The attacker can specify his own plain text and encrypt or sign it.

learn more… | top users | synonyms (1)

3
votes
0answers
47 views

LR-Oracle Experiment in Lindell and Katz

In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme $\pi = (Gen,Enc_K,Dec_K)$ is CPA secure for ...
3
votes
1answer
49 views

Affine cipher and plaintext attacks

Last year, a question concerning plaintext attacks was posted at Mathematics.SE: “Plaintext attacks: affine cipher”. I have no problem to see how to solve it when we are given two ciphertexts and ...
2
votes
0answers
38 views

Recover secret $x$ when $c\equiv m^x \pmod p$ with public $p$ (modified)

Given an encryption system where $c\equiv m^x \pmod p$, $p$ is a known prime, 1. Is it possible to recover $x$ with a known plaintext attack? Given $(p,\text{factorization of }\varphi(p),m,c)$ 2. Is ...
2
votes
0answers
21 views

Is EFS vulnerable to Chosen plaintext attack?

I have some backed up files encrypted with EFS and I lost the EFS certificate thus unable to decrypt the files. I understand that EFS uses the user certificate public key to encrypt the symmetric key ...
3
votes
1answer
158 views

Construct IND-CPA secure encryption scheme by combining two given schemes

I have two encryption schemes $\Pi_0, \Pi_1$, at least one of them is IND-CPA secure but I don't know which one. The task is to construct a scheme $\Pi$ that is guaranteed to be CPA secure and to ...
2
votes
2answers
129 views

Given a pseudorandom function F, is $(F_k(r) \; | \; F_k(r + 1))$ also a PRF?

Given: F is a pseudorandom function, G is a pseudorandom generator with $l(n) = n+1$. The following schemes should be classified as being insecure, IND-COA secure, IND-CPA secure. To encrypt $m \in ...
1
vote
0answers
32 views

What do you mean by Ciphertext indistinguishability [duplicate]

Wiki definition : A cryptosystem is considered secure in terms of indistinguishability if no adversary, given an encryption of a message randomly chosen from a two-element message space ...
5
votes
1answer
48 views

How to show CPA attacker does not need access to encryption oracle after receiving cyphertext

In the private key CPA game, the attacker has access to an encryption oracle anytime during the attack. However, I have seen this statement in lecture notes I downloaded "You can prove that for ...
2
votes
2answers
102 views

Are parts of a pseudorandom string also a pseudorandom string?

I am working on an exercise that encrypts a message using only the first $n$ bits of a pseudorandom generator's output $G(k)$, i.e. $F_k(m) := G(k)_{0...n−1} \oplus m$. $k$ is chosen uniformly at ...
2
votes
0answers
59 views

MITM Attack on Key Exchange Protocols

I was doing research on this attack and I am wondering, why is Diffie-Hellman always associated with such an attack? ​ Aren't other public key cryptography schemes vulnerable to the same kind of ...
2
votes
1answer
38 views

Probabilistic RSA, IND CPA

Suppose we have classic RSA scheme. Let $n=pq$, $e$ public, $d$ secret. Then message(M), not empty(not 0), is encrypted by choosing random $r$ and computing $A=(r^e)^e$ and $B=(Mr)^e$ $(A,B)$ is ...
1
vote
1answer
53 views

How to prove that a SKE scheme is IND-CPA secure

There's an IND-CPA SKE scheme 1 $(\mathsf{Gen}, \mathsf{Enc}, \mathsf{Dec})$. Scheme 2 is defined as $(\mathsf{Gen}', \mathsf{Enc}', \mathsf{Dec}')$, where $\mathsf{Gen}' = \mathsf{Gen}$, ...
5
votes
1answer
140 views

Why is only one oracle + challenge-response phase sufficient for IND-CPA security?

The CRYPTUTOR wiki from UIUC uses the following definition of the IND-CPA game: We (privately) choose a key K according to the key generation algorithm: K $\gets \mathsf{KeyGen}$. We ...
2
votes
1answer
109 views

Finding key of AES in ECB mode

How many plaintext-ciphertext pairs would be needed to guess with probability, say $p=0.5$, the key $k$ of AES under ECB mode? Most of the articles that I found tried attacks on single ...
5
votes
2answers
145 views

Security game oracle queries

Concerning private key (symmetric) IND-CPA game definition: Attacker $A$ queries the encryption oracle polynomial number of times. $A$ sends the challenger $C$ a message pair $m_0$ and $m_1$. $C$ ...
4
votes
1answer
74 views

Creating own ciphertext after a padding oracle attack?

