Tag Info

Hot answers tagged

3

The important thing to note here is that $\mathsf{D}(k,0)=0$ does not necessarily imply that $\mathsf{E}(k,0)=0$. That is the reason why your attack does not work in general. To illustrate, let $(\mathsf{E},\mathsf{D})$ be a CCA secure encryption scheme. We then construct a new encryption scheme $(\mathsf{E'},\mathsf{D'})$ as follows: $$\mathsf{E'}(k,m) = ...


3

The difference is how the plaintext-ciphertext pairs that the attacker has access to are generated. In a chosen plaintext attack, the attacker chooses some plaintext and is handed the corresponding ciphertext. In other words, the attacker may encrypt arbitrary messages. In a chosen ciphertext attack, the attacker can additionally (a chosen ciphertext ...


3

If you can read the intermediate states of the encryption algorithm you could recover, one by one all the round keys. Given a AES round, all the operation between the two AddRoundKey (at the beginning and the ond of the round) are invertible. Take for example round 1: you get the internal state before AddRoundKey (of round 2), you get back at the beginning ...


3

Assuming you don't use counter-measures against this kind of an attack, a chosen-ciphertext attack works as follows: Variables: $p$ is field prime, $\alpha$ is the chosen generator, $a$ is the private key, $\alpha^a=\beta$ is the public key. $k'$ and $m'$ are chosen at random. Note: all the following equations are $(mod$ $p)$. Suppose you want to decrypt ...


3

With chosen-plaintext attack, the attacker is allowed to choose an arbitary amount of plaintext to encrypt. After that he/she can't do that again, he/she has to work with the current data. With the adaptive-chosen-plaintext attack, he/she can do the same as with the chosen-plaintext attack, but is also allowed to encrypt new data after the attacker has ...


2

Here is the answer for why a deterministic public-key encryption scheme cannot be CPA secure. For CPA security it is sufficient if an adversary can distinguish between encryptions of two messages $m_0$ and $m_1$. That is, an adversary gets to see an encryption $c \gets \textsf{Enc}(pk,m_b)$ for a random bit $b$ together with the public key $pk$. Now in ...


2

First off, your definition is not IND-CPA: In the IND-CPA setting, the adversary has access to an encryption oracle. As you have already determined, no deterministic encryption scheme can be IND-CPA secure. I don't think IND-CPA is widely used for symmetric encryption though (although I might be wrong), semantic security might be a better option. For public ...


1

how will having a few samples of plaintext-ciphertext pairs help Eve find out p [in the second scheme]? Well, suppose we have four plaintext/ciphertext pairs, and lets look at what is available to the attacker. We make the plaintexts $m_1$, $m_2$, $m_3$, $m_4$, and the corresponding ciphertexts: $$e_1 = a m_1 + b + k_1 p$$ $$e_2 = a m_2 + b + k_2 p$$ ...


1

While OAEP uses a one-way function on the plaintext, it's not quite a hash: it's called a mask generation function (MGF), and unlike a hash it can produce as much or as little output as you want (the output length is an argument to the function, and input length is decoupled from output length). This output should be pseudorandom. You use this in a ...


1

There exist many standards which describe a lot of padding modes and security protocols. If you're new in that field, I strongly recommend you to study the family of PKCS standards which are the reference in the domain. There also exist other distinct standards depending of very specific application fields (Banking, mobile, Cloud, Embedding ... or Global ...


1

Xor can help find bits not yet known, whether most significant or least significant; and help the adversary find more information about both ciphertext and plaintext, especially if a table of potential plain texts or even keys is stored in conjunction with bitwise Xor. Some reading: ...



Only top voted, non community-wiki answers of a minimum length are eligible