Tag Info

New answers tagged


You need to allow queries before the attacker outputs $m_0,m_1$ since maybe the queries help the attacker choose $m_0,m_1$ that are "easier" for it to attack. You need to allow queries after the attacker receives back the challenge ciphertext $c=E_k(m_b)$ since knowing $c$ may make it possible to generate a plaintext whose encryption helps to know what $c$ ...


I want to make this clear: You're defining $E_K(m):\{0,1\}^{2n}\times \{0,1\}^n\rightarrow \{0,1\}^{2n}$ as $E_K(m):=G(K)\oplus m$. This construction is well-known in the literature. It can't be CPA secure because it is a deterministic algorithm. However as discussed in Katz' and Lindell's book Introduction to Modern Cryptography it is secure against passive ...


Ask a CPA-query with a known $m$ and get back $c_0,c_1'$. Compute $c_1'' = c_1' \oplus m$. Then, compute $F^{-1}_r(c_1'')$ and this will be $k$. Now you know the key. Of course, this attack assumes that you can invert $F$, but nothing in the definition says you cannot (and in practice you often can).


If $a_i = c$ for all $i$, then clearly $a_{\pi(i)} = c$ for all $i$ as well, regardless of the permutation $\pi$. Thus, you can choose your two messages $a$ and $b$ such that, say, $a_i = 0$ and $b_i = 1$ for all $i$. This will then also be true for their encryptions under any permutation cipher, allowing you to trivially distinguish the encrypted messages ...

Top 50 recent answers are included