What cryptographic algorithms succumb to kleptographic attacks?
Kleptographic attacks have been devised for factoring-based key generation algorithms [YY96b]. These attacks leak the private key securely and subliminally through the public key itself. This can potentially affect any implementation of RSA, Rabin, Goldwasser-Micali, Paillier, and so on. Kleptographic attacks have been devised for key exchanges [YY97b]. They have been devised for digital signature algorithms as well. These include ElGamal, Schnorr, DSA, Pointcheval-Stern, and others. There is a general way to attack any cryptosystem that displays a modular exponentiation in its output when the exponent is chosen randomly [YY97c,Yo02]. Kleptographic attacks also work against elliptic curve cryptosystems. A more comprehensive listing of the work in this area is given in [YY04].
