The attacker can specify his own plain text and encrypt or sign it.

learn more… | top users | synonyms (1)

11
votes
1answer
841 views

Easy explanation of “IND-” security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
11
votes
3answers
3k views

Is using a predictable IV with CFB mode safe or not?

While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine): "For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...
7
votes
1answer
5k views

The difference between these 4 breaking Cipher techniques?

I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ...
10
votes
2answers
4k views

Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

I just learned that using CBC encryption with an IV which is predictable is not secure. From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can ...
3
votes
1answer
344 views

Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure

Any thoughts on how this can be done? Let $\Pi_1 = (\mathrm{Gen}_1, \mathrm{Enc}_1, \mathrm{Dec}_1)$ and $\Pi_2 = (\mathrm{Gen}_2, \mathrm{Enc}_2, \mathrm{Dec}_2)$ be two encryption schemes for ...
7
votes
2answers
8k views

How does a chosen plaintext attack on RSA work?

How can one run a chosen plaintext attack on RSA? If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
3
votes
0answers
48 views

IND-CCA1 RSA padding?

I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property. I'm restricted to RSA (any padding; for hardware ...
3
votes
1answer
677 views

How much data can I encrypt with AES before I need to change the key in CBC mode?

In my cryptography class, the instructor suggested that in order to give the attacker a minimal advantage of $1/2^{32}$, we have to change the key after $2^{48}$ blocks are encrypted. It seems that ...
8
votes
1answer
589 views

Importance of block size in CBC mode

Why is it necessary to use a sufficiently long block size when implementing a CBC block cipher with a truly random initialization vector? In ECB mode it's easy to get information about the message if ...
2
votes
1answer
75 views

On composition of encryption schemes

If we composed (as in function composition) multiple CPA-secure encryption schemes would the result also be CPA-secure?
2
votes
1answer
741 views

How can an encryption scheme be indistinguishable with multiple messages but vulnerable to an adaptive chosen-plaintext attack?

In order to be indistinguishable with respect to multiple messages, wouldn't the scheme need to be nondeterministic? How would this then possibly be vulnerable to an adaptive CPA?
0
votes
1answer
164 views

How does chosen ciphertext attack on Elgamal work?

Can it be proven that attacker can obtain the full message if he knows some plain-ciphertext pairs?
5
votes
2answers
170 views

Security game oracle queries

Concerning private key (symmetric) IND-CPA game definition: Attacker $A$ queries the encryption oracle polynomial number of times. $A$ sends the challenger $C$ a message pair $m_0$ and $m_1$. $C$ ...
6
votes
1answer
671 views

Proof that padded RSA is CPA-secure

I'm referring to page 383 of J. Katz and Y. Lindell's Introduction to Modern Cryptography. The book presents a padded RSA: ${\bf Key Generation:}$ same as Textbook RSA (given security parameter ...
4
votes
2answers
312 views

Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?

A modern trend in cryptography consists of defining security as rigorously as possible, and then designing schemes which are secure according to those definitions. Proving security comes in the form ...
4
votes
1answer
873 views

Why is asymmetric encryption IND-CPA?

According to Wikipedia, the IND-CPA game is: The challenger generates a key pair PK, SK based on some security parameter k (e.g., a key size in bits), and publishes PK to the adversary. The ...
2
votes
1answer
195 views

Encrypting the same message using different schemes

$E_1$ and $E_2$ are IND-CPA secure encryption schemes. $E$ is defined as: $k_1,k_2 \leftarrow K_1 \times K_2$ . $E_{k_1,k_2}(m) \leftarrow E_{1,k_1}(m)||E_{2,k_2}(m)$. Hope the notations are in an ...
1
vote
2answers
610 views

How many oracle calls to break an affine cipher in a chosen plaintext attack?

Assuming the ability to launch Chosen Plaintext Attacks (CPA), how many oracle calls does an attacker need to break the affine cipher? How does it work?
6
votes
3answers
334 views

What are the practical implications of ciphertext distinguishability?

Commonly there are four ways to "break" a secrecy-focused cryptosystem: Recover the secret key Recover the message Distinguish an encryption from random noise Distinguish the encryption of two ...
3
votes
2answers
205 views

Are all stream-ciphers IND-CPA?

A stream cipher usually generates a stream of pseudo-random bits which get XORed with the plaintext to form the ciphertext. The stream is generated using a given IV / nonce and a secret key. CTR-mode ...
2
votes
2answers
559 views

Is One Time Pad considered Chosen-Plaintext Attack Secure?

If we're considering Chosen-Plaintext Attack setting, then the adversary has access to the Encryption Oracle right, and we know that OTP is only considered secure if we use the key only once. How ...
1
vote
0answers
51 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key encryption material / data encryption material) which is used for example by the (famous) ECIES, where the key is the hash of some ...
1
vote
2answers
214 views

CPA distinguisher for matrix multiplication in GF(256) with randomized padding

What is the best CPA distinguisher for the function $F_k:\{0,1\}^{8n}\to\{0,1\}^{16n}$ described below? Let $E_k$ be a $2n\times2n$ matrix with elements in $GF(2^8)$, selected by generating bit ...
0
votes
1answer
69 views

Breaking One Time Pad with CCA

I was taught that: although OTP is CPA secure, it is not the case with CCA. I'm trying to figure how to break OTP with CCA by showing how it fails the IND test. ...
0
votes
2answers
1k views

Is the AES encryption scheme CPA secure?

Give a 256 bit key space and 128 message space would AES block cipher as the encryption scheme be CPA secure?