# Tag Info

18

In short: You must authenticate the IV. Which particular attacks apply if you don't depends on the block cipher mode; I will give two common examples. In CTR mode, an attacker who fiddles with the IV can forge authenticated messages, but the content of the corresponding plaintext is beyond his control (since he doesn't know the key). Depending on the ...

12

First of all, you stated: Because this message is encrypted using CBC mode, any modification of the first block of cipher text would propagate throughout the message. Actually, that's not true. Here's the CBC mode operation in the decryption direction: (Public domain image from Wikimedia Commons.) If you examine the process closely, you will see ...

6

For the 3rd proposal, see my comment to the question for the issues/questions I have regarding there. For the 2nd proposal, basically what you are proposing is using an IV with a stream cipher. The IV in this case being the hash of the file which would have to be shared in order to decrypt. In theory, it is a good idea. In practice, however, the track ...

6

As mikeazo notes in the comments, RSA operates on the ring $\mathbb Z / n\mathbb Z$ of integers modulo $n$, for a given modulus $n = pq$. In this ring, $$E(m) \cdot t^e \equiv m^e \cdot t^e \equiv (mt)^e \equiv E(mt)\ \pmod n.$$ In particular, for $n = 35$, $e = 23$, $$17^{23} \cdot 2^{23} \equiv 33 \cdot 18 \equiv 594 \equiv 34 \equiv 34^{23}\ \pmod{35}... 5 Yes. Assume that the attacker knows the ciphertext c = c_1 \mathbin\| c_2, the initialization vector v and the plaintext m = m_1 \mathbin\| m_2. This tells them that D_k(c_1) = m_1 \oplus v and D_k(c_2) = m_2 \oplus c_1, where D_k(\cdot) denotes block cipher decryption under the (unknown) key k. In particular, this implies that, if the ... 4 Commitment functions should be at least hiding and binding, and in your case, you want non-malleable. Using a hash function as a commitment does require addition assumptions on the hash that are not covered by (second) pre-image and collision resistance for both non-malleability (as you point out) and hiding: the hash can be assumed to not reveal the ... 4 There are different crypto-systems that have been called Hash-Elgamal. The one your exam refers to is likely whatever was included in your course. Without knowing that, we can't necessarily answer your question. The most common is the Elgamal variant defined with encryption function: c=\mathsf{Enc}(m,r)=\langle g^r, \mathcal{H}(y^r)\oplus m \rangle This ... 4 I believe it would match the relaxed RCCA security, but it looks like it wouldn't be of much use because reencryption would not be secure. You could generate reencryptions of any ciphertext, but they would not be indistinguishable from each other, i.e. given c_1 and c_2 you can determine easily whether c_2 is a reencryption of c_1. 4 The Encrypt then MAC is done in general in order to be sure to decrypt into the correct plaintext, without risking of parsing a non-authentic plaintext message. If you don't MAC the IV, then Mallory (attacker that can tamper with messages as a man-in-the-middle) can modify the IV and your MAC will be still validated as good. So you will decrypt into an ... 3 The answer may depend on your exact definitions of "homomorphic" and "malleable", but I'll give it a shot. Basically, homomorphic encryption denotes that, given encryptions E_k(x) and E_k(y) of some values x and y, it is possible to obtain an encryption of x\ast y under k from E_k(x) and E_k(y), where \ast is some binary operation, without ... 3 Vigenere Cryptosystem is as follow: You chose a key (K_0,...,K_{m-1}) consisting of elements in Z_{26}. Then a ciphertext for the message (M_0,...,M_{n-1}) is$$(M_i+K_{i\mod m}\mod 26)_{i \in [0..n-1]}$$It is easy to see that you can generate a ciphertext for the message (M_0+1,...,M_{n-1}+1) by adding 1 to each letter. It is therefore by ... 3 FFX is not malleable. It's a strong tweakable pseudo-random permutation, where the "strong" here indicates that both encryption and decryption look like random permutations from the attacker's perspective. In particular, there's no relationship between the plaintexts of closely related ciphertexts (aside from the trivial observation that different ... 3 I just want to add some additional information to the answer of Ilmari. As Ilmari has already described in his answer, when using RSA you work in the ring of integers {\mathbb Z}/{\mathbb Z}_n, which is also called a residue class ring. This means that it consists of the set of residue classes [i], where the i'th class is defined as the set \{a \... 3 To learn more about this sort of attack, see my answer Don't use encryption without message authentication, where I detail many examples of systems that were broken because they used encryption without authentication. You will see that there is a wide variety of attacks that may be applicable, depending upon specific details of how the system works. You ... 3 Depending on how malleability is defined, the question actually has some merit. Given to the Wikipedia definition of malleability, a cipher is malleable if there exists at least one function g over the set of possible cipher texts, and one function f over the set of possible plain texts, such that given any cipher text c_0, the cipher text c_1 = g(... 3 Non-malleability of Scrypt w.r.t. to salt (as well as passphrase) follows from the definition of Scrypt (which simply pass that salt to that input of PBKDF2); the definition of PBKDF2 (which uses the salt followed by a non-malleable encoding of an integer as a massage passed to HMAC_SHA256); the non-malleability of HMAC_SHA256 w.r.t. the message; and perhaps ... 2 AES in counter mode works by XORing the output of an encrypted counter against the plain-text. This easily allows you to flip bits in the ciphertext and have that bit flip in the plain-text. The easiest way to get the kind of behaviour you're looking for is rather than XORing the encrypted counter against the plain-text, add it mod 2^{128}. Decryption ... 2 This scheme isn't probabilistc so it could not be even CPA secure. Another weakness in this scheme is in the seed for PRG. the value "passcode"||"hashedvalue" is not uniformely distributed value. This mean that a CPA-attacker knows a part of the seed and then you cannot rely on the PRG property. A way to break the second weakness is to concatenate message ... 2 Your permutation idea is leaving the realm of encryption and trying to address a different type of idea: authentication. Encryption hides the bits, authentication gives confidence that they are being read as intended. But it doesn't do this properly, the attacker might still be able to flip bits. What if the random permutation maps the modified ciphertext ... 2 What you are saying for hashing is actually more commonly known as Cramer-Shoup's crypto-system and yes it is non-malleable. You can read Lecture notes 22 given by Boaz Barak in Fall 2007 for more details. 2 The answer to your question is contained in the Authenticity bound (Theorem 5.1). This is because Authenticity implies non-malleability (see e.g. http://eprint.iacr.org/2011/092.pdf). Note that only one term in the bound refers to the length of the tag (referred to by the variable \tau):$$\mathbf{Adv}_{OCB}^{auth}[\mathrm{Perm}(n), \tau] (A) \leq \...

