A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.

learn more… | top users | synonyms (1)

-1
votes
0answers
21 views

What is the right key of the encrypted text [on hold]

what is the message of Bob? or what is the algorithm used for the substitution function? If Bob responded to Alice's message. The clear message was in the form of a text that was encrypted using an ...
-2
votes
0answers
26 views

block cipher secure as ind - cpa

if we have the following block cipher found here http://imagebin.ca/v/2WGa2kAGEX3E, is it ind - cpa secure?
1
vote
1answer
31 views

Why Boneh-Franklin BasicIdent IBE is not chosen-ciphertext secure? Why use random oracle?

I don't know why BasicIdent is not chosen-ciphertext secure. If there are anybody who knows well, please explain it to me with example. Moreover, I don't know random oracle and its usage for security ...
3
votes
0answers
48 views

LR-Oracle Experiment in Lindell and Katz

In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme $\pi = (Gen,Enc_K,Dec_K)$ is CPA secure for ...
6
votes
1answer
104 views

What is the difference between RCCA and CCA2?

Well, I know it's easy to tell CCA1 from CCA2, but I failed to find the difference between RCCA and CCA2. What is the difference?
1
vote
0answers
32 views

What do you mean by Ciphertext indistinguishability [duplicate]

Wiki definition : A cryptosystem is considered secure in terms of indistinguishability if no adversary, given an encryption of a message randomly chosen from a two-element message space ...
2
votes
0answers
33 views

How do I prove that a bit by bit PKE scheme (that is IND-CPA secure) for an n-bit message is not IND-CCA-2 secure?

Gen generates Pk and Sk (l bits each), Enc encrypts m (length l) but by bit using each bit of Pk respectively, Dec decrypts ciphertext bit by bit using each bit of Sk respectively. How do I prove this ...
2
votes
1answer
144 views

Confused about how chosen ciphertext attacks work?

When performing a CCA, the adversary gets the public key. At some point, he will send a message m to the challenger, and the challenger will send back either $E_{pk}(m)$ or $E_{pk}(r)$, where r is ...
2
votes
1answer
96 views

Cracking a hash which descends to a single value after repeated hashes

Assume I have a hash function (such as the one below) and a cipher, and I know that if I repeatedly hash any string over and over again, it will eventually descend to one unique value. Is there any ...
2
votes
1answer
215 views

Given a linear block-cipher,how can an attacker decrypt any plaintext value encrypted,using 128 chosen ciphertexts

Given the linear block cipher $\operatorname{LinearCipher}(k, p) = c$ $$\operatorname{LinearCipher}(k, p_1 \oplus p_2) = \operatorname{LinearCipher}(k, p_1) \oplus \operatorname{LinearCipher}(k, ...
4
votes
1answer
74 views

Creating own ciphertext after a padding oracle attack?

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired? ...
4
votes
1answer
192 views

How can a Encrypt-And-MAC scheme be insecure if the encryption is CCA secure?

I was presented with this seemingly paradoxical information, and am hoping someone can explain what I'm missing here. I have an encrypt-and-mac scheme here.If I want to transmit message m to Bob, I'd ...
3
votes
1answer
63 views

Fixed-points in block ciphers; why don't they indicate a vulnerability?

I've seen a few questions here on fixed-points in ciphers, most asking about the possibility and existence. Most of the answers however pointed out that fixed points are not exactly a security threat. ...
4
votes
2answers
84 views

Chosen plain text and chosen ciphertext definitions clarification

I am trying to understand a concept of CPA and CCA attack and I cannot get one thing from the definition. If an attacker can execute a CPA attack for something like Send 100 dollars to attacker that ...
8
votes
1answer
110 views

Can RSA be securely used for “blind decryption”?

Assume we have the following setup: A client with trusted storage and computing capabilities (e.g. a smartcard) A server with trusted computing and short-term storage capabilities (e.g. RAM + CPU, ...
4
votes
2answers
63 views

Is there a partially homomorphic quantum secure public key cryptosystem with IND-CCA1 security?

