# Tagged Questions

The attacker can specify his own plain text and encrypt or sign it.

85 views

### How to prove a function is pseudorandom function?

I am currently enrolled in a cryptography course, which uses the book by Katz and Lindell. I am using a function having $F_{k}$ = $A_{k}(B_{k}(r,m),r)$, the random number is generated using the ...
959 views

### how to prove our algorithm is secure against chosen plaintext attack?

I am working on a topic in cryptography where I have tried to develop an encryption scheme. How could I prove mathematically that my algorithm is secure against chosen plaintext attacks?. Will it ...
550 views

### Using bcrypt for MAC - is it correct and secure?

Suppose there is a hashing function: $$ph = bcrypt(sha256(m + k), salt)$$ Here $ph$ is a password hash obtaining by applying $bcrypt$ on $sha256$ result of concatenating a message $m$ with a secret ...
437 views

### What is the random tape?

I am reading the paper "Toward plaintext-aware public-key encryption without random oracles" by Bellare and Palacio. So I can't understand what is the tape and random tape?
27 views

### Proving CCA security for scheme constructed from secure PRP

We have a $PRP : \{0,1\}^{3n} \rightarrow \{0,1\}^{3n}$ and encryption scheme constructed from this $PRP$. $E_k(x\|r\|0^n)$, where $r$ is randomly chosen from $\{0,1\}^n$ and $0^n$ is a block of ...
50 views

### How do you prove an encryption scheme is IND-CPA or IND-CCA?

I know for proving a scheme is not IND-CPA or not IND-CCA you can construct an Adversary which has an unfair advantage in an experiment/game, but how would you prove a scheme is IND-CPA or IND-CCA?
156 views

### How to crack unknown 8-bit encryption algorithm?

Can anyone tell me how to crack the encryption of 8 bit algorithm, when you have some clue that CBC mode is used, but the algorithm is secret. You also have some encrypted data (chosen plain text), ...
54 views

### Differences between OWP and OWF and their IND-CPA security

I am learning about one way permutations and one way functions and am not sure of the differences if there are any. Also in the random oracle model are they both IND-CPA secure?
50 views

### Is there any IND-CPA secure stream cipher with a “standard” hardness assumption?

I've read our recent question: "One-time pad using RSA and Diffie-Hellman functions" which asks about the security of a particular way to convert RSA and discrete exponentiation into a stream cipher. ...
73 views

### Breaking One Time Pad with CCA

I was taught that: although OTP is CPA secure, it is not the case with CCA. I'm trying to figure how to break OTP with CCA by showing how it fails the IND test. ...
197 views

54 views

42 views

### Recover secret $x$ when $c\equiv m^x \pmod p$ with public $p$ (modified)

Given an encryption system where $c\equiv m^x \pmod p$, $p$ is a known prime, 1. Is it possible to recover $x$ with a known plaintext attack? Given $(p,\text{factorization of }\varphi(p),m,c)$ 2. Is ...
34 views

### Is EFS vulnerable to Chosen plaintext attack?

I have some backed up files encrypted with EFS and I lost the EFS certificate thus unable to decrypt the files. I understand that EFS uses the user certificate public key to encrypt the symmetric key (...
260 views

### Construct IND-CPA secure encryption scheme by combining two given schemes

I have two encryption schemes $\Pi_0, \Pi_1$, at least one of them is IND-CPA secure but I don't know which one. The task is to construct a scheme $\Pi$ that is guaranteed to be CPA secure and to ...
177 views

176 views

### Why is only one oracle + challenge-response phase sufficient for IND-CPA security?

The CRYPTUTOR wiki from UIUC uses the following definition of the IND-CPA game: We (privately) choose a key K according to the key generation algorithm: K $\gets \mathsf{KeyGen}$. We (...
188 views

### Finding key of AES in ECB mode

How many plaintext-ciphertext pairs would be needed to guess with probability, say $p=0.5$, the key $k$ of AES under ECB mode? Most of the articles that I found tried attacks on single plaintext-...
175 views

### Security game oracle queries

Concerning private key (symmetric) IND-CPA game definition: Attacker $A$ queries the encryption oracle polynomial number of times. $A$ sends the challenger $C$ a message pair $m_0$ and $m_1$. $C$ ...
82 views

### Creating own ciphertext after a padding oracle attack?

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired? ...
39 views

### Indistinguishability through a chosen plaintext attack

I have a question about how to go about doing an IND-CPA style attack. I'm supposed to think of this as two black boxes, where I do not know which box contains which function. What would I do with the ...
92 views

### How can IND-CPA encryption be identity revealing?

This is problem 10 of Chapter 4 "Symmetric Encryption" (pdf) from Lecture notes by Bellare and Rogaway: An IND-CPA secure encryption scheme might not conceal identities, in the following sense: ...
108 views

### What is the difference between CPA and IND-CPA?

I am writing a paper and I got comments from the reviewer that I don’t really understand. Is there any difference between a CPA (Chosen Plaintext Attack) and IND-CPA (Indistinguishability under ...
130 views

### Challenge-Response Phases in IND-CPA

The IND-CPA game has two challenge-response phases A key is generated by running $Gen(1^n)$ and challenger selects a bit b {0,1} uniformly at random. Adversary gets input $1^n$. Can query the oracle ...
163 views

### CPA and pseudorandom generator

Just started learning about Cryptography and Network Security in general, and I can't seem to grasp the understanding of the following question. Please correct me if I am misunderstanding anything. ...
64 views

### Modified version of a CPA-secure encryption scheme

The following encryption scheme: choose a random string $r \leftarrow \{0,1\}^n$ and compute the ciphertext $c= \thinspace <c_0, c_1>= \thinspace <r, F_k(r) \oplus m>$, assuming $F$ a PRF; ...
141 views

### How to prove that the Permutation cipher is not CPA secure?

Encryption scheme is called a permutation cipher if every plaintext string with letters $a_1,\ldots, a_n$ is encrypted as $a_{\pi(1)}, \ldots, a_{\pi(n)}$ for some (not necessarily uniform) ...
102 views

### Chosen plain text and chosen ciphertext definitions clarification

I am trying to understand a concept of CPA and CCA attack and I cannot get one thing from the definition. If an attacker can execute a CPA attack for something like Send 100 dollars to attacker that ...
The 10.9 exercise from the Katz-Lindell textbook creates a lot of confusion, let me state it here. Consider the following experiment for an algorithm $A$ and a function $l$ with $l(n) \leq 2n-2$ for ...