Tag Info

6

In general, CTR mode is not secure against chosen-ciphertext attacks. (The same goes for the other classic block cipher modes of operation too; to get security against chosen-ciphertext attacks, you need authenticated encryption.) In your stated attack scenario, the attacker can obviously use the decryption oracle to decrypt any ciphertexts they intercept, ...

5

I do not remember if we checked this explicitly, but my guess is that in the chosen-plaintext setting the biclique attack would still be faster than the exhaustive search, maybe by the factor of 2 compared with 4 in the chosen-ciphertext setting. However, both results are pretty far from declaring AES broken in any sense. Such small gain over exhaustive ...

2

I am assuming that $n$ is small enough that the counter never rolls over and repeats, and that the IV is chosen randomly from the space of all possible IVs. The length of the plaintext is leaked, but that is leaked by the ciphertext anyways. The plaintext for a given ciphertext is leaked as the attacker can feed that in to the oracle. AFAIK, however, ...

2

The standard approach is to break this problem into two pieces: What information is unavoidably leaked, merely by computing the desired function? In your case, the goal is to compute $\sum_i x_i$. This sum unavoidably leaks a little bit of information about the $x_i$'s. For instance, as you correctly state, if we somehow know that all $x_i$'s are ...

2

This is tricky and I don't know that there is a generic way to take care of all domain/auxiliary information. The way we typically do proofs in multi-party computations is by defining an ideal world and show that the information generated in the ideal world (usually the encrypted inputs and the outputs) could be used to simulate the real world protocol ...

2

There are two possible ways (I can think of) an attacker could mess you up here, but they both stem from very poor design. So I don't know how realistic they are. Note: the following figure assumes a 64-bit blocksize CFB is only self synchronizing against insertions/deletions of a specific length. The length is determined by the shift register. If the ...

1

You asked if there is anything else that can be done, so I'll add some things that mikeazo did not mention. You should make very sure that the IV you are using is a nonce. In other words, you should never ever repeat an IV value using the same key. You should check your known value (prepended padding) before using any part of the decrypted ciphertext. ...

1

The security claim on page 5 of the Linear Cramer-Shoup paper is that their modified scheme is CCA secure, which is weaker than the IND-CCA2 security of the original DDH based Cramer-Shoup scheme. However, from the outline of the security proof, it seems the author actually means the LCS scheme is CCA2 secure. Also note the first sentence on page 6: ...

Only top voted, non community-wiki answers of a minimum length are eligible