I recentely asked "IND-CCA1 RSA padding?" about whether there is a IND-CCA1 secure variant of RSA. The original version of the question also allowed usage of ECC which would allow usage of ElGamal, ...
3
votes
0answers
41 views

IND-CCA1 RSA padding?

I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property. I'm restricted to RSA (any padding; for hardware ...
0
votes
1answer
46 views

Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?

After the introduction of McBits, I was interested what security notions are neccessary for IND-CCA2 security of integrated encryption schemes (IES, following the key encapsulation mechanism / data ...
5
votes
3answers
310 views

What are the practical implications of ciphertext distinguishability?

Commonly there are four ways to "break" a secrecy-focused cryptosystem: Recover the secret key Recover the message Distinguish an encryption from random noise Distinguish the encryption of two ...
1
vote
0answers
38 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key encryption material / data encryption material) which is used for example by the (famous) ECIES, where the key is the hash of some ...
2
votes
1answer
95 views

Is ElGamal IND-CCA1?

We all know that textbook ElGamal falls due to chosen ciphertext attacks, because of its multiplicative homomorphic property ($E(A)*E(B)=E(AB)$). However these attacks require the ciphertext ($E(A)$ ...
4
votes
2answers
385 views

ElGamal against chosen ciphertext attacks

In Hoffstein, Pipher, and Silverman's book An Introduction to Mathematical Cryptography, the authors make the following remark: An attack in which Eve has access to an oracle that decrypts ...
7
votes
1answer
421 views

Easy explanation of “IND-” security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
7
votes
1answer
155 views

Secret key and Decryption oracle in the revised Fujisaki-Okamoto transformation

Recently, Fujisaki and Okamoto provided a revised version of the Fujisaki-Okamoto transformation [1], a generic transformation for achieving IND-CCA2 security in the Random Oracle model. This new ...
3
votes
1answer
58 views

What is the right notion of security to use for file encryption?

It seems that several file encryption systems do NOT use authenticated encryption. (E.g. gpg --symmetric and boxcryptor as far as I can determine). I understand that this is generally considered ...
2
votes
1answer
41 views

Does failure of indistinguishability of encryptions imply lack of CPA-security?

Suppose we have an encryption scheme that fails the indistinguishability of encryptions test. That is, given messages $m_0, m_1$ and a ciphertext $c_b = Enc_k(m_b)$, where $b \in \{0, 1\}$, the ...
1
vote
1answer
62 views

CCA secure or not?

Let $F : \{0,1\}^n \times \{0,1\}^n \rightarrow \{0,1\}^n $ be a PRF. And let the encryption function be $Enc{_k}(m) = r || (F{_k}(m) \bigoplus r \bigoplus 0^n)$ , where r's value is random. Is this ...
3
votes
1answer
83 views

How to make PKCS conformation oracle for trying Bleichenbacher’s RSA attack?

I was trying to understand Bleichenbacher’s CCA attack and thought of work it out in python. Can some one throw some light on the the logic behind the oracle used to check PKCS conformation? Will a ...
3
votes
1answer
129 views

Secure ElGamal with OAEP

Is it possible to make ElGamal IND-CCA2 using OAEP or OAEP+? (OAEP+ from: "OAEP Reconsiderd" by Shoup) The reason I ask is that I recently answered this question and it came to my mind that OAEP or ...
1
vote
1answer
79 views

CCA-attack is possible in RSA, but how the decryption key $d$ is known to anyone

CCA-attack is possible in text-book RSA, but how the decryption key $d$ is known to anyone, as it is kept secret with receiver.
1
vote
1answer
117 views

Definition of ciphertext security

If I got it right, chosen ciphertext security implies also CPA security. In other words, attacker can submit plaintexts to the challenger (along with ciphertexts). I do not understand why ...
3
votes
1answer
233 views

Definition of the Decryption oracle

In the context of public-key encryption, what would be a formal definition of the decryption oracle? I know the informal definition (i.e., a function that is available to the adversary and that ...
6
votes
2answers
537 views

How does cryptanalysis of the Playfair cipher work?

