# Tag Info

16

This is a common mistake, so I'd like to give an in-depth answer. Basically, what you are proposing is to rely on the ONE-WAYNESS of RSA as a ONE-WAY FUNCTION, rather than relying on its CPA or CCA security as an encryption scheme. The advantage of using RSA as a one-way function is that no padding etc is needed. Now, the first important thing to note is ...

6

This isn't really a "hard" answer, but an attempt to give some intuition or motivation. One can interpret indistinguishability as an overapproximation of the most common notions of security: Any system that is broken in a more practical way will also fail to meet indistinguishability, that is, all practically important security requirements are in fact ...

5

You can generate a random string $s_1$ as long as the plaintext. Then XOR this value with the plaintext generating $s_2$. Now encrypt both parts using $\mathrm{Enc}_1$ and $\mathrm{Enc}_2$. You need to decrypt both to XOR the two parts together again. This is similar to secret sharing where you need two parts of a key to decrypt. If $\mathrm{Gen}_1$ and ...

5

No. There is a difference between the type of a cipher and the construction of a cipher. If a cipher is of a specific type for which there are known IND-CPA secure constructions then that doesn't mean that an entirely different construction is secure. There are known attacks on stream ciphers, including "modern" stream ciphers such as RC4. If the generated ...

4

Katz & Lindell mention in their book "Introduction to Modern Cryptography: Principles and Protocols" an example of an IND-CPA attack from World War II. Navy cryptanalysts suspected that Japanese ciphertexts containing the fragment "AF" where referring to the Midway island. Then, they told officials at Midway to send unencrypted messages reporting they ...

3

The difference is how the plaintext-ciphertext pairs that the attacker has access to are generated. In a chosen plaintext attack, the attacker chooses some plaintext and is handed the corresponding ciphertext. In other words, the attacker may encrypt arbitrary messages. In a chosen ciphertext attack, the attacker can additionally (a chosen ciphertext ...

3

If you can read the intermediate states of the encryption algorithm you could recover, one by one all the round keys. Given a AES round, all the operation between the two AddRoundKey (at the beginning and the ond of the round) are invertible. Take for example round 1: you get the internal state before AddRoundKey (of round 2), you get back at the beginning ...

3

Note: In this answer, I stick to a definition of the One Time Pad where the random pad is used only One Time; at least, I've the name of it as support! Otherwise, it is well known that the OTP encryption scheme consisting of XOR with a repeated key is insecure by even the weakest standard (unknown plaintext with redundancy). INDistinguishability under ...

3

Yes, if (and this is important) the keys for $E$ and $S$ are selected independently. Consider that we had two encryption methods $E$, $S$ for which their composition $E(S(x))$ is not CPA secure; that is, we have some distinguisher $D$ that had some advantage in distinguishing that from a random function. Then, we can build a distinguisher for $E$ (by ...

