Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a case where it may be possible for an adversary to deduce the plaintext inputs that went into creating a AES-128-GCM encrypted message (there is good IV diversity across the encrypted messages, however) This opens up the potential to expose a GCM "oracle" to the adversary who may additionally be able to adaptively modify the inputs to the encryption function and observe the GCM encrypted outputs. I'm thinking about adding a random string of bytes of some fixed length to each encrypted message in order to prevent this (since an attacker would no be able to guess the random bytes that were appended and would therefore not know the full plaintext for a corresponding ciphertext). Some questions: 1) Can someone provide a "rule of thumb" around how much randomness should be appended to each message of a given length. 2) Does one need to take particular care around how the random byes are added an removed from the message 3) Are there any other methods one can employ in order to avoid exposing the encryption "oracle" described above?

share|improve this question
up vote 3 down vote accepted

GCM is authenticated encryption. As such, it is secure against chosen-plaintext attacks and against chosen-ciphertext attacks. Thus, there is no problem whatsoever with the adversary having access to an encryption oracle. It will not help it at all to break any of the encrypted messages.

share|improve this answer
    
A couple of questions: (1) Is it safe to assume that its OK to provide an encryption oracle to a CPA adversary so long as the encryption scheme $\pi$ has the property that for multiple encryptions $Pr[PrivK^{LR cpa}_{\mathcal{A},\pi}(n)=1]≤1/2+negl(n)$ (in the notation of Lindell and Katz),i.e, its safe to provide an oracle so long as the scheme is CPA secure for multiple encryptions, (2)If not, what is the exact definition that tells me when it's secure to expose an encryption oracle to a CPA adversary (3)for a CPA secure scheme, adding authentication additionally provides CCA security ? – Rohit Khera Jan 27 at 0:56
    
Yes, it's OK to expose an encryption oracle in this case. I wouldn't provide it freely if it's not a natural by-product of the application, but there's no reason to prevent it. – Yehuda Lindell Jan 27 at 13:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.