Hot answers tagged chosen-plaintext-attack
13
It's the difference between an active and a passive attacker:
Known plaintext attack: The attacker knows at least one sample of both the plaintext and the ciphertext. In most cases, this is recorded real communication. If the XOR cipher is used for example, this will reveal the key as plaintext xor ciphertext.
Chosen plaintext attack: The attacker can ...
6
Thomas is correct; there's no attack on CFB mode if you can predict the IV; NIST is just being cautious.
With CBC, the value of the first encrypted block $C_0 = E_k( IV \oplus P_0)$, where $IV$ is the IV used for that packet, $P_0$ is the value of the first plaintext block, and $E_k$ is the evaluation of the block cipher.
If an attacker can predict the ...
5
I found a little more info on Google, so let me provide a partial answer to my own question. In particular, I found a post by David Wagner to sci.crypt in 2004, titled "IND-CPA for CFB mode", which in turn led me to a paper titled "Practical symmetric on-line encryption", published in FSE 2003 by Fouque, Martinet and Poupard.
In this paper, the authors ...
4
Encryption using a block cypher such as AES by passing plaintext blocks directly to the encryption function is known as Electronic Code Book mode (ECB) and is not CPA secure as (as you say in your question) it is entirely deterministic and two identical plaintext blocks will result in two identical ciphertext blocks.
To prevent this an initialisation ...
3
The $1/2^{32}$ is an arbitrary figure, based upon one particular value for what counts as an acceptable risk.
You need to decide what is an acceptable risk. If you think that a $1/2^{32}$ probability of failure is an acceptable risk, then this calculation is relevant to you. If you think it isn't, then decide what you think is an acceptable risk and re-do ...
3
I'm a little bit confused by your notation (what's $1^n$ supposed to mean? based on context, it looks like a key or a passphrase, but I've never seen that notation before), but the exercise itself seems to just amount to proving that an Encrypt-and-MAC scheme, using a deterministic MAC of the plaintext which is sent in plain, cannot be IND-CPA secure.
To ...
3
Sure. Assuming that you're using the encoding $A = 0$, $B = 1$, etc., just choose your plaintext messages to be the one-block strings:
$$
BA \dots A \\
AB \dots A \\
\vdots \\
AA \dots B
$$
The encryptions of these strings will then directly give you the columns of your key matrix.
2
As others have pointed out, there are some ciphers that can be broken if all you have is a known plaintext and the ciphertext. In general, because of this, those ciphers are considered very vulnerable and are not used anywhere. Or I should say, where they are used, the keys are generated (pseudo-) randomly and only used once.
However, if the attacker can ...
2
You are mistaken about what an encryption scheme is. As CodeInChaos pointed out AES is a primitive and we assume that it is a preudo random permutation. That is an assumption since the way AES is built means that we won't be able to formally prove that it is one. With that PRP we try to build modes of encryption that might or might not be CPA-secure
I ...
2
The standard approach is to break this problem into two pieces:
What information is unavoidably leaked, merely by computing the desired function? In your case, the goal is to compute $\sum_i x_i$. This sum unavoidably leaks a little bit of information about the $x_i$'s. For instance, as you correctly state, if we somehow know that all $x_i$'s are ...
1
To be secure against a chosen-plaintext attack, an encryption scheme must be non-deterministic — that is, its output must include a random element, so that e.g. encrypting the same plaintext twice will result in two different ciphertexts.
Indeed, if that was not the case, an attacker could easily win the IND-CPA game just by using the encryption ...
1
This is tricky and I don't know that there is a generic way to take care of all domain/auxiliary information.
The way we typically do proofs in multi-party computations is by defining an ideal world and show that the information generated in the ideal world (usually the encrypted inputs and the outputs) could be used to simulate the real world protocol ...
1
The typical way to make an encryption scheme work for variable length message is to use a mode of operation.
Since you are starting with an already IND-CPA secure cipher, even the often despised ECB mode will work. That said, you will still need padding to make the plaintext length a multiple of the blocksize. If adding padding is out of the question, a ...
1
A known plaintext attack is that if you know any of the plaintext that has been encrypted and have the resulting encrypted file, with a flawed encryption algorithm you can use that to break the rest of the encryption.
Example: We saw this with the old pkzip encryption method. In this case if you had any of the unencrypted files in the archive, you could ...
Only top voted, non community-wiki answers of a minimum length are eligible
