Questions tagged [chosen-ciphertext-attack]
A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.
33
questions
68
votes
1
answer
35k
views
Easy explanation of "IND-" security notions?
There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security.
...
77
votes
1
answer
61k
views
Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?
I've studied that the Bleichenbacher's CCA attack on PKCS#1 v1.5. is a base to many versions of attacks in the area.
I'm trying to understand that attack, but every explanation I saw starts with the ...
17
votes
1
answer
19k
views
The difference between these 4 breaking Cipher techniques?
I'm trying to understand the difference between the following and what they actually mean :
Known plaintext attack
Known ciphertext attack
Chosen ciphertext attack
Chosen plaintext attack
Any ...
22
votes
2
answers
22k
views
How does a padding oracle attack work?
I am unsure of how a padding oracle attack works.
What I am not getting is how changing one bit at one time allows one to exploit(get keys) ASP.NET machines.
Can anyone explain this?
13
votes
1
answer
3k
views
Can a homomorphic encryption scheme be made CCA2 Secure?
Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure?
From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 ...
6
votes
1
answer
3k
views
Is ElGamal IND-CCA1?
We all know that textbook ElGamal falls due to chosen ciphertext attacks, because of its multiplicative homomorphic property ($E(A)*E(B)=E(AB)$).
However these attacks require the ciphertext ($E(A)$ ...
6
votes
0
answers
348
views
IND-CCA1 RSA padding?
I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property.
I'm restricted to RSA (any padding; for hardware ...
30
votes
2
answers
33k
views
How does a chosen ciphertext attack work, with a simple example?
Can someone please explain - using a simple example - how a chosen ciphertext attack works?
15
votes
3
answers
2k
views
Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?
The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes.
Does this mean that an attacker can only see a single ...
13
votes
1
answer
5k
views
Why do we encrypt-then mac but sign-then-encrypt?
This question was asked in comments on my answer to should we sign then encrypt or encrypt then sign. I think posing the question as a separate entity is best, so:
The general advice for applying ...
5
votes
1
answer
5k
views
Common modulus attack on RSA when the 2 public exponents differ by a single bit
This is an exam question an i have no idea how to recover the message m.
John wants to send an encrypted message to mary who has a pair of RSA keys, However, John does not know Mary's public key and ...
4
votes
2
answers
9k
views
Chosen plaintext attack on textbook RSA decryption
Let $(n,d)$ be an RSA private key and $(n,e)$ the corresponding public key.
Generate a secret random $r$ from $(\mathbb{Z}/n\mathbb{Z})^*$
Compute $C’ = C (r^e) \bmod n$
Submit $C’$ as a chosen ...
2
votes
1
answer
3k
views
How to prove an encryption scheme is not CCA secure
Given the following context below, how does one show or prove the encryption scheme is NOT IND-CCA secure
The IND-CPA secure private-key encryption scheme for n-bit messages can be constructed from a ...
9
votes
2
answers
3k
views
Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?
I have written a code to encrypt a plaintext as below. Here I am using bouncycastle crypto provider and referring to the RSA+OAEP for that.
...
8
votes
2
answers
498
views
Is there a partially homomorphic quantum secure public key cryptosystem with IND-CCA1 security?
I recentely asked "IND-CCA1 RSA padding?" about whether there is a IND-CCA1 secure variant of RSA. The original version of the question also allowed usage of ECC which would allow usage of ElGamal, ...
8
votes
1
answer
657
views
Can RSA be securely used for "blind decryption"?
Assume we have the following setup:
A client with trusted storage and computing capabilities (e.g. a smartcard)
A server with trusted computing and short-term storage capabilities (e.g. RAM + CPU, ...
7
votes
3
answers
1k
views
What are the practical implications of ciphertext distinguishability?
Commonly there are four ways to "break" a secrecy-focused cryptosystem:
Recover the secret key
Recover the message
Distinguish an encryption from random noise
Distinguish the encryption of two ...
6
votes
2
answers
2k
views
Creating own ciphertext after a padding oracle attack?
I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired?
...
6
votes
2
answers
1k
views
Why does Encrypt-Then-Sign not yield a CCA-secure public-key encryption scheme?
