The attacker can specify his own plain text and encrypt or sign it.

learn more… | top users | synonyms (1)

4
votes
1answer
613 views

Why is asymmetric encryption IND-CPA?

According to Wikipedia, the IND-CPA game is: The challenger generates a key pair PK, SK based on some security parameter k (e.g., a key size in bits), and publishes PK to the adversary. The ...
0
votes
2answers
166 views

The security of the AES secret itself

I am writing an application, running on a server, where multiple users access data from a database which is AES encrypted with a master secret. The master secret itself is initially randomly ...
3
votes
1answer
515 views

How much data can I encrypt with AES before I need to change the key in CBC mode?

In my cryptography class, the instructor suggested that in order to give the attacker a minimal advantage of $1/2^{32}$, we have to change the key after $2^{48}$ blocks are encrypted. It seems that ...
6
votes
1answer
465 views

Proof that padded RSA is CPA-secure

I'm referring to page 383 of J. Katz and Y. Lindell's Introduction to Modern Cryptography. The book presents a padded RSA: ${\bf Key Generation:}$ same as Textbook RSA (given security parameter ...
1
vote
1answer
83 views

Adversary Two Stages

I am read this paragraph and I have a doubt. "An adversary to PKC $\Pi$ is given by two probabilistic polynomial time algorithms, $A = (A1; A2)$. In the first stage, the "find" stage, the ...
1
vote
2answers
489 views

Chosen Plaintext Attacks against an Affine Cipher

Assuming the ability to launch Chosen Plaintext Attacks (CPA), how many oracle calls an attacker needs to break the affine cipher? and how
3
votes
2answers
1k views

Which categories of cipher are semantically secure under a chosen-plaintext attack?

I am trying to get my head around the circumstances under which a cipher is (or is not) semantically secure under a chosen-plaintext attack. I can't seem to find a good reference explaining this. I ...
3
votes
2answers
178 views

Security model for privacy-preserving aggregation scheme.

Suppose that $S=(E,D)$ is an additively homomorphic encryption scheme. Now I want to design a protocol $P$ such that given inputs $x_1,x_2,..,x_n$, the adversary $A$ (who can decrypt) can only learn ...
0
votes
2answers
722 views

Is the AES encryption scheme CPA secure?

Give a 256 bit key space and 128 message space would AES block cipher as the encryption scheme be CPA secure?
1
vote
0answers
57 views

IND-CPA security scheme [duplicate]

Possible Duplicate: CPA Secure Chosen plaintext scheme The example for IND-CPA secure schemes given is generally: for a random r, $Enc_k(m) =(r|| E_k(r)$ $XOR$ $m)$ where $E$ is a $PRF$ ...
2
votes
2answers
656 views

Why is an Encrypt-and-MAC scheme with deterministic MAC not IND-CPA secure?

I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. It's the task from two-years ago exam. At the bottom I reminded one definition. Let $(Gen_E,Enc,Dec)$ be an ...
2
votes
2answers
228 views

How to construct a variable length IND-CPA cipher from a fixed length one?

Suppose we can construct a secure (IND-CPA) encryption scheme for fixed length messages. I was wondering if there is a natural way to extend this construction for messages of variable length such that ...
4
votes
1answer
1k views

Figuring out key in hill cipher (chosen-plaintext attack)

I have been wondering what approach to take in order to figure out what key was used to encrypt a message using the hill cipher. I know it is possible to obtain it even if it were just a ...
11
votes
3answers
2k views

Is using a predictable IV with CFB mode safe or not?

While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine): "For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...
10
votes
4answers
12k views

What is the difference between known-plaintext attack and chosen-plaintext attack?

I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not. Can anyone explain to me how ...
5
votes
2answers
741 views

Practical necessity of semantic security under chosen plain text attack (CPA) in CBC mode

I was not able to understand why we practically need a CPA security in Cipher Block Chaining. (which insist on having a random IV), let say if the encryption is not CPA secure i.e , the adversary can ...
6
votes
2answers
6k views

How does a chosen plaintext attack on RSA work?

How can one run a chosen plaintext attack on RSA? If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
1
vote
2answers
186 views

CPA distinguisher for matrix multiplication in GF(256) with randomized padding

What is the best CPA distinguisher for the function $F_k:\{0,1\}^{8n}\to\{0,1\}^{16n}$ described below? Let $E_k$ be a $2n\times2n$ matrix with elements in $GF(2^8)$, selected by generating bit ...
6
votes
1answer
341 views

Message space in security definitions

What is the message space in the following example and how does a message space relate to a security definition? I mean, what difference does it make to such a definition if your message space is ...
6
votes
2answers
431 views

For public-key encryption, why does COA resistance imply CPA resistance?

My professor told me: If a public-key crypto-system is secure against ciphertext-only attacks, then it is also secure against a chosen-plaintext attack. Why is this true? Is there a proof that ...
4
votes
2answers
769 views

What is the smallest plaintext/ciphertext size for an algorithm like?

When I read about a choosen plaintext attack, for example on AES the block size is always 128 bits, does it mean the attacker will only supply 128 bits data words as "plain text" ?