# Tag Info

7

In step 2, the adversary outputs two messages. One of these will be selected at random for encryption. You can think of the adversary sending these messages to a "challenger" that also has oracle access (or is the oracle itself). It doesn't really matter who is running the challenge since the challenger doesn't have any "intelligence." All the challenger ...

5

The idea of IND-CCA2 (indistinguishable under an adaptive chosen-ciphertext attack) is that the attacker has no chance to distinguish the ciphertexts of two given plaintext messages, even if it can feed the decryption machine other ciphertexts for decryption. In the second part of the experiment, the adversary has to chose two messages for the challenge (of ...

5

Intuition The intuition behind the proof is that a valid ciphertext is correctly generated and, thus, an adversary should query to the random oracles to generate random strings in the ciphertext. In addition, notice that the hash value on an unqueried string is undetermined (to the adversary) in the random oracle model. Therefore, the chance to construct a ...

5

INT-CTXT and INT-PTXT are usually on considered for private-key encryption. For public-key encryption, no correct encryption scheme can satisfy those requirements. (Proof: The adversary can run the encryption algorithm on an arbitrary message and submit it as its output. Since it made no queries to its encryption oracle, this ciphertext violates both ...

4

No, there are also CCA games for private key encryption schemes. There you have additional encryption oracles that you can use, to obtain encryptions for messages of your choice (in a private key encryption scheme you can not encrypt yourself, because this requires the secret key). See here for a concise explanation and comparison: ...

2

An "encryption scheme" defines the encryption/decryption of data. A "message transmission scheme" is about securing transmission and defines both "privacy" and "authenticity" between a sender and a receiver. Since you haven't asked about the definition of CCA-secure (encryption) schemes and since you've been given this as an exercise, I won't mention ...

2

The randomness is not enough for IND-CCA-2. If we get a message (so $L$ bits of data plus the $y$ to reconstruct the random seed), we can modify it, say flip the first bit, and ask the decryption oracle for a decryption of the modified message (which will have the same $y$!), which we will get. Then the original message can easily be obtained: we get the ...

2

[EDIT: I am assuming a public key system here] IND-CCA2 summary: get encryption key. make decryption queries on chosen ciphertexts. obtain challenge ciphertext on $m_L$, $m_R$, two equal-length messages chosen by you, the attacker. The challenger is suppsed to randomply pick one, encrypt it and return the ciphertext. make decryption queries as in 2. ...

1

The Fujisaki-Okamoto construction requires a non-deterministic public key encryption scheme. Textbook RSA is not randomized, but deterministic, and so it cannot be applied to it to obtain CCA-security. It can be applied to schemes like Elgamal and Paillier that take randomness to create indistinguishable encryptions of the same message.

Only top voted, non community-wiki answers of a minimum length are eligible