In symmetric cryptography, combining an IND-CPA secure symmetric encryption scheme with a secure MAC with the encrypt-then-MAC method yields a IND-CCA secure symmetric encryption scheme.
I am trying ...
5
votes
3
answers
17k
views
Chosen plaintext vs Chosen ciphertext
What is the difference between chosen plaintext and chosen ciphertext attack?
In both of these adversary has access to paintext-ciphertext pairs.Then where lies the difference?
5
votes
1
answer
814
views
Secure ElGamal with OAEP
Is it possible to make ElGamal IND-CCA2 using OAEP or OAEP+? (OAEP+ from: "OAEP Reconsiderd" by Shoup)
The reason I ask is that I recently answered this question and it came to my mind that OAEP or ...
4
votes
2
answers
9k
views
AES-CTR vulnerability to cryptographic oracle
I am new to cryptographic issues and from what I googled so far I could not retrieve the information I need.
Consider the use of AES-128 in CTR mode.
Let M be the set of possible plaintexts, for ...
4
votes
1
answer
2k
views
How can a Encrypt-And-MAC scheme be insecure if the encryption is CCA secure?
I was presented with this seemingly paradoxical information, and am hoping someone can explain what I'm missing here.
I have an encrypt-and-mac scheme here.If I want to transmit message m to Bob, I'd ...
4
votes
0
answers
294
views
IES: What security has the asymmetric primitive to provide?
I think most of us know the notion Shoup introduced of KEM/DEM (Key Encapsulation Mechanism / Data Encapsulation Mechanism) which is used for example by the (famous) ECIES, where the key is the hash ...
3
votes
2
answers
266
views
Bleichenbacher attack test vectors
I was trying to understand the Bleichenbacher attack. I went through the paper of Bleichenbacher to understand it a bit more. However, I tried to get some test vectors to simulate this attack locally ...
3
votes
1
answer
429
views
Attack on AES-CBC with small pool of IV
Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$.
I know that if we can predict next IV with 100% probability there is attack that completely breaks ...
2
votes
1
answer
527
views
Why Boneh-Franklin BasicIdent IBE is not chosen-ciphertext secure? Why use random oracle?
I don't know why BasicIdent is not chosen-ciphertext secure. If there are anybody who knows well, please explain it to me with example.
Moreover, I don't know random oracle and its usage for security ...
1
vote
1
answer
481
views
To which game-based security definition is Perfect Secrecy equivalent?
We all know the classic definitions of perfect secrecy, being
$$\Pr[M=m|C=c]=\Pr[M=m]$$
and
$$H(M|C)=H(M)$$
But now what I've asked myself:
If we were to remove the polynomial restriction on the ...
1
vote
1
answer
379
views
Finding RSA private exponent with a chosen ciphertext attack?
Let's say there's this blackbox app that has a known modulus $N$, private exponent $e$, and takes ciphertext $C$ encrypted against $N$ and $e$ input and outputs plaintext $M$.
The encryption is done ...
1
vote
1
answer
823
views
Does RSA-OEAP have integrity and authenticity properties?
RSA-OAEP is IND-CCA2 secure (indistinguishable under an adaptive chosen ciphertext attack). Does it also have the INT-CTXT (integrity of ciphertext) and INT-PTXT (integrity of plaintext) properties?
...
0
votes
1
answer
4k
views
Proving the CCA-insecurity of El Gamal encryption scheme
I am trying to prove that El Gamal Encryption is not CCA-Secure.
If an adversary queried the encryption oracle for the encryption of $m=1$, he'll get a pair $(c_1,c_2)=(g^y,g^{xy}\cdot m)=(g^y,g^{xy}\...
0
votes
1
answer
1k
views
Breaking One Time Pad with CCA
I was taught that:
although OTP is CPA secure, it is not the case with CCA.
I'm trying to figure how to break OTP with CCA by showing how it fails the IND test.
...
0
votes
1
answer
1k
views
many time pad attack [duplicate]
I am a beginner in cryptography. I studied many time pad attack and now I want to solve a popular exercise, It consists 11 ciphertexts (s1,s2,...,s11), that encrypted by a same key and I want to find ...