Tag Info

Hot answers tagged

5

You seem to have some misconception here. Obviously, you are investigating chosen ciphertext attacks (CCAs) on textbook RSA instead of chosen plaintext attacks (CPAs). To help you with your understanding I am discussing CPA on textbook RSA first. To analyse all these kinds of attacks we formally model the attack as a game between an adversary (trying to ...


3

Chosen Ciphertext Attacks against RSA (such as Bleichenbacher's Attack on PKCS #1 encryption) do not actually reveal the private key. If they don't, they why do we say that they are a threat? Well, it's because that the keys are generally not of interest to the attacker. Instead, given an encrypted message, the attacker actually wants to know what that ...


3

The important thing to note here is that $\mathsf{D}(k,0)=0$ does not necessarily imply that $\mathsf{E}(k,0)=0$. That is the reason why your attack does not work in general. To illustrate, let $(\mathsf{E},\mathsf{D})$ be a CCA secure encryption scheme. We then construct a new encryption scheme $(\mathsf{E'},\mathsf{D'})$ as follows: $$\mathsf{E'}(k,m) = ...


3

The difference is how the plaintext-ciphertext pairs that the attacker has access to are generated. In a chosen plaintext attack, the attacker chooses some plaintext and is handed the corresponding ciphertext. In other words, the attacker may encrypt arbitrary messages. In a chosen ciphertext attack, the attacker can additionally (a chosen ciphertext ...


2

No. RSA-OAEP is indistinguishable under adaptive chosen cipher text attacks (and even non malleable under adaptive chosen cipher text attacks), but it is not an instance of authenticated encryption. - The sender who encrypts the message might even be anonymous to the recipient who decrypts the message. More generally, in a successful Chosen Cipher text ...


2

No, CCA does not imply authenticated encryption. CCA tries to recover the secret using chosen ciphertexts. A well designed block cipher should in itself already process the property that the key cannot be retrieved. If used with a properly implemented block mode of operation, this property should hold. Using authenticated encryption a CCA attack should not ...


2

The best you can get for homomorphic encryption schemes is non-adaptive chosen ciphertext security (IND-CCA1 security), see e.g. here for a quite up to date characterization. As you rightly observe homomorphic encryption schemes are malleable by definition and cannot provide adaptive security against chosen ciphertext attacks (be IND-CCA2 secure). Since ...


2

You are correct; whoever put together the above proof typo'ed that point; we have $c \times d \equiv 1 \pmod {\phi(n)}$, or more accurately, $c \times d \equiv 1 \pmod {lcm(p-1, q-1)}$. On the other hand, the attacker isn't expected to be able to compute step 2 (he can't, he doesn't know the value of $lcm(p-1,q-1)$, and hence cannot compute $d$). Instead, ...


1

Simple, $r$ just needs to be co-prime to $n$. To test this check that $gcd(r,n)==1$. This is required since you need to "divide" by $r$, i.e., multiply by $r^{-1}$. $r$ is invertible iff $gcd(n,r)==1$.


1

Well, one obvious way he can decrypt ANY cipher block is just give it to his Decryption machine; that machine will give him the matching plaintext block, which is precisely what he is looking for. Now, normally when we give an attacker a decryption oracle, and give him a challenge "decrypt this specific message", we put a limitation on the oracle that it ...



Only top voted, non community-wiki answers of a minimum length are eligible