I have a set of Playfair-enciphered data that I'm trying to crack without the key. I know I need to analyse bigrams; I've currently worked out what decrypts to th, ...
3
votes
2answers
2k views

Chosen plaintext vs Chosen ciphertext

What is the difference between chosen plaintext and chosen ciphertext attack? In both of these adversary has access to paintext-ciphertext pairs.Then where lies the difference?
1
vote
1answer
276 views

Secure double encryption using CPA and CCA

Do you mind if you give me any hints, links or ideas about how to improve the security of double regular encryption and decryption, by using CPA game and CCA game, it sounds interesting question, and ...
1
vote
1answer
90 views

What is the difference between IND-CCA2 and NM-CCA2? And how does one imply another? [closed]

Is there any proof that shows the equivalence of these two?
1
vote
0answers
117 views

CCA security of a system that splits messages and encrypts each packet

Propose a symmetric key based crypto-system for implementing a secure email system. This system is based on AES and CCA secure. Suppose that you have to encrypt a large message and that this message ...
2
votes
0answers
75 views

IND-CCA2 secure schemes without Plaintext Awareness?

I have been reading up on IND-CCA2 security and was wondering: Are there efficient IND-CCA2 secure schemes that do not require plaintext awareness? I'm guessing yes - could someone point me to these ...
3
votes
2answers
1k views

Chosen plaintext attack on textbook RSA decryption

Let $(n,d)$ be an RSA private key and $(n,e)$ the corresponding public key. Generate a secret random $r$ from $(\mathbb{Z}/n\mathbb{Z})^*$ Compute $C’ = C (r^e) \bmod n$ Submit $C’$ as a chosen ...
3
votes
1answer
464 views

RSA Blind Signature Attack

In Information Security Class I learned a non-adaptive chosen ciphertext attack using "blinding" but I just can't follow the proof and therefore can't reconstruct it. From what I've found out, it ...
7
votes
1answer
109 views

The REACT transform and Replayable CCA

Before stating my questions, let us recall the REACT transform [OP01], which enables to construct a CCA-secure hybrid PKE scheme, $\varepsilon'_{pk}$, from an OW-CPA PKE scheme ...
3
votes
2answers
492 views

Does CCA security imply authenticated encryption?

Does CCA security imply authenticated encryption?
5
votes
1answer
452 views

Can a homomorphic encryption scheme be made CCA2 Secure?

Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure? From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 ...
2
votes
1answer
178 views

Chosen Ciphertext Attack with a theoretical decryption machine

Say we have an encryption algorithm that encrypts data blocks of 128 bits size, and makes them cipher blocks $C = E(P)$ without chaining. Also assume there is a linearity rule for XOR: For every pair ...
2
votes
1answer
86 views

Do Chosen-Chiphertext attacks only apply to public-key cryptosystems?

Do Chosen-Chiphertext attacks (CCA-1/2) only apply to public-key Cryptosystem?
6
votes
1answer
362 views

Why do we encrypt-then mac but sign-then-encrypt?

This question was asked in comments on my answer to should we sign then encrypt or encrypt then sign. I think posing the question as a separate entity is best, so: The general advice for applying ...
3
votes
1answer
240 views

Security proof of FO(Fujisaki-Okamoto) hybrid encryption

The proof of FO hybrid encryption is hard to understand. $\:$ Especially, how does the challenger respond to the decryption queries when the challenger can only have some encryption queries? Can ...
1
vote
1answer
280 views

Semantic Security Active or Passive attacks?

I'm reading A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack and here define Semantic Security ... Semantic security, dened by Goldwasser and Micali ...
6
votes
1answer
4k views

The difference between these 4 breaking Cipher techniques?

I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ...
1
vote
1answer
98 views

Is OCB with short MAC malleable?

At the beginning of OCB's white paper [pdf], OCB is compared to other modes, and non-malleability is one of the properties advertised. At the end of the paper, it is mentioned the MAC length can be ...