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired? ...
0
votes
0answers
36 views

Indistinguishability through a chosen plaintext attack

I have a question about how to go about doing an IND-CPA style attack. I'm supposed to think of this as two black boxes, where I do not know which box contains which function. What would I do with the ...
1
vote
1answer
86 views

How can IND-CPA encryption be identity revealing?

This is problem 10 of Chapter 4 "Symmetric Encryption" (pdf) from Lecture notes by Bellare and Rogaway: An IND-CPA secure encryption scheme might not conceal identities, in the following sense: ...
2
votes
1answer
93 views

What is the difference between CPA and IND-CPA?

I am writing a paper and I got comments from the reviewer that I don’t really understand. Is there any difference between a CPA (Chosen Plaintext Attack) and IND-CPA (Indistinguishability under ...
4
votes
2answers
120 views

Challenge-Response Phases in IND-CPA

The IND-CPA game has two challenge-response phases A key is generated by running $Gen(1^n)$ and challenger selects a bit b {0,1} uniformly at random. Adversary gets input $1^n$. Can query the oracle ...
2
votes
1answer
113 views

CPA and pseudorandom generator

Just started learning about Cryptography and Network Security in general, and I can't seem to grasp the understanding of the following question. Please correct me if I am misunderstanding anything. ...
2
votes
1answer
53 views

Modified version of a CPA-secure encryption scheme

The following encryption scheme: choose a random string $r \leftarrow \{0,1\}^n$ and compute the ciphertext $c= \thinspace <c_0, c_1>= \thinspace <r, F_k(r) \oplus m>$, assuming $F$ a PRF; ...
1
vote
1answer
101 views

How to prove that the Permutation cipher is not CPA secure?

Encryption scheme is called a permutation cipher if every plaintext string with letters $a_1,\ldots, a_n$ is encrypted as $a_{\pi(1)}, \ldots, a_{\pi(n)}$ for some (not necessarily uniform) ...
4
votes
2answers
82 views

Chosen plain text and chosen ciphertext definitions clarification

I am trying to understand a concept of CPA and CCA attack and I cannot get one thing from the definition. If an attacker can execute a CPA attack for something like Send 100 dollars to attacker that ...
2
votes
0answers
75 views

CPA-security proof of “l-padded RSA” encryption scheme

The 10.9 exercise from the Katz-Lindell textbook creates a lot of confusion, let me state it here. Consider the following experiment for an algorithm $A$ and a function $l$ with $l(n) \leq 2n-2$ for ...
2
votes
0answers
55 views

Ciphertext size of any CPA-secure public-key encryption scheme

I know that, for any CPA-secure public-key encryption scheme, the size of the ciphertext after encrypting a single bit is superlogarithmic in the security parameter. That is, for $(pk,sk) \leftarrow ...
6
votes
3answers
104 views

Why is it good to split a CTR-mode counter into nonce and counter?

When discussing the CTR mode of block ciphers, Wikipedia says the following: Simply adding or XORing the nonce and counter into a single value would completely break the security under a ...
3
votes
0answers
41 views

IND-CCA1 RSA padding?

I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property. I'm restricted to RSA (any padding; for hardware ...
3
votes
1answer
48 views

Are deployed MACs IND-CPA?

There are a number of message authentication codes (MACs) used in practice. They are highly used in practice (f.ex. in TLS), but there's (at least) one application where they can't be used: Full Disk ...
5
votes
3answers
305 views

What are the practical implications of ciphertext distinguishability?

Commonly there are four ways to "break" a secrecy-focused cryptosystem: Recover the secret key Recover the message Distinguish an encryption from random noise Distinguish the encryption of two ...
1
vote
0answers
66 views

CPA-security of a pseudorandom permutation encryption scheme

Let $F$ be a pseudorandom permutation, and define a fixed-length encryption scheme $(Gen, Enc, Dec)$ as follows: on input $m \in$ $\{0,1\}^{n/2}$ and key $k \in \{0,1\}^n$, algorithm Enc ...
3
votes
0answers
30 views

Proving existence of an encryption scheme that has indistinghuishable multiple encryptions in the presence of an eavesdropper, but is not CPA-secure [duplicate]

I got stuck in trying to find a solution to the 3.7 exercise of the Katz-Lindell book. The exercise also assumes the existence of a pseudorandom function. The problem is that a multiple messages ...
2
votes
1answer
61 views

Improve security of transposition ciphers

As we know, breaking a Transposition Cipher is quite trivial and can be easily done by either exploiting single letter frequencies (not $d$-gram frequencies though, given that $2 < d < L$), or ...
1
vote
0answers
36 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key encryption material / data encryption material) which is used for example by the (famous) ECIES, where the key is the hash of some ...
3
votes
2answers
164 views

Are all stream-ciphers IND-CPA?

