phong1337 / Cryptanalysis

This is my personal (big) recopilation about cryptanalysis, crypto tools and challenges

Cryptanalysis recopilation

This is a big recopilation of cryptanalysis tools/books/papers and crypto challenges/solutions (CTFs). I'm planning to update it periodically. If you know some good information in this direction please ping me ;)

Crypto challenges & write-ups (CTFs)

• CryptOMG is a configurable CTF style test bed that highlights common flaws in cryptographic implementations -https://github.com/SpiderLabs/CryptOMG

• ASIS CTF Finals 2018 - https://github.com/VoidHack/write-ups/tree/master/ASIS%20CTF%20Finals%202018/crypto/Ariogen

• Aero CTF 2019 pycryptor v2 writeup - https://github.com/VoidHack/write-ups/tree/master/Aero%20CTF%202019/crypto

• Timisoara CTF - https://github.com/VoidHack/write-ups/tree/master/Timisoara%20CTF/crypto/SSS%20Part%202

• VolgaCTF 2018 Quals - https://github.com/VoidHack/write-ups/tree/master/VolgaCTF%202018%20Quals/crypto

• Web-based CTF challenge that demonstrates cryptographic weakness. https://github.com/HackUCF/seedme

• CTF Writeup (Crypto) https://github.com/maojui/CTF_WriteUp

• Kudelski Security's 2018 pre-Black Hat crypto challenge https://github.com/kudelskisecurity/cryptochallenge18

• picoCTF-2018-Writeups/Cryptography/ https://github.com/d4rkvaibhav/picoCTF-2018-Writeups/tree/master/Cryptography

• Writeups about several challenges from CTFs: https://github.com/ashutosh1206/Crypto-CTF-Writeups/tree/master/2018

• Writeups about several challenges from CTFs: https://github.com/ashutosh1206/Crypto-CTF-Writeups/tree/master/2017

• The cryptopals crypto challenges - https://cryptopals.com/

• https://github.com/AntonKueltz/cryptopals

• https://potatopla.net/crypto/

• https://www.cryptoclub.org/

• http://hkopp.github.io/2019/08/writeup-crypto-ctf

• https://cryp.toc.tf/

• https://github.com/ValarDragon/CTF-Crypto

• https://github.com/sonickun/ctf-crypto-writeups

• CTF write-ups written by me. Mostly crypto! (2020, 2019...) - https://github.com/pcw109550/write-up

• https://github.com/JoelGMSec/Cloudtopolis

Cryptanalysis tool

• RSA primes numbers /RSA/CTFs https://github.com/ihebski/factordb

• https://sourceforge.net/projects/msieve/

• https://code.google.com/archive/p/hash-identifier/source

• Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS https://github.com/nonce-disrespect/nonce-disrespect

• PkCrack - Breaking PkZip-encryption https://www.unix-ag.uni-kl.de/~conrad/krypto/pkcrack.html

• A portable, padding oracle exploit API https://github.com/mwielgoszewski/python-paddingoracle

• CRC RevEng: arbitrary-precision CRC calculator and algorithm finder http://reveng.sourceforge.net/

• This tool can decipher captured SSH sessions where one of the two ends uses a vulnerable OpenSSL (debian OpenSSL PRNG vuln). https://github.com/jjyg/ssh_decoder

• Transparent SSL/TLS interception https://github.com/droe/sslsplit

• A tool to analyze multi-byte xor cipher https://github.com/hellman/xortool

• YAFU (with assistance from other free software) uses the most powerful modern algorithms (and implementations of them) to factor input integers in a completely automated way. Most algorithm implementations are multi-threaded, allowing YAFU to fully utilize multi- or many-core processors (including SNFS, GNFS, SIQS, and ECM). https://sourceforge.net/projects/yafu/

• cribdrag - an interactive crib dragging tool for cryptanalysis on ciphertext generated with reused or predictable stream cipher keys https://github.com/SpiderLabs/cribdrag

• https://www.win.tue.nl/hashclash/

• A tool for predicting the output of random number generators https://github.com/ALSchwalm/foresight

• An automated, modular cryptanalysis tool; i.e., a Weapon of Math Destruction https://github.com/nccgroup/featherduster

• hashkill password recovery tool http://www.gat3way.eu/hashkill

• A tool to exploit the hash length extension attack in various hashing algorithms https://github.com/bwall/HashPump

• A tool to exploit the hash length extension attack in various hashing algorithms https://github.com/mheistermann/HashPump-partialhash

