# Tag Info

17

This is a common mistake, so I'd like to give an in-depth answer. Basically, what you are proposing is to rely on the ONE-WAYNESS of RSA as a ONE-WAY FUNCTION, rather than relying on its CPA or CCA security as an encryption scheme. The advantage of using RSA as a one-way function is that no padding etc is needed. Now, the first important thing to note is ...

8

This isn't really a "hard" answer, but an attempt to give some intuition or motivation. One can interpret indistinguishability as an overapproximation of the most common notions of security: Any system that is broken in a more practical way will also fail to meet indistinguishability, that is, all practically important security requirements are in fact ...

7

No. There is a difference between the type of a cipher and the construction of a cipher. If a cipher is of a specific type for which there are known IND-CPA secure constructions then that doesn't mean that an entirely different construction is secure. There are known attacks on stream ciphers, including "modern" stream ciphers such as RC4. A stream cipher ...

5

You can generate a random string $s_1$ as long as the plaintext. Then XOR this value with the plaintext generating $s_2$. Now encrypt both parts using $\mathrm{Enc}_1$ and $\mathrm{Enc}_2$. You need to decrypt both to XOR the two parts together again. This is similar to secret sharing where you need two parts of a key to decrypt. If $\mathrm{Gen}_1$ and ...

5

Katz & Lindell mention in their book "Introduction to Modern Cryptography: Principles and Protocols" an example of an IND-CPA attack from World War II. Navy cryptanalysts suspected that Japanese ciphertexts containing the fragment "AF" where referring to the Midway island. Then, they told officials at Midway to send unencrypted messages reporting they ...

4

The property you are probably looking for is whether the MACs are PRF. With HMAC it depends on the pseudo-randomness of the hash function used. If the hash is a PRF then the HMAC is as well. However, that is not required for MAC security of HMAC, so it's not necessarily true even with a secure HMAC. See New Proofs for NMAC and HMAC: Security without ...

4

Suppose you do CTR mode as: $E(k,nonce+1) \oplus m_1$, $E(k,nonce+2) \oplus m_2$, $E(k,nonce+3) \oplus m_3$, etc. The wikipedia page is talking about a non-random nonce, with a specific example of a packet counter. So suppose $nonce$ is a packet counter and in each packet you encrypt several blocks. You might end up with the following: In packet #$p$: ...

3

The ideal encryption scheme $E$ would be one that, for every ciphertext $C=E(K, M)$, if the key remains secret for the adversary, the probability of identifying $M$ is negligible. Since that is not possible in practice, the second most reasonable approach is to define constraints strong enough to satisfy some definition of security. The $IND-$ notation ...

3

Note: In this answer, I stick to a definition of the One Time Pad where the random pad is used only One Time; at least, I've the name of it as support! Otherwise, it is well known that the OTP encryption scheme consisting of XOR with a repeated key is insecure by even the weakest standard (unknown plaintext with redundancy). INDistinguishability under ...

3

Yes, if (and this is important) the keys for $E$ and $S$ are selected independently. Consider that we had two encryption methods $E$, $S$ for which their composition $E(S(x))$ is not CPA secure; that is, we have some distinguisher $D$ that had some advantage in distinguishing that from a random function. Then, we can build a distinguisher for $E$ (by ...

3

The important thing to note here is that $\mathsf{D}(k,0)=0$ does not necessarily imply that $\mathsf{E}(k,0)=0$. That is the reason why your attack does not work in general. To illustrate, let $(\mathsf{E},\mathsf{D})$ be a CCA secure encryption scheme. We then construct a new encryption scheme $(\mathsf{E'},\mathsf{D'})$ as follows: \mathsf{E'}(k,m) = ...

3

Assuming you don't use counter-measures against this kind of an attack, a chosen-ciphertext attack works as follows: Variables: $p$ is field prime, $\alpha$ is the chosen generator, $a$ is the private key, $\alpha^a=\beta$ is the public key. $k'$ and $m'$ are chosen at random. Note: all the following equations are $(mod$ $p)$. Suppose you want to decrypt ...

3

With chosen-plaintext attack, the attacker is allowed to choose an arbitary amount of plaintext to encrypt. After that he/she can't do that again, he/she has to work with the current data. With the adaptive-chosen-plaintext attack, he/she can do the same as with the chosen-plaintext attack, but is also allowed to encrypt new data after the attacker has ...

3

Ask a CPA-query with a known $m$ and get back $c_0,c_1'$. Compute $c_1'' = c_1' \oplus m$. Then, compute $F^{-1}_r(c_1'')$ and this will be $k$. Now you know the key. Of course, this attack assumes that you can invert $F$, but nothing in the definition says you cannot (and in practice you often can).

3

IND-CPA is equivalent to semantic security under CPA.

3

You need to allow queries before the attacker outputs $m_0,m_1$ since maybe the queries help the attacker choose $m_0,m_1$ that are "easier" for it to attack. You need to allow queries after the attacker receives back the challenge ciphertext $c=E_k(m_b)$ since knowing $c$ may make it possible to generate a plaintext whose encryption helps to know what $c$ ...

