CTF Cryptography — Recognize the Weakness, Reach the Attack

cryptoctfsecurityrsa

112 techniques for CTF crypto: given a signal, reach the right attack — with field-tested operational detail and a clear map of what does NOT work. Distilled from real CTF campaign notes, every claim cross-checked against the sources (2,442 checked, 50 refuted and corrected).

• Block Cipher Modes of Operation — the mode carries the CTF vulnerability, not the primitive
• CBC Bit-Flipping — controlled tampering with no oracle needed
• CBC Padding Oracle — leak the intermediate decryption value one byte at a time
• CTR Nonce Reuse — when the counter mode keystream repeats
• DES Weaknesses — recognizing and exploiting a 56-bit Feistel cipher
• Differential Cryptanalysis — chosen-plaintext XOR-difference propagation through S-boxes
• Double Encryption & MITM — composing two keys buys about one extra bit
• ECB Detection & Cut-and-Paste — the identical-block signal and how to weaponize it
• Feistel Structure — the split-and-XOR shape that tells you which attack family applies
• Hill Cipher — a linear block cipher that known-plaintext breaks in one matrix inversion
• Linear Cryptanalysis — known-plaintext linear approximation with a biased key parity bit
• Meet-in-the-Middle Attack — the time-memory tradeoff that breaks composed encryption
• Permutation Cipher — frequencies survive intact, only position is scrambled
• Related-Key Attack — exploiting encryptions under keys with a known relationship
• S-box Analysis — profiling a cipher's S-box to pick the right statistical attack
• Slide Attack — breaking a cipher's key schedule, not its rounds
• Weak Key Classes — when a cipher's own key schedule betrays it
• Affine Cipher — a tiny 312-key space that known-plaintext or brute force both break instantly
• Substitution & Shift Cipher — recovered by letter-frequency, not by algebra
• Vigenere Cipher — Kasiski / Index-of-Coincidence Key-Length Recovery
• DH Composite Modulus — splitting the discrete log by CRT when the modulus isn't prime
• DH Man-in-the-Middle — unauthenticated exchange lets an active attacker relay two separate keys
• DH Parameter Injection — tamper with (p, g) themselves to make the exchange breakable
• DH Small-Subgroup Attack — confining the secret to a tiny subgroup to leak it mod that order
• DH Static-Key Reuse — turning a persistent secret exponent into a leaking oracle
• Diffie-Hellman Fundamentals — what to audit first in any DH challenge
• ElGamal Encryption — when the key is a discrete log, not a factored modulus
• ElGamal Malleability — scaling plaintext by a known factor without the private key
• Key-Exchange Methodology — triage any DH/ECDH challenge before reaching for heavy DLP machinery
• X25519 Basics — recognizing Curve25519 ECDH and where it actually breaks
• Baby-Step Giant-Step — the generic meet-in-the-middle solver for a mid-sized discrete log
• Discrete Logarithm — the factorization of the group order picks your algorithm
• Index Calculus — sub-exponential DLP attack for large prime fields with no smooth structure
• Pohlig-Hellman — solving the discrete log when the group order is smooth
• Elliptic Curve Discrete Logarithm Problem — the curve order's factorization picks your attack
• Elliptic Curve Fundamentals — the audit that routes to the right ECC attack
• Invalid Curve Attack — leaking an ECDH secret through a point nobody checked was on the curve
• Singular Curve Attack — the zero-discriminant signal that collapses ECDLP to a field problem
• Smart Attack — the anomalous-curve signal that turns ECDLP into polynomial time
• Birthday Attack — the square-root speedup that governs any collision search
• CBC-MAC Forgery — splice a new message onto a known tag without the key
• Chosen-Prefix Collision — forcing two attacker-chosen, meaningfully different prefixes to hash equal
• CRC and Polynomial Recovery — forging or reversing a checksum built from GF(2) division
• Fixed-Point Hash — Davies-Meyer no-op blocks that let you insert or expand a message for free
• Hash Collisions and Weak Preimages — truncated tags and broken functions that fall to brute force or known tooling
• Hash Length Extension — forge H(secret‖msg‖extra) from a digest alone
• HMAC Fundamentals — the nested MAC that tells you when to STOP trying length-extension
• MAC Forgery — the construction, not the primitive, decides the attack
• Merkle–Damgård Construction — the digest IS the internal state
• Multicollision Attack — Joux's trick: 2^t colliding messages for the price of t single-block collisions
• Poly1305 Nonce Issues — nonce reuse turns a one-time MAC into a solvable polynomial
• Sponge Construction — why length-extension does NOT work on SHA-3/Keccak
• Hidden Number Problem — recovering a secret from many small-bounded-error samples
• Knapsack Cryptosystem — subset-sum ciphertexts broken by low-density lattice reduction
• Lattice Fundamentals — encoding a bounded unknown as a short vector