2

The randomness is not enough for IND-CCA-2. If we get a message (so $L$ bits of data plus the $y$ to reconstruct the random seed), we can modify it, say flip the first bit, and ask the decryption oracle for a decryption of the modified message (which will have the same $y$!), which we will get. Then the original message can easily be obtained: we get the ...

2

Yes, in theory, but this doesn't usually work in practice. You are right in that the last-block ciphertext in this example is malleable to some extent, but not as much as you seem to suggest. It is true that here, if you were to change the last ciphertext block so that the first byte of its corresponding plaintext corresponds to some value you chose, it ...

1

Will this method deliver true non-malleability? No. If we set the ciphertext to the value $(B, B)$, then the decrypted plaintext will have the second block as $B$ (assuming that the PCBC mode uses an implicit plaintext/ciphertext IV of 0; if it's two known constants, it's easy to adjust for that). Even if we ignore this, it also fails to make sure that ...

1

With the usual definition of AES-CTR or Xsalsa20, no, it is not possible to reliably perform some arithmetic operation $\odot$ (such as addition or multiplication) with a known constant $a$ on ciphertext, without some additional knowledge or restriction. In these stream ciphers, the ciphertext is the exclusive-OR of plaintext with some unknown keystream $K$, ...

1

What you are referring to is the same weakness in regard to malleability that is also applicable to (non-hashed schoolbook) RSA. In Elgamal an attacker can (in practice) not decrypt the transferred and encrypted message, but he can modify (factor) it and is able to determine the effect of his modification. Let $y$ be the original encrypted message of the ...

Only top voted, non community-wiki answers of a minimum length are eligible