3

The important thing to note here is that $\mathsf{D}(k,0)=0$ does not necessarily imply that $\mathsf{E}(k,0)=0$. That is the reason why your attack does not work in general. To illustrate, let $(\mathsf{E},\mathsf{D})$ be a CCA secure encryption scheme. We then construct a new encryption scheme $(\mathsf{E'},\mathsf{D'})$ as follows: $$\mathsf{E'}(k,m) = ... 3 Assuming you don't use counter-measures against this kind of an attack, a chosen-ciphertext attack works as follows: Variables: p is field prime, \alpha is the chosen generator, a is the private key, \alpha^a=\beta is the public key. k' and m' are chosen at random. Note: all the following equations are (mod p). Suppose you want to decrypt ... 3 With chosen-plaintext attack, the attacker is allowed to choose an arbitary amount of plaintext to encrypt. After that he/she can't do that again, he/she has to work with the current data. With the adaptive-chosen-plaintext attack, he/she can do the same as with the chosen-plaintext attack, but is also allowed to encrypt new data after the attacker has ... 2 One can't "get rid of" the factor 2. However, there might be a way to replace it with 2\hspace{-0.03 in}-\hspace{-0.03 in}o(1)\: where that depends on q and the advantage. || is concatenation. Start with some encryption scheme \mathcal{E}'\hspace{-0.04 in}, and for any integer n and probability p, let \mathcal{E}_{\hspace{.02 ... 2 Here is the answer for why a deterministic public-key encryption scheme cannot be CPA secure. For CPA security it is sufficient if an adversary can distinguish between encryptions of two messages m_0 and m_1. That is, an adversary gets to see an encryption c \gets \textsf{Enc}(pk,m_b) for a random bit b together with the public key pk. Now in ... 2 Faliure of indistinguishablity of encryptions under a eavesdropper does imply faliure of indistinguishablity of encryptions under a chosen-plaintext attack. But the converse is not necessarily true (ex. OTP) The aim of CPA-secure is not to decrypt previously unobserved ciphertext but to pass the distinguishability test after a set of (plaintext, ciphertext) ... 2 No. This isn't secure by itself against chosen-plaintext attacks. This mode is known as plaintext-feedback mode (PFB) and referenced for example in here. The next point is this mode hasn't received much attention in the cryptographic literature, whereas other modes (CFB, OFB, CBC, CTR) have. Two notes: Don't roll your own crypto. Never use such modes if ... 2 The ideal encryption scheme E would be one that, for every ciphertext C=E(K, M), if the key remains secret for the adversary, the probability of identifying M is negligible. Since that is not possible in practice, the second most reasonable approach is to define constraints strong enough to satisfy some definition of security. The IND- notation ... 2 Here's an artificial example: Start with some secure encryption scheme with encryption function \mathcal{E}(\cdot), and construct a new scheme with encryption function \mathcal{E}'(\cdot), which for any input message m copies the first bit, b, of the message, and outputs b||\mathcal{E}(m), where || denotes concatenation. For such a scheme, ... 2 No. Indeed, as in the answer by Maarten, it depends on the security and strength of the stream cipher. However, even if the stream cipher is a secure pseudorandom generator (which is its proper modeling), encryption is not necessarily CPA-secure when XORing the pad with the plaintext. This is also explained in great detail in Katz-Lindell. In fact, it is ... 1 A predictable nonce that cannot be controlled by the adversary is safe as a CFB IV (with some assumptions), as shown in the other answers. However, a nonce that can be chosen by an adversary is not safe against chosen plaintext attacks, as shown in Evaluation of Some Blockcipher Modes of Operation (page 36): Assume s = n. The adversary asks its oracle to ... 1 Yes, you can. Your construction C=P\oplus KDF(K||N) is IND-CPA secure, assuming the KDF is secure, which is reasonable. This construction can be used and is sometimes used with ECIES (meaning E_K(M)=K\oplus M), but I'd recommend against using it. Replacing the KDF with AES is as secure as the above construction, as this mode is called CTR-mode, which is ... 1 For example, let say that you have a message: "100 dollars should be moved." and you encrypt it with OTP. Then everybody can just take the first character "1" and change it to a 9 by XOR the 1 from the cipher-text and then XOR a "9" with the key you got. What you are describing is what happens if an attacker introduces changes in the ciphertext by a ... 1 Is CBC mode in OTP more secure? No. If your one time pad satisfies the required properties (it's truly random, the attacker has no information about it, and it's only used once), then OTP already has perfect secrecy; playing around with how it works can't make things better. If your one time pad doesn't satisfy the required properties, then all bets ... 1 Actually, I think I found the answer to my question while writing it, but I'll post it anyway, since it might be interesting to others: Yes, OFB mode is secure even with 8-bit feedback, at least as long as IVs are chosen randomly. Specifically, in the paper "New proof for old modes" (IACR Cryptology ePrint Archive, 2008), which I've cited earlier here, ... 1 how will having a few samples of plaintext-ciphertext pairs help Eve find out p [in the second scheme]? Well, suppose we have four plaintext/ciphertext pairs, and lets look at what is available to the attacker. We make the plaintexts m_1, m_2, m_3, m_4, and the corresponding ciphertexts:$$e_1 = a m_1 + b + k_1 pe_2 = a m_2 + b + k_2 p ...

1

While OAEP uses a one-way function on the plaintext, it's not quite a hash: it's called a mask generation function (MGF), and unlike a hash it can produce as much or as little output as you want (the output length is an argument to the function, and input length is decoupled from output length). This output should be pseudorandom. You use this in a ...

1

There exist many standards which describe a lot of padding modes and security protocols. If you're new in that field, I strongly recommend you to study the family of PKCS standards which are the reference in the domain. There also exist other distinct standards depending of very specific application fields (Banking, mobile, Cloud, Embedding ... or Global ...

1

Xor can help find bits not yet known, whether most significant or least significant; and help the adversary find more information about both ciphertext and plaintext, especially if a table of potential plain texts or even keys is stored in conjunction with bitwise Xor. Some reading: ...

Only top voted, non community-wiki answers of a minimum length are eligible