# Tag Info

10

This isn't really a "hard" answer, but an attempt to give some intuition or motivation. One can interpret indistinguishability as an overapproximation of the most common notions of security: Any system that is broken in a more practical way will also fail to meet indistinguishability, that is, all practically important security requirements are in fact ...

9

Katz & Lindell mention in their book "Introduction to Modern Cryptography: Principles and Protocols" an example of an IND-CPA attack from World War II. Navy cryptanalysts suspected that Japanese ciphertexts containing the fragment "AF" where referring to the Midway island. Then, they told officials at Midway to send unencrypted messages reporting they ...

5

Informally, CCA2 does not permit any kind of modification of ciphertexts, while RCCA permits some alteration as long as it does not alter the original message. For example, think of a publicly randomizable encryption scheme, that is, a scheme that permits to alter the original randomness used during encryption. CCA2 would consider these ciphertexts as ...

5

RFC 4880, OpenPGP (superseded RFC 2440 which was up to date in 2002) contains a chapter on security considerations, which also discusses the decryption oracle attack Jallad et al described: In late summer 2002, Jallad, Katz, and Schneier published an interesting attack on the OpenPGP protocol and some of its implementations [JKS02]. In ...

3

Your questions can be split in two: What is the meaning of IND-CCA secure? What have an adversary access in a challenger-adversary game? This basically means that the scheme achieves the indistinguishability notion, even if an attacker has access to a decryption oracle. See Easy explanation of "IND-" security notions? for more detail on ...

3

First, recall that in a chosen-ciphertext attack (CCA) model, the attacker has access to a decryption oracle. A scheme is said CCA-secure if access to a decryption oracle does not give any advantage to the attacker. Knowing this, a very simple CCA attack can be done on BasicIdent. I will use the description of the scheme from Wikipedia. As you can see, ...

3

Tape is a basic concept from Turing machines. The random tape is the tape with random bits on it.

3

As SEJPM said in his comment: one proceeds by contrapositive, first suppose that such an adversary with an unfair advantage exists and use that adversary to break a well known assumption, e.g.: the adversary can be used to factorise a large composite integer (as defined in RSA). As of today, we have no efficient algorithm to factorise large composite ...

3

The adversary clearly can do that. But if the adversary wins with this strategy, then the scheme in question cannot even be CPA secure and is far away from reaching the goal desired from CCA security. Recall, CCA security requires that even having access to a decryption oracle (for any ciphertext but the challenge ciphertext) does not help the adversary.

3

This specific hash function is weak; it appears that what this hash function does is pad out the string to be hashed into a 32 byte string, and then take the 8 4-byte substrings, and maps each substring individually into an individual byte. This immediately makes it trivial to find a preimage; start with a random 31 byte preimage (there appears to be a bug ...

3

The (CCA-related) problem of this padding scheme is that it lacks a failure condition, i.e. a ciphertext which a decryption oracle will refuse to decrypt. Now first for the chosen ciphertext attack which exploits RSA's homomorphic property. Assume you want to decrypt a ciphertext $c$ that is the encryption of $m$ which is encrypted properly according to the ...

3

Let's try to simplify and abstract your protocol a bit. Instead of your server and client, we just have two parties, let's call them Sally and Charlie. Charlie has a key pair $K = (K_i, K_u)$ for a suitable asymmetric cryptosystem $\mathcal E$. We assume that this cryptosystem is partially homomorphic, such that $\mathcal E_K(a) \otimes \mathcal E_K(b) = ... 3 Essentially any IND-CPA-secure lattice-based cryptosystem offers additive homomorphism, up to a predetermined number of operations. I don't know of any IND-CCA1-secure post-quantum candidate that offers any homomorphic property, except Loftus-May-Smart-Vercauteren SAC'11, which is based on a nonstandard "knowledge of error" lattice assumption. 3 Intuitively, the reason fixed points are not a problem is the same reason that zeros in a one time pad are not. Because the transform is supposed to be random, a ciphertext that looks like plaintext could be that plaintext... or it could be any other plaintext. With proper encryption they are all equally likely. If I find out that the block that I ... 3 The idea behind these models is to model an adversaries capabilities. To get reliable security the worst case for a capability is modelled. Let's start with chosen plaintext attacks (CPA): In this game the adversary is given access to an encryption oracle. This models the case where an attacker knows (parts of) the message. For example, the British knew ... 2 "What prevents an attacker from just sending the received ciphertext to the recipient who will think that this is the legitimate message?" Nothing.$\:$(In that case, the recipient will be correct.) Why "in the definition" is the attacker "only allowed to send another" message? If he knows before seeing the ciphertext that it will be an encryption of ... 2 Note that the security notion targeted by MACs is not IND-CCA, but EUF-CMA (Existentially Unforgability against Chosen Message Attacks). You can read the formal definition on page 156 here: https://cseweb.ucsd.edu/~mihir/papers/gb.pdf. Suppose we have a MAC scheme$M =(\mathcal{K}, \mathsf{MAC}, \mathsf{VF})$which is EUF-CMA secure. Let's create another ... 2 It can be proved, mathematically, that your (2), (3), and (4) are all equivalent under chosen plaintext attack. That is, if you can do any of those things then you can also do the other two! It should be obvious that (2) implies both (3) and (4): if you can decrypt a message then you know which message it is, and also you know it's not random noise. The ... 2 Scheme is not IND-CPA for any message longer than one block. I'll include a image of CBC mode below for reference (Source: Wikipedia). Suppose instead of block cipher encryption we have plaintext xor-ed with the key as you propose. You'll note that for message block 1,$M_1$, the ciphertext block$C_1 = M_1 \oplus IV \oplus Key$. Similarly$C_2 = M_2 \...

