# Tag Info

## Hot answers tagged chosen-plaintext-attack

9

XXTEA (also known as Corrected Block TEA) is a block cipher with $128$-bit key and block width parameterizable to $n\cdot32$ bits for $n\ge2$. It is an Unbalanced Feistel Cipher making $q=6+\lfloor52/n\rfloor$ passes over the block, with $q\cdot n$ rounds each modifying $32$ bits of the block. In Cryptanalysis of XXTEA, it is presented a chosen-plaintext ...

8

That sounds like an overly succinct description of the 'Find then Guess' (FTG) notion of security, described in the paper "A Concrete Security Treatment of Symmetric Enryption". And you are correct, there is something the test is missing: the two 'challenge' plaintexts must be the same length ($|m_0| = |m_1|$). Also, the description is so succinct I can't ...

7

The XXTEA cipher is badly broken. Even though the paper is not published at a conference, the author verified it on reduced versions of XXTEA. You should never ever use a cipher or a hash function, that has been broken in academic terms, in particular if you are not a cryptographer. Attacks always get better, and a cipher does not attract much attention ...

7

CBC mode encryption is defined as: $C_i = E_k(P_i\oplus C_{i-1})$ (with $P_i$ being the $i$th plaintext block, and $C_{i-1}, C_i$ being the ciphertext blocks. What might happen if we have a lot of ciphertext encrypted with the same key is if two ciphertexts happen to be the same, that is: $C_i = C_j$ If we see that, we can then immediately deduce that: ...

7

These aren't "attacks" in and of themselves, they are simply a way to classify attacks depending on how many assumptions they make. For instance, if an attack requires plaintext-ciphertext pairs to recover the key, but they don't have to be any particular pairs, that attack is categorized as a known-plaintext attack. However if another attack required the ...

6

It seems to me that what you need is a public-key signature scheme like rsa signatures. The process would work something like this: A user license $L$ is created by your license generator Your system signs it to give $s(L)$ and the licence is $\{L,s(L)\}$. When program tries to open the user's license $\{t,v\}$: The system verifies that $v$ is indeed ...

6

This isn't just limited to asymmetric schemes; in any chosen-plaintext attack, even for symmetric ciphers, the attacker can (by definition of the CPA game) compute as many encryptions as they like (limited to polynomial time, of course). Formally, we say the adversary is given access to an "encryption oracle." Anyway, you have stumbled across a necessary ...

5

I do not remember if we checked this explicitly, but my guess is that in the chosen-plaintext setting the biclique attack would still be faster than the exhaustive search, maybe by the factor of 2 compared with 4 in the chosen-ciphertext setting. However, both results are pretty far from declaring AES broken in any sense. Such small gain over exhaustive ...

4

Under a chosen-plaintext attack, the adversary has the power to encrypt polynomially-many chosen plaintexts. In the symmetric world, since only the valid parties hold the encryption key, only the valid parties can "grant" the adversary access to an encryption oracle. So, it isn't assumed that an eavesdropper necessarily has access to an encryption oracle. ...

4

Yes. Assume that the attacker knows the ciphertext $c = c_1 \mathbin\| c_2$, the initialization vector $v$ and the plaintext $m = m_1 \mathbin\| m_2$. This tells them that $D_k(c_1) = m_1 \oplus v$ and $D_k(c_2) = m_2 \oplus c_1$, where $D_k(\cdot)$ denotes block cipher decryption under the (unknown) key $k$. In particular, this implies that, if the ...

3

The $1/2^{32}$ is an arbitrary figure, based upon one particular value for what counts as an acceptable risk. You need to decide what is an acceptable risk. If you think that a $1/2^{32}$ probability of failure is an acceptable risk, then this calculation is relevant to you. If you think it isn't, then decide what you think is an acceptable risk and re-do ...

3

This result is proven in the following research papers: Johan Hastad, Mats Naslund. The Security of all RSA and Discrete Log Bits. Journal of the ACM, Oct 2003, pp.1--45. W. Alexi, B. Chor, O. Goldrech, C. Schnorr. RSA and Rabin functions: Certain parts are as hard as the whole. SIAM Journal on Computing, vol 17 no 2, pp.194--209. They show that if ...

3

Advantage and success probability are just words. Their meaning is in practice decided by how the speakers of the language use the words. You have observed that people use the terms advantage and probability in this way. One could probably argue that this is confusing or illogical or something like that, but such is language. About dividing by two: ...

3

Yes, this is easy enough to exploit. Start by sending any 15-byte message $m$, and then 256 different 16-byte messages consisting of $m$ followed by each of the 256 possible values of the last byte. One of the encrypted 16-byte messages will have the same first ciphertext block as the encryption of $m$. Find out which, and you've found the first byte of ...

2

ICE is a block cipher operating on 64-bit data blocks (which is a bit dated, and less than perfectly safe in some usage scenario involving a huge amount of data). Depending on implementations, the key can be 64-bit (which is quite dated, and unsafe against a potent attacker), or some higher multiple (128-bit is fine for longer than I dare try making ...

2

If a user has a copy of both the encrypted and decrypted data, he is in a position to perform at least a known-plaintext attack. If users can submit arbitrary plaintexts for encryption, they can conduct a chosen-plaintext attack, which is stronger. In a chosen-plaintext attack, the attacker can submit any number of plaintexts and can retrieve the ...

2

There are a surprisingly large number of subtly different definitions of CPA indistinguishability. What you describe in points 1 through 5 is one that I have heard of, though at the end of your post you make it 'iterative', in the sense that $\mathcal{A}$ can play the game over and over with $\mathcal{E}$ using the same secret key but fresh, ...

1

Your master secret is never secure, at least not as you have described it. As a user, I know my private secret. When I use your application, my private secret decrypts the master secret right there in the application. With modest technical skills, I can examine the memory of the process or machine and read the master secret in plaintext any time I wish. I ...

1

It's hard to be sure without seeing a bit more context, but the paragraph you quoted looks like it's part of a definition of IND-CPA security (ciphertext indistinguishability under a chosen-plaintext attack) for public-key ciphers. Here's the corresponding definition from the Wikipedia article I linked to above: "For a probabilistic asymmetric key ...

1

The answer is 1 I think because if we apply a chosen plain text attack, then we need at least 2 encrypted alphabets and two plaintext alphabets corresponding to the related encrypted alphabets. Then we will have two variable and two equations. By solving those you can get the additive key as well as the multiplicative key.

Only top voted, non community-wiki answers of a minimum length are eligible