# Tag Info

8

This isn't really a "hard" answer, but an attempt to give some intuition or motivation. One can interpret indistinguishability as an overapproximation of the most common notions of security: Any system that is broken in a more practical way will also fail to meet indistinguishability, that is, all practically important security requirements are in fact ...

5

Katz & Lindell mention in their book "Introduction to Modern Cryptography: Principles and Protocols" an example of an IND-CPA attack from World War II. Navy cryptanalysts suspected that Japanese ciphertexts containing the fragment "AF" where referring to the Midway island. Then, they told officials at Midway to send unencrypted messages reporting they ...

4

The CCA1 security of ElGamal is a big open question. There are no attacks known, but standard reductions don't seem to work. In 1991, Damgard proposed an ElGamal variant and proved it to be CCA1-secure (albeit under a very problematic non-falsifiable assumption, called the "knowledge of exponent assumption"); see the paper here ...

4

As already mentioned in a previous answer and the comments, you are right regarding that ElGamal is not secure against chosen-ciphertext attacks. An immediate reason is that the scheme is multiplicatively homomorphic, and that is not compatible with CCA: the attacker could query the decryption oracle with the ciphertext that results of multiplying the ...

4

After some thought, I think the answer is in fact NO, even for CCA1 and even for Shoup's OAEP+. RSA-OAEP/OAEP+ work by taking a message $m$, producing a padding $p(m,r)$ and then encrypting this, so $c = f(p(m,r))$ where $f$ is RSA encryption, and $f(u) = u^e \pmod{N}$ is deterministic. In fact, the whole point of OAEP(+) is to inject some entropy into ...

3

Essentially any IND-CPA-secure lattice-based cryptosystem offers additive homomorphism, up to a predetermined number of operations. I don't know of any IND-CCA1-secure post-quantum candidate that offers any homomorphic property, except Loftus-May-Smart-Vercauteren SAC'11, which is based on a nonstandard "knowledge of error" lattice assumption.

3

The idea behind these models is to model an adversaries capabilities. To get reliable security the worst case for a capability is modelled. Let's start with chosen plaintext attacks (CPA): In this game the adversary is given access to an encryption oracle. This models the case where an attacker knows (parts of) the message. For example, the British knew ...

3

The difference is how the plaintext-ciphertext pairs that the attacker has access to are generated. In a chosen plaintext attack, the attacker chooses some plaintext and is handed the corresponding ciphertext. In other words, the attacker may encrypt arbitrary messages. In a chosen ciphertext attack, the attacker can additionally (a chosen ciphertext ...

3

Chosen Ciphertext Attacks against RSA (such as Bleichenbacher's Attack on PKCS #1 encryption) do not actually reveal the private key. If they don't, they why do we say that they are a threat? Well, it's because that the keys are generally not of interest to the attacker. Instead, given an encrypted message, the attacker actually wants to know what that ...

3

The important thing to note here is that $\mathsf{D}(k,0)=0$ does not necessarily imply that $\mathsf{E}(k,0)=0$. That is the reason why your attack does not work in general. To illustrate, let $(\mathsf{E},\mathsf{D})$ be a CCA secure encryption scheme. We then construct a new encryption scheme $(\mathsf{E'},\mathsf{D'})$ as follows: \mathsf{E'}(k,m) = ...

2

In the standard definition of security for public key encryption schemes there exists only one public key. Therefore the decryption oracle will always decrypt with the secret key that corresponds to the public key given to the attacker. It does not matter how the $c_1$ in your question is computed, it can be computed using the real public key, a different ...

2

For CPA security it is actually enough that the first scheme, i.e., $\pi = (gen, enc, dec)$ is CPA secure. Lets define the CPA game of a general scheme $\pi = (Gen, Enc, Dec)$ against an adversary $A$ as follows: We sample $(pk, sk) \leftarrow Gen(1^\lambda)$, and send $pk$ to $A$. $A$ outputs messages $m_0$ and $m_1$. We sample $b \leftarrow \{0,1\}$ (a ...