2

A cryptosystem is not "based on an assumption" ; it is based on some mathematical structure (e.g. prime order elliptic curves, or prime order fields). Informally, a cryptosystem is said IND-CCA secure (which means: it satisfies the indistinguishability security notion, against adversaries which are given access to a decryption oracle) under some assumption A ...

2

If attackers can strip off RSA / EC / -DSA digital signature and conduct CCA on AES-CTR or CBC payload, why can't they do the same for AES-GCM? The scenario, you're talking about is iMessage or Signal Protocol or other protocols which allow optionally to sign the ciphertext and thereby don't MAC it. The problem here is a) that you could replace the ...

1

TL;DR: This attack extends the standard chosen ciphertext attacks on RSA and ElGamal to the hybrid encryption setting, but requires some huge IFs which no longer even have a slight possibility of being fulfilled. To understand this attack, one first needs to understand how data is encrypted for PGP according to this snippet. Let's assume you have a ...

1

Ok, suppose that we have a ciphertext $(c_1, c_2, ..., c_8)$ that we wish to decrypt. What we start off with is to make a guess for $p_8$, which is the decryption of the last byte of the block. Suppose that we guess that it is 0x07; we then need to validate that guess. What we do is create a two block message; the second block is the challenge ciphertext ...

1

It's actually fairly straight-forward; the attacker knows $m_0$, $m_1$, and the challenge ciphertext $c = m_r \oplus s$, for an unknown bit $r$ and an unknown string $s$; his job is to recover $r$. One thing he can try is selecting an arbitrary ciphertext $c'$ (which needs to be distinct from the challenge ciphertext, but can be anything else of the same ...

1

I understand that this could be easily made secure by producing few more keys out of the one key that is provided by, for example, using a stream cipher over predefined plaintexts or by hashing the key with predefined prefixes. This would be the task of a Key Based Key Derivation Function or KBKDF for short. HKDF is such a KBKDF that quickly has made ...

1

You already got the answer by yourself. As a linear cipher with 128 bit, it can be described by a 128x128 matrix over GF(2). To break the cipher is to find that matrix. But that's easy: column k is the decryption of the k'th standard basis, i.e. the vector (0,0,0,...1,...,0,0,0) , with the 1 on the k'th place. Example: Decrypt(0001) = 1101 Decrypt(0010) = ...

1

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired? You cannot. The padding oracle attack does not give you enough information to produce the ciphertext for any plaintext. You can do it for some plaintext, though. ...

1

The author does not define hybrid PKE schemes. What is their definition? A hybrid public-key encryption scheme is a scheme that uses public-key encryption along with symmetric encryption to gain speed advantages for long messages. The usual instantiation is to simply encrypt a key for the symmetric scheme and prepend the resulting cipher text. The more ...

1

There should be plenty of them. Off the top of my head, I'm thinking of the provable secure version of NTRU by Stehlé and Steinfeld [1], which is IND-CPA secure. In this scheme, ciphertexts are of the form: $$c = pk \cdot s + p\cdot e + \operatorname{encode}(m)$$ where $s$ and $e$ are random polynomials, $p$ is a small prime, ...

1

If I understand the question correctly, you are asking whether it's really needed to have the KEM be CCA secure, and maybe in the random oracle model it would suffice for it to just be an invertible one-way function. This would not be CCA2-secure. Specifically, let $f$ be any invertible one-way function, and construct $f'$ so that $f'(x)=0f(x)$ for every \$...

Only top voted, non community-wiki answers of a minimum length are eligible