3

The difference is how the plaintext-ciphertext pairs that the attacker has access to are generated. In a chosen plaintext attack, the attacker chooses some plaintext and is handed the corresponding ciphertext. In other words, the attacker may encrypt arbitrary messages. In a chosen ciphertext attack, the attacker can additionally (a chosen ciphertext ...

3

The idea behind these models is to model an adversaries capabilities. To get reliable security the worst case for a capability is modelled. Let's start with chosen plaintext attacks (CPA): In this game the adversary is given access to an encryption oracle. This models the case where an attacker knows (parts of) the message. For example, the British knew ...

2

I will think more about a proof/counterexample for #1, but here is a counterexample for #2. Let $\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec}$ refer to a CPA-secure encryption scheme with message space $\{0,1\}^\lambda$, and define the following modified scheme: $\mathsf{KeyGen}'$: run $sk \gets \mathsf{KeyGen}$ and sample $m^* \gets \{0,1\}^\lambda$. The ...

2

First determine the permutation domain. If $L_2 > L_1$, then the cipher is broken by $\lceil log_2 (L_2) \rceil$ pairs of plaintext/ciphertect. The security improvement is small, as the attacker only needs to use $\lceil log_2 (L_2) \rceil - \lceil log_2 (L_1) \rceil$ additional pairs to find the key.

2

One can't "get rid of" the factor 2. However, there might be a way to replace it with $2\hspace{-0.03 in}-\hspace{-0.03 in}o(1)\:$ where that depends on $q$ and the advantage. $||$ is concatenation. Start with some encryption scheme $\mathcal{E}'\hspace{-0.04 in}$, and for any integer $n$ and probability $p$, let $\mathcal{E}_{\hspace{.02 ... 2 Here is the answer for why a deterministic public-key encryption scheme cannot be CPA secure. For CPA security it is sufficient if an adversary can distinguish between encryptions of two messages$m_0$and$m_1$. That is, an adversary gets to see an encryption$c \gets \textsf{Enc}(pk,m_b)$for a random bit$b$together with the public key$pk$. Now in ... 2 No. This isn't secure by itself against chosen-plaintext attacks. This mode is known as plaintext-feedback mode (PFB) and referenced for example in here. The next point is this mode hasn't received much attention in the cryptographic literature, whereas other modes (CFB, OFB, CBC, CTR) have. Two notes: Don't roll your own crypto. Never use such modes if ... 2 Faliure of indistinguishablity of encryptions under a eavesdropper does imply faliure of indistinguishablity of encryptions under a chosen-plaintext attack. But the converse is not necessarily true (ex. OTP) The aim of CPA-secure is not to decrypt previously unobserved ciphertext but to pass the distinguishability test after a set of (plaintext, ciphertext) ... 2 Here's an artificial example: Start with some secure encryption scheme with encryption function$\mathcal{E}(\cdot)$, and construct a new scheme with encryption function$\mathcal{E}'(\cdot)$, which for any input message$m$copies the first bit,$b$, of the message, and outputs$b||\mathcal{E}(m)$, where$||$denotes concatenation. For such a scheme, ... 2 No. Indeed, as in the answer by Maarten, it depends on the security and strength of the stream cipher. However, even if the stream cipher is a secure pseudorandom generator (which is its proper modeling), encryption is not necessarily CPA-secure when XORing the pad with the plaintext. This is also explained in great detail in Katz-Lindell. In fact, it is ... 2 "What prevents an attacker from just sending the received ciphertext to the recipient who will think that this is the legitimate message?" Nothing.$\:$(In that case, the recipient will be correct.) Why "in the definition" is the attacker "only allowed to send another" message? If he knows before seeing the ciphertext that it will be an encryption of ... 2 As CodesInChaos notes in the comments, having more ciphertext–plaintext pairs doesn't help with brute force guessing attacks. Well, that is, except for the minor issue of unicity. Basically, to narrow the results of your brute force attack down to a single key, you do need to have enough ciphertext–plaintext pairs that the length of the known plaintext ... 1 A predictable nonce that cannot be controlled by the adversary is safe as a CFB IV (with some assumptions), as shown in the other answers. However, a nonce that can be chosen by an adversary is not safe against chosen plaintext attacks, as shown in Evaluation of Some Blockcipher Modes of Operation (page 36): Assume s = n. The adversary asks its oracle to ... 1 With multiple blocks the scheme is definitely not CPA as the same plaintext blocks encrypt to the same ciphertext. Using the security game given here as a framework for proving this, begin by letting$m_0 = 0^n0^n1^n$and$m_1 = 0^n1^n0^n$. Given back a ciphertext$c = Enc_{k1, k2}(m_i)$(where$i \in \{0, 1\}$) we can look at blocks two and three of$c\$ to ...

Only top voted, non community-wiki answers of a minimum length are eligible