2

Faliure of indistinguishablity of encryptions under a eavesdropper does imply faliure of indistinguishablity of encryptions under a chosen-plaintext attack. But the converse is not necessarily true (ex. OTP) The aim of CPA-secure is not to decrypt previously unobserved ciphertext but to pass the distinguishability test after a set of (plaintext, ciphertext) ...

2

The ideal encryption scheme $E$ would be one that, for every ciphertext $C=E(K, M)$, if the key remains secret for the adversary, the probability of identifying $M$ is negligible. Since that is not possible in practice, the second most reasonable approach is to define constraints strong enough to satisfy some definition of security. The $IND-$ notation ...

2

As you say, CCA proofs are actually reductions to underlying problems. In all CCA proofs that I can think of at the moment, the underlying problem is a weaker security notion for an "embedded" encryption scheme - e.g. Cramer-Shoup and friends use IND-CPA of ElGamal and Fujisaki-Okamoto uses OWE of the contained scheme. The general proof strategy is to take ...

2

2

"What prevents an attacker from just sending the received ciphertext to the recipient who will think that this is the legitimate message?" Nothing. $\:$ (In that case, the recipient will be correct.) Why "in the definition" is the attacker "only allowed to send another" message? If he knows before seeing the ciphertext that it will be an encryption of ...

2

Let's try to simplify and abstract your protocol a bit. Instead of your server and client, we just have two parties, let's call them Sally and Charlie. Charlie has a key pair $K = (K_i, K_u)$ for a suitable asymmetric cryptosystem $\mathcal E$. We assume that this cryptosystem is partially homomorphic, such that $\mathcal E_K(a) \otimes \mathcal E_K(b) = ... 1 There should be plenty of them. Off the top of my head, I'm thinking of the provable secure version of NTRU by Stehlé and Steinfeld [1], which is IND-CPA secure. In this scheme, ciphertexts are of the form: $$c = pk \cdot s + p\cdot e + \operatorname{encode}(m)$$ where$s$and$e$are random polynomials,$p$is a small prime, ... 1 If I understand the question correctly, you are asking whether it's really needed to have the KEM be CCA secure, and maybe in the random oracle model it would suffice for it to just be an invertible one-way function. This would not be CCA2-secure. Specifically, let$f$be any invertible one-way function, and construct$f'$so that$f'(x)=0f(x)$for every ... 1 It can be proved, mathematically, that your (2), (3), and (4) are all equivalent under chosen plaintext attack. That is, if you can do any of those things then you can also do the other two! It should be obvious that (2) implies both (3) and (4): if you can decrypt a message then you know which message it is, and also you know it's not random noise. The ... 1 ElGamal is not secure against chosen-ciphertext attacks, and there is a trivial attack. This is incorrect. 1 It's not elegant, but the brute force method is to write a program that creates a table of 25x25 digraphs (assuming i=j), yielding 625 rows. I'd also add a column that lists the relative frequency of each digraph (given enough ciphertext you can use that to identify frequent substitutions, as you already have done). You start off with 625! possible ... 1 Yes.$\:$NME-CPA is such a notion, and is equivalent to modifying the IND-CCA notion so that$\;$the adversary can submit more than one ciphertext simultaneously$\;\;\;\;$and$\;$the adversary can only submit ciphertext(s) one time$\;\;\;\;$and$\;$that time must be after receiving the challenge ciphertext$\;\;\;\;$and$\;$after submitting ... 1 As fgrieu already said, the question is a bit weird. The encryption scheme is not complete in a very strong sense, as there exists no efficient algorithm that can recover$m\$ from a ciphertext. But anyway, the definition of CCA security does not require completeness, so let me just answer the question as asked: No the scheme as described is not CCA secure ...

Only top voted, non community-wiki answers of a minimum length are eligible