What's that property called when a scheme is secure even if you encrypt the decryption key? Some schemes have problems when your plaintext is the decryption key (or just the key if symmetric).
1 Answer
$\begingroup$
$\endgroup$
0
It is called circular security. It is problematic because it is not captured by the usual security definitions. I.e., even if an encryption scheme is proven secure by some regular definition, it is usually not a given to be circular secure.
To see why consider, for example, the usual definition of semantic security for a public-key encryption scheme $\Pi = (Gen, Enc, Dec)$: We say that $\Pi$ is semantically secure if all adversaries $A$ has at most negligible advantage (in security parameter $\lambda$) in the following security game:
- We sample $(pk, sk) \leftarrow Gen(1^\lambda)$, and send $pk$ to $A$ (here $pk$ is the public key and $sk$ the secret decryption key).
- $A$ outputs messages $m_0$ and $m_1$.
- We sample $b \leftarrow \{0,1\}$ (a random bit), and send $c \leftarrow Enc(pk,m_b)$ to $A$.
- $A$ outputs a bit $b'$ and wins if $b = b'$.
The problem here is that this only talks about security for some messages $m_0$ and $m_1$ that $A$ can pick. However, since $A$ does not know $sk$ there is negligible probability that she will pick $sk$ as a message (in fact if $A$ could pick $sk$ with non negligible probability the scheme would not be secure!). So using this definition we cannot say much about the circular security of the scheme.