• LLL Reduction — the polynomial-time workhorse behind almost every lattice attack
• LWE Fundamentals — recognizing and breaking noisy linear equations mod q
• NTRU Fundamentals — recovering the short (f,g) key pair via lattice reduction
• Regev Encryption — the LWE public-key scheme, and why recovering the secret is game over
• Ring-LWE — recognizing polynomial-ring LWE and reducing it to plain LWE
• Cryptanalysis Methodology — classify the family before you reach for an attack
• Custom Cipher Reverse — read the source, invert every primitive, run the pipeline backwards
• Encoding and Decoding Layers — peel base64/hex/URL/compression first or you attack the wrong plaintext
• Multi-Step Crypto Chain — recognizing and decomposing a pipeline challenge
• Carmichael Numbers & λ(n) — the true group exponent, and why a lone Fermat test lies
• Chinese Remainder Theorem — recombining residues across coprime moduli
• Euler's Totient — the RSA key-math backbone, and why it's not the exponent you want to leak
• Finite Field Arithmetic — the GF(p^k) substrate under AES, LFSRs, and extension-field curves/DLP
• Gaussian Integers — factoring sums of two squares in Z[i]
• Jacobi Symbol — the factoring-free residuosity bit, and why +1 lies on a composite modulus
• Legendre Symbol — the O(log p) yes/no on square-root existence, before you touch Tonelli-Shanks
• Linear Algebra over GF(2) — solving bit-level unknowns as a linear system mod 2
• Polynomial GCD — the Euclidean algorithm on polynomials, and the trick that recovers a shared root
• Primality Testing — confirming a number is prime without factoring it
• Quadratic Residues — deciding if x² ≡ a (mod n) has a solution before you go looking for one
• Smooth Numbers — the concept behind why Pollard p-1, Pohlig-Hellman, and index calculus work (and when they don't)
• Tonelli-Shanks — computing an actual modular square root, not just whether one exists
• RSA Blinding Attack — bypass a signing/decryption oracle's blocklist with the multiplicative homomorphism
• Boneh-Durfee Attack — the lattice extension of Wiener that reaches d < N^0.292
• Common Modulus Attack — same n, two coprime exponents on the same message
• Coppersmith's Method — recovering a small unknown from a modular polynomial via lattice reduction
• Fermat Factorization — recovering p, q when the RSA primes were chosen too close
• Franklin–Reiter Related-Message Attack — recovering RSA plaintexts from a known relation via polynomial GCD
• Håstad's Broadcast Attack — recovering one plaintext from many small-e ciphertexts, no factoring
• Integer Factorization Methodology — which factoring attack to try, in what order
• Partial Key Exposure — recovering RSA when part of p or d has leaked
• Perfect-Power Modulus (n = p^k) — trivial factoring via integer k-th root
• Pollard's p-1 Factorization — when a prime's predecessor is smooth
• Pollard's Rho Factorization — finding a small-to-medium factor when trial division and Fermat fail
• RSA Fundamentals — the routing hub: which artifact points to which attack
• RSA LSB / Parity Oracle Attack — recover the plaintext one bit at a time from a decryption oracle
• RSA Signature Forgery — homomorphic combination and lax padding checks forge signatures without the private key
• Small Public Exponent Attack — recovering m by an exact integer e-th root when m^e never wraps mod n
• Wiener Attack — recovering RSA's private exponent when d is small, via continued fractions
• Cache-Timing Attack — recovering key bytes from which cache line a table lookup touched
• Error / Boolean Oracle Attack — turn any distinguishable valid/invalid response into a key or plaintext
• Fault Injection Attacks — one faulty RSA-CRT signature factors the modulus outright
• Power Analysis (SPA/DPA/CPA) — reading a key off a device's power draw
• Timing Attack — recovering a secret from how long a secret-dependent operation takes
• Deterministic Nonce (RFC 6979) Failures — when 'no more RNG risk' still leaks the key
• DSA Fundamentals — the linear signing equation every DSA attack exploits
• DSA/ECDSA Biased-Nonce Lattice Attack — turning partial nonce leaks into a private-key recovery
• ECDSA Fundamentals — the s*k = h + d*r identity that routes every nonce attack
• ECDSA/DSA Nonce Reuse — identical r collapses the private key to closed-form algebra
• Repeated / Linearly-Related Nonce Recovery — when nonces aren't reused, but ARE related by a known formula
• Signature Malleability — a valid (r,s) becomes another valid (r,s) without the key
• Berlekamp-Massey Algorithm — recover the minimal LFSR from raw keystream
• LFSR State Recovery — when the keystream itself hands you the seed
• One-Time-Pad / Many-Time-Pad Reuse — the crib-drag break when a pad is used twice
• PRNG State Prediction — recovering the internal state of a non-cryptographic generator
• Stream-Cipher Keystream Reuse — the umbrella break behind every reused-keystream challenge
• Repeating-Key XOR — recovering key length and key from a Vigenère-style stream