# Tag Info

0

A CPA on the second scheme is exactly the same thing as a CPA on the first one, provided that the attacker never calls the encryption oracle on a message which equals the key. But the latter can happen only with negligible probability, otherwise the first scheme would not be CPA-secure since it has the same key generation algorithm. Thus, for any CPA attack ...

1

EDIT: I realised that I assumed an IND-CPA game where the adversary has pre- and post-challenge access to the encryption oracle and not only pre-challenge access. I'll edit my answer soon. I'll give the idea and leave the concrete analysis to you. You want to show that single-query IND-CPA implies multi-query IND-CPA or in other words if there is an ...

1

The Game described in #1 is equivalent to IND-CPA security according the CRYPTUTOR wiki from UIUC (The section on modifications). This may explain why Mikero had trouble coming up with a counter example.

1

The oracle in step 3 is absolutely necessary. Check the answer to this question for an example that would break IND-CPA security otherwise. On the other hand, the oracle in step 5 may be unnecessary for IND-CPA security according to the alternate formulations of IND-CPA suggested in the CRYPTUTOR wiki from UIUC.

0

Consider an IND-CPA secure scheme that has the setup, encrypt and decrypt functions as $S_{secure}$, $E_{secure}$ and $D_{secure}$ respectively. Consider another scheme with setup, encrypt and decrypt functions as $S_{IR}$, $E_{IR}$ and $D_{IR}$ respectively. Let $S_{IR}$ be the same as $S_{secure}$ to produce the key $K$. Let $E_{IR}$ run $E_{secure}(K, ... 2 As CodesInChaos notes in the comments, having more ciphertext–plaintext pairs doesn't help with brute force guessing attacks. Well, that is, except for the minor issue of unicity. Basically, to narrow the results of your brute force attack down to a single key, you do need to have enough ciphertext–plaintext pairs that the length of the known plaintext ... 2 I will think more about a proof/counterexample for #1, but here is a counterexample for #2. Let$\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec}$refer to a CPA-secure encryption scheme with message space$\{0,1\}^\lambda$, and define the following modified scheme:$\mathsf{KeyGen}'$: run$sk \gets \mathsf{KeyGen}$and sample$m^* \gets \{0,1\}^\lambda\$. The ...

Top 50 recent answers are included