to be understood in the sense of computational complexity theory, specifically the theory of polynomial time problems. A trapdoor one-way function can only be inverted with the help of a “trapdoor” i.e. our ‘d’, the private key in public key encryption. This method has been used in Digital Transactions and authentication of electronic data.

Let ‘N‘ be the modulus, ‘e‘ be the public key and ‘d‘ be the private key.

The relation between the three is as follows:

ed \equiv 1 mod N -> 1

Digital Signature is used for authentication of electronic data. Let Alice and Bob be two generic parties wishing to communicate with each other and Marvin be the eavesdropper, trying to tamper the data transfer between the two parties. The scenario here is as follows: Alice is trying to get signature of Bob over a message ‘M\in Z*N. To get a signature Alice sends the message ‘M‘ where Bob signs the message M as follows:

S = Md mod N -> 2

Here S becomes the signature of the message M. In the above step, Bob applies his private key to the message and obtains a signature S. Bob then sends this S to Alice or any other authentic party which needs the signature of Bob on M. Since public key of Bob, as the name suggests, is known to the parties, the signature can be easily verified if it is generated from Bob or not by simply calculating

Se = M mod N -> 3

We have used two simple properties, 1 and 2 to arrive at 3. Only Bob has his private key and so the parties can conclude that the signature is authenticate and legible. In the next session we discuss some vulnerabilities in the above method.

Blinding Attack

Consider the same scenario here, except for the fact that this time Marvin wants the signature of Bob over a message M which Bob refuses, being no fool knowing the significance of Digital Signature. So instead of the signature on M, Marvin asks for the signature of “innocent looking”  M’ which is calculated as following:

M’ = reM mod N

Bob agrees to sign this message M’. Let S’ be the signature generated in case of M’. We can write S’ as:

S’ = (M’)d mod N

Upon receiving the signature S’, Marvin can then easily forge the signature to get the signature for message M as follows:

Step 1: Se = (S’)e/re

Step 2: (S’)e/re = (M’)ed/re

Step 3: (M’)ed/re \equiv M’/re = M mod N
(from 1, ed \equiv 1 mod N )

Step 4: Se = M mod N

Here r is any random integer in the same interval as M. The term re mod N is known as blinding factor.

So without actually getting the signature on M, Marvin could successfully manipulate the signature S’ to gain the signature of M i.e. S. This technique allows an attacker to get signature on a message of his choice without the consent of the one who is signing it.

The question which arises now is, what could be the possible measures to prevent such attacks? If you closely look at the way Blinding Attack is implemented, you will get the catch in Step #3. If the signatory signs the Hash of the message M instead of signing the message itself, all the four steps in the attack would make no sense since M’ would then be replaced by H(M’) (The hash function) and hence it cannot be divided by blinding factor to get back M. Another advantage of using hash of the message instead of using the message is that a cryptographic hash can take an arbitrarily long message, and ‘compress’ it into a short string, in such a way that we cannot find two messages that hash to the same value. Hence, signing the hash is just as good as signing the original message, without the length restrictions we would have if we didn’t use a hash. This overcomes the size problem in RSA operation where the key has to be very large in order to sign smaller messages!

 

Resource

[1] https://crypto.stanford.edu/~dabo/papers/RSA-survey.pdf

Advertisements

RC3 CTF Writeup – Salad(Crypto 100)

Being a part of bi0s, this was the first time I was able to decode a cipher while the CTF was still going on and the feeling was amazing! I feel extremely lucky to be a part of bi0s with such great seniors who are experienced exploit experts and mentor like Vipin Sir!

Its been more than a month I have joined bi0s, and I am pretty sure that Cryptography will the field I am going to focus upon in Computer Science for the rest of my life, I mean for my Masters and if possible then PhD. My blog from now will primarily focus upon the new ideas that emerge in the field of Cryptography, along with the topics which I learn.

Of Course, I won’t stop writing critical thoughts and ideas of mine!

The question stated:

Salad

Category: Cryptography              Points: 100

Description:

“The fault, dear Brutus, is not in our stars, but in ourselves.” (I.ii.141) Julius Caesar in William Shakespeare’s Julius Caesar

Cipher Text: 7sj-ighm-742q3w4t

At the first glance, the question looks like one encoded with Caesar(Shift) cipher but it is kinda not so. It involves applying Substitution cipher along with Caesar to get the flag.

So here we go,

Since each flag in the CTF had to start with RC3-2016, it struck me at a point of time if even the encoded message contains RC3-2016, but in encoded form! This forced me to find a relation between the letters and the digits using the first 7 encoded digits and RC3-2016. The pattern that I could make out was this:

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
KLMNOPQRSTUVWXYZ0123456789ABCDEFGHIJ 

7sj-ighm-742q3w4t
RC3-2016-ROMANGOD

Here is the flag: RC3-2016-ROMANGOD

Looking forward to exploring and solving more questions in Cryptography!