A stream cipher usually generates a stream of pseudo-random bits which get XORed with the plaintext to form the ciphertext. The stream is generated using a given IV / nonce and a secret key. CTR-mode ...
8
votes
1answer
816 views

If RSA is only used to encrypt symmetric keys which are random, what's wrong with textbook RSA?

IND-CPA is used to protect against frequency analysis AFAICT. But if RSA is only used to encrypt symmetric keys (AFAICT) then what's wrong with using only textbook RSA because random keys are very ...
7
votes
1answer
407 views

Easy explanation of “IND-” security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
1
vote
1answer
57 views

Determine if encryption is safe against CPA

The following encryption scheme encrypts each block of length $n$ of the plaintext separately: $c_i = k_1 \oplus F(k_2 \oplus p_i)$ Where $F$ is a strong pseudo-random permutation (i.e. it is easy ...
-1
votes
4answers
136 views

One time pad in CBC mode?

I have been searching about if it is more secure to use CBC mode in OTP but I can't find anywhere where people have sad that it is more secure. Question: Is CBC mode in OTP more secure? Because I ...
2
votes
1answer
270 views

Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure

Any thoughts on how this can be done? Let $\Pi_1 = (\mathrm{Gen}_1, \mathrm{Enc}_1, \mathrm{Dec}_1)$ and $\Pi_2 = (\mathrm{Gen}_2, \mathrm{Enc}_2, \mathrm{Dec}_2)$ be two encryption schemes for ...
2
votes
1answer
41 views

Does failure of indistinguishability of encryptions imply lack of CPA-security?

Suppose we have an encryption scheme that fails the indistinguishability of encryptions test. That is, given messages $m_0, m_1$ and a ciphertext $c_b = Enc_k(m_b)$, where $b \in \{0, 1\}$, the ...
2
votes
1answer
67 views

On composition of encryption schemes

If we composed (as in function composition) multiple CPA-secure encryption schemes would the result also be CPA-secure?
1
vote
1answer
76 views

Chosen-plaintext attack

Let F be a block cipher with 128-bit block length. Consider the following encryption scheme for 256-bit messages: to encrypt message $M=m_1∥m_2$ using key $k$ (where $|m_1|=|m_2|=128$), choose random ...
2
votes
2answers
410 views

Is One Time Pad considered Chosen-Plaintext Attack Secure?

If we're considering Chosen-Plaintext Attack setting, then the adversary has access to the Encryption Oracle right, and we know that OTP is only considered secure if we use the key only once. How ...
2
votes
1answer
118 views

Is MCrypt's 8-bit OFB mode secure?

I just stumbled across a Stack Overflow post which points out that the libmcrypt library (notably used in PHP) implements a somewhat unusual set of block cipher modes: it calls the usual CFB and OFB ...
0
votes
1answer
238 views

What is the difference between chosen-plaintext attack and adaptive-chosen-plaintext attack?

I've just dived in cryptography and would like to learn basics of this science. Currently I can't understand the difference between these two types of attacks. As I understood from Bruce Schneier's ...
0
votes
0answers
52 views

Recover keys using statistical saturation attack

I am having trouble here performing this attack on a block cipher. This is my block cipher, it is a toy with really bad diffusion just for the sake of performing a successful attack ...
5
votes
2answers
245 views

Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?

A modern trend in cryptography consists of defining security as rigorously as possible, and then designing schemes which are secure according to those definitions. Proving security comes in the form ...
2
votes
1answer
199 views

Counter Mode (CTR) and mult-CPA

I am not sure if Counter Mode (CTR) encryption is mult-CPA (chosen-plaintext attack) secure or not.
0
votes
1answer
237 views

CPA security of a stateless and deterministic encryption system

Why can no stateless and deterministic encryption system be IND-CPA secure? Is there a formal proof for it?