The chosen-ciphertext-attack tag has no wiki summary.
-4
votes
1answer
99 views
Indistinguishability CPA and CCA2
I am study security notions in two lecture and I am cofusing with the concepts IND-CCA and IND-CPA2. About IND-CCA in wikipedia say
Indistinguishability under chosen ciphertext attack/adaptive chosen
...
4
votes
1answer
102 views
Does Linear Cramer-Shoup have pseudo-random ciphertexts?
"Linear Cramer-Shoup" is defined on pages 4 and 5 of $\:$ eprint.iacr.org/2007/074.pdf .
Are the ciphertexts in Linear Cramer-Shoup computationally indistinguishable from uniform
under a ...
2
votes
2answers
249 views
AES-CTR vulnerability to cryptographic oracle
I am new to cryptographic issues and from what I googled so far I could not retrieve the information I need.
Consider the use of AES-128 in CTR mode.
Let M be the set of possible plaintexts, for ...
2
votes
2answers
96 views
Security model for privacy-preserving aggregation scheme.
Suppose that $S=(E,D)$ is an additively homomorphic encryption scheme. Now I want to design a protocol $P$ such that given inputs $x_1,x_2,..,x_n$, the adversary $A$ (who can decrypt) can only learn ...
1
vote
1answer
69 views
Comparing plaintext to contents of ciphertext
Given an authenticated mode of encryption, when comparing a plaintext string against the contents of a ciphertext, which approach is typically considered safer?
Encrypt the plaintext and compare ...
4
votes
2answers
1k views
How does a padding oracle attack work?
I am unsure of how a padding oracle attack works.
What I am not getting is how changing one bit at one time allows one to exploit(get keys) ASP.NET machines.
Can anyone explain this?
4
votes
1answer
954 views
Common modulus attack on RSA when the 2 public exponents differ by a single bit
This is an exam question an i have no idea how to recover the message m.
John wants to send an encrypted message to mary who has a pair of RSA keys, However, John does not know Mary's public key and ...
0
votes
0answers
54 views
cipher text only attack - how to know when to stop when brute-force attack? [duplicate]
Possible Duplicate:
How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
My question is about a cipher text only attack - I have as input only the initialization ...
2
votes
2answers
123 views
Can you help with that definition for a CCA?
The following is a definition taken from Introduction to Modern Cryptography by Katz and Lindell.
I'm having a hard time understanding some basic concepts! Can you please help me?
...
6
votes
2answers
2k views
How does a chosen ciphertext attack work, with a simple example?
Can someone please explain - using a simple example - how a chosen ciphertext attack works?
12
votes
3answers
793 views
Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?
The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes.
Does this mean that an attacker can only see a single ...
4
votes
1answer
168 views
Why isn't the IND-CCA property inherited when sending redundant ciphertext?
Suppose that in order to avoid loss in transmission, a secret key encryption scheme $(Gen, Enc, Dec)$ is modified to be $(Gen, Enc', Dec')$, such that the message m is encrypted independently ...
