The attacker can specify his own plain text and encrypt or sign it.
1
vote
1answer
76 views
How much data can I encrypt with AES before I need to change the key in CBC mode?
In my cryptography class, the instructor suggested that in order to give the attacker a minimal advantage of $1/2^{32}$, we have to change the key after $2^{48}$ blocks are encrypted.
It seems that ...
-3
votes
0answers
38 views
DES chosen-plaintext attack in Windows [closed]
How do I do a DES chosen-plaintext attack in Windows?
-4
votes
1answer
99 views
Indistinguishability CPA and CCA2
I am study security notions in two lecture and I am cofusing with the concepts IND-CCA and IND-CPA2. About IND-CCA in wikipedia say
Indistinguishability under chosen ciphertext attack/adaptive chosen
...
-1
votes
1answer
103 views
Chosen Plaintext Attacks
Assuming the ability to launch Chosen Plaintext Attacks (CPA), how many oracle calls an attacker
needs to break the affine cipher? and how
2
votes
2answers
136 views
Which categories of cipher are semantically secure under a chosen-plaintext attack?
I am trying to get my head around the circumstances under which a cipher is (or is not) semantically secure under a chosen-plaintext attack.
I can't seem to find a good reference explaining this.
I ...
2
votes
2answers
95 views
Security model for privacy-preserving aggregation scheme.
Suppose that $S=(E,D)$ is an additively homomorphic encryption scheme. Now I want to design a protocol $P$ such that given inputs $x_1,x_2,..,x_n$, the adversary $A$ (who can decrypt) can only learn ...
-1
votes
2answers
129 views
Is the AES encryption scheme CPA secure?
Give a 256 bit key space and 128 message space would AES block cipher as the encryption scheme be CPA secure?
1
vote
0answers
42 views
IND-CPA security scheme [duplicate]
Possible Duplicate:
CPA Secure Chosen plaintext scheme
The example for IND-CPA secure schemes given is generally:
for a random r,
$Enc_k(m) =(r|| E_k(r)$ $XOR$ $m)$ where $E$ is a $PRF$
...
1
vote
2answers
205 views
Why is an Encrypt-and-MAC scheme with deterministic MAC not IND-CPA secure?
I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. It's the task from two-years ago exam. At the bottom I reminded one definition.
Let $(Gen_E,Enc,Dec)$ be an ...
2
votes
2answers
126 views
How to construct a variable length IND-CPA cipher from a fixed length one?
Suppose we can construct a secure (IND-CPA) encryption scheme for fixed length messages. I was wondering if there is a natural way to extend this construction for messages of variable length such that ...
3
votes
1answer
413 views
Figuring out key in hill cipher (chosen-plaintext attack)
I have been wondering what approach to take in order to figure out what key was used to encrypt a message using the hill cipher.
I know it is possible to obtain it even if it were just a ...
6
votes
2answers
479 views
Is using a predictable IV with CFB mode safe or not?
While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine):
"For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...
8
votes
3answers
2k views
What is the difference between known-plaintext attack and chosen-plaintext attack?
I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not.
Can anyone explain to me how ...
5
votes
2answers
300 views
Practical necessity of semantic security under chosen plain text attack (CPA) in CBC mode
I was not able to understand why we practically need a CPA security in Cipher Block Chaining. (which insist on having a random IV), let say if the encryption is not CPA secure i.e , the adversary can ...
2
votes
2answers
2k views
How does a chosen plaintext attack on RSA work?
How can one run a chosen plaintext attack on RSA?
If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
0
votes
2answers
133 views
CPA distinguisher for matrix multiplication in GF(256) with randomized padding
What is the best CPA distinguisher for the function $F_k:\{0,1\}^{8n}\to\{0,1\}^{16n}$ described below?
Let $E_k$ be a $2n\times2n$ matrix with elements in $GF(2^8)$, selected by generating bit ...
6
votes
1answer
124 views
Message space in security definitions
What is the message space in the following example and how does a message space relate to a security definition?
I mean, what difference does it make to such a definition if your message space is ...
6
votes
2answers
299 views
For public-key encryption, why does COA resistance imply CPA resistance?
My professor told me:
If a public-key crypto-system is secure against ciphertext-only attacks,
then it is also secure against a chosen-plaintext attack.
Why is this true? Is there a proof that ...
3
votes
2answers
499 views
What is the smallest plaintext/ciphertext size for an algorithm like?
When I read about a choosen plaintext attack, for example on AES the block size is always 128 bits, does it mean the attacker will only supply 128 bits data words as "plain text" ?
