Matasano Crypto Challenges

Go solutions to the Matasano Crypto Challenges (http://cryptopals.com/). Solutions to the previous challenges are written in Erlang and can be found here.

Set 4: Stream crypto and randomness

30. Break an MD4 keyed MAC using length extension (problem, solution, test)
31. Implement and break HMAC-SHA1 with an artificial timing leak (problem, solution, test)
32. Break HMAC-SHA1 with a slightly less artificial timing leak (problem, solution, test)

Set 5: Diffie-Hellman and friends

33. Implement Diffie-Hellman (problem, solution, test)
34. Implement a MITM key-fixing attack on Diffie-Hellman with parameter injection (problem, solution, test)
35. Implement DH with negotiated groups, and break with malicious "g" parameters (problem, solution, test)
36. Implement Secure Remote Password (SRP) (problem, solution, test)
37. Break SRP with a zero key (problem, solution, test)
38. Offline dictionary attack on simplified SRP (problem, solution, test)
39. Implement RSA (problem, solution, test)
40. Implement an E=3 RSA Broadcast attack (problem, solution, test)

Set 6: RSA and DSA

41. Implement unpadded message recovery oracle (problem, solution, test)
42. Bleichenbacher's e=3 RSA Attack (problem, solution, test)
43. DSA key recovery from nonce (problem, solution, test)
44. DSA nonce recovery from repeated nonce (problem, solution, test)
45. DSA parameter tampering (problem, solution, test)
46. RSA parity oracle (problem, solution, test)
47. Bleichenbacher's PKCS 1.5 Padding Oracle (Simple Case) (problem, solution, test)
48. Bleichenbacher's PKCS 1.5 Padding Oracle (Complete Case) (problem, solution, test)

Set 7: Hashes

49. CBC-MAC Message Forgery (problem, solution, test)
50. Hashing with CBC-MAC (problem, solution, test)
51. Compression Ratio Side-Channel Attacks (problem, solution, test)

Set 8: Abstract Algebra

57. Diffie-Hellman Revisited: Small Subgroup Confinement (problem)
58. Pollard's Method for Catching Kangaroos (problem)
59. Elliptic Curve Diffie-Hellman and Invalid-Curve Attacks (problem)
60. Single-Coordinate Ladders and Insecure Twists (problem)
61. Duplicate-Signature Key Selection in ECDSA (and RSA) (problem)
62. Key-Recovery Attacks on ECDSA with Biased Nonces (problem)
63. Key-Recovery Attacks on GCM with Repeated Nonces (problem)
64. Key-Recovery Attacks on GCM with a Truncated MAC (problem)
65. Truncated-MAC GCM Revisited: Improving the Key-Recovery Attack via Ciphertext Length Extension (problem)
66. Exploiting Implementation Errors in Diffie-Hellman (problem)

Useful links

1. Bleichenbacher's RSA signature forgery based on implementation error (challenge 42)
2. The Debian PGP disaster that almost was (challenge 43)
3. DSA requirements for random k value (challenge 44)
4. Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1 (challenges 47 and 48)
5. Why I hate CBC-MAC (challenge 49)
6. The CRIME attack (challenge 51)