• RSA attack tool (mainly for ctf) - retreive private key from weak public key and/or uncipher data https://github.com/Ganapati/RsaCtfTool

• rsatool can be used to calculate RSA and RSA-CRT parameters https://github.com/ius/rsatool

• http://cado-nfs.gforge.inria.fr/

• http://factordb.com/

• http://rumkin.com/tools/cipher/

• https://crypto.interactive-maths.com/frequency-analysis-breaking-the-code.html

• http://www.fourmilab.ch/random/

• The Python Cryptography Toolkit https://www.dlitz.net/software/pycrypto/ https://gchq.github.io/CyberChef/

• https://github.com/Deadlyelder/Tools-for-Cryptanalysis

• http://ganzua.sourceforge.net/en/index.html

• https://www.cryptool.org/de/

• Cracks SSL PEM files that hold encrypted private keys. Brute forces or dictionary cracks. This code is extraordinarily slow, DON'T JUDGE ME!!! https://github.com/robertdavidgraham/pemcrack

• https://github.com/Deadlyelder/Tools-for-Cryptanalysis

• https://github.com/ashutosh1206/Crypton

• https://github.com/google/wycheproof

• https://github.com/vikasnkumar/wisecracker

• https://github.com/hkscy/Basic-SPN-cryptanalysis

• https://github.com/FlameOfIgnis/CtfCryptoTool

• https://github.com/mindcrypt/cracking

Cryptanalysis Books

• https://www.nsa.gov/news-features/declassified-documents/military-cryptanalysis/

TLS/SSL - HTTP/s attacks

• Seguridad en el protocolo SSL-TLS. Ataques criptoanaliticos modernos. https://github.com/mindcrypt/libros/blob/master/Book.%20Seguridad%20en%20el%20protocolo%20SSL-TLS.%20Ataques%20criptoanaliticos%20modernos.%20Dr.%20Alfonso%20Mu%C3%B1oz%20-%2027092020.pdf

• SSL/TLS and PKI History. A comprehensive history of the most important events that shaped the SSL/TLS and PKI ecosystem https://www.feistyduck.com/ssl-tls-and-pki-history/

• https://en.wikipedia.org/wiki/CRIME

• https://en.wikipedia.org/wiki/BREACH

• https://en.wikipedia.org/wiki/Heartbleed

• Revisiting SSL/TLS Implementations: New Bleichenbacher Side Channels and Attacks https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-meyer.pdf

• The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations https://eprint.iacr.org/2018/1173

• https://en.wikipedia.org/wiki/POODLE

• https://en.wikipedia.org/wiki/FREAK

• https://mitls.org/pages/attacks/SMACK

• logjam - https://weakdh.org/

• https://www.mitls.org/pages/attacks/SLOTH

• https://drownattack.com/

• https://sweet32.info/

• https://en.wikipedia.org/wiki/ROCA_vulnerability

• https://en.wikipedia.org/wiki/Coppersmith%27s_attack

• https://robotattack.org/

Papers & links

• https://github.com/prajithrg/Accoustic_Cryptanalysis
• https://github.com/mmeh/simon-speck-cryptanalysis
• https://en.wikipedia.org/wiki/Cryptanalysis
• https://en.wikipedia.org/wiki/Boomerang_attack
• https://en.wikipedia.org/wiki/Brute-force_attack
• https://en.wikipedia.org/wiki/Davies_attack
• https://en.wikipedia.org/wiki/Differential_cryptanalysis
• https://en.wikipedia.org/wiki/Impossible_differential_cryptanalysis
• https://en.wikipedia.org/wiki/Integral_cryptanalysis
• https://en.wikipedia.org/wiki/Linear_cryptanalysis
• https://en.wikipedia.org/wiki/Meet-in-the-middle_attack
• https://en.wikipedia.org/wiki/Mod_n_cryptanalysis
• https://en.wikipedia.org/wiki/Related-key_attack
• https://en.wikipedia.org/wiki/Slide_attack
• https://en.wikipedia.org/wiki/XSL_attack
• https://en.wikipedia.org/wiki/Black-bag_cryptanalysis
• https://en.wikipedia.org/wiki/Man-in-the-middle_attack
• https://en.wikipedia.org/wiki/Power_analysis
• https://en.wikipedia.org/wiki/Replay_attack
• https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis
• https://en.wikipedia.org/wiki/Timing_attack