# Tag Info

9

First of all, you stated: Because this message is encrypted using CBC mode, any modification of the first block of cipher text would propagate throughout the message. Actually, that's not true. Here's the CBC mode operation in the decryption direction: (Public domain image from Wikimedia Commons.) If you examine the process closely, you will see ...

6

As mikeazo notes in the comments, RSA operates on the ring $\mathbb Z / n\mathbb Z$ of integers modulo $n$, for a given modulus $n = pq$. In this ring, $$E(m) \cdot t^e \equiv m^e \cdot t^e \equiv (mt)^e \equiv E(mt)\ \pmod n.$$ In particular, for $n = 35$, $e = 23$, $$17^{23} \cdot 2^{23} \equiv 33 \cdot 18 \equiv 594 \equiv 34 \equiv 34^{23}\ ... 6 For the 3rd proposal, see my comment to the question for the issues/questions I have regarding there. For the 2nd proposal, basically what you are proposing is using an IV with a stream cipher. The IV in this case being the hash of the file which would have to be shared in order to decrypt. In theory, it is a good idea. In practice, however, the track ... 4 There are different crypto-systems that have been called Hash-Elgamal. The one your exam refers to is likely whatever was included in your course. Without knowing that, we can't necessarily answer your question. The most common is the Elgamal variant defined with encryption function: c=\mathsf{Enc}(m,r)=\langle g^r, \mathcal{H}(y^r)\oplus m \rangle This ... 4 Commitment functions should be at least hiding and binding, and in your case, you want non-malleable. Using a hash function as a commitment does require addition assumptions on the hash that are not covered by (second) pre-image and collision resistance for both non-malleability (as you point out) and hiding: the hash can be assumed to not reveal the ... 4 Yes. Assume that the attacker knows the ciphertext c = c_1 \mathbin\| c_2, the initialization vector v and the plaintext m = m_1 \mathbin\| m_2. This tells them that D_k(c_1) = m_1 \oplus v and D_k(c_2) = m_2 \oplus c_1, where D_k(\cdot) denotes block cipher decryption under the (unknown) key k. In particular, this implies that, if the ... 3 I just want to add some additional information to the answer of Ilmari. As Ilmari has already described in his answer, when using RSA you work in the ring of integers {\mathbb Z}/{\mathbb Z}_n, which is also called a residue class ring. This means that it consists of the set of residue classes [i], where the i'th class is defined as the set \{a ... 3 I believe it would match the relaxed RCCA security, but it looks like it wouldn't be of much use because reencryption would not be secure. You could generate reencryptions of any ciphertext, but they would not be indistinguishable from each other, i.e. given c_1 and c_2 you can determine easily whether c_2 is a reencryption of c_1. 3 Non-malleability of Scrypt w.r.t. to salt (as well as passphrase) follows from the definition of Scrypt (which simply pass that salt to that input of PBKDF2); the definition of PBKDF2 (which uses the salt followed by a non-malleable encoding of an integer as a massage passed to HMAC_SHA256); the non-malleability of HMAC_SHA256 w.r.t. the message; and perhaps ... 2 Yes, in theory, but this doesn't usually work in practice. You are right in that the last-block ciphertext in this example is malleable to some extent, but not as much as you seem to suggest. It is true that here, if you were to change the last ciphertext block so that the first byte of its corresponding plaintext corresponds to some value you chose, it ... 2 What you are saying for hashing is actually more commonly known as Cramer-Shoup's crypto-system and yes it is non-malleable. You can read Lecture notes 22 given by Boaz Barak in Fall 2007 for more details. 2 This scheme isn't probabilistc so it could not be even CPA secure. Another weakness in this scheme is in the seed for PRG. the value "passcode"||"hashedvalue" is not uniformely distributed value. This mean that a CPA-attacker knows a part of the seed and then you cannot rely on the PRG property. A way to break the second weakness is to concatenate message ... 2 Your permutation idea is leaving the realm of encryption and trying to address a different type of idea: authentication. Encryption hides the bits, authentication gives confidence that they are being read as intended. But it doesn't do this properly, the attacker might still be able to flip bits. What if the random permutation maps the modified ciphertext ... 2 AES in counter mode works by XORing the output of an encrypted counter against the plain-text. This easily allows you to flip bits in the ciphertext and have that bit flip in the plain-text. The easiest way to get the kind of behaviour you're looking for is rather than XORing the encrypted counter against the plain-text, add it mod 2^{128}. Decryption ... 2 To learn more about this sort of attack, see my answer Don't use encryption without message authentication, where I detail many examples of systems that were broken because they used encryption without authentication. You will see that there is a wide variety of attacks that may be applicable, depending upon specific details of how the system works. You ... 2 The randomness is not enough for IND-CCA-2. If we get a message (so L bits of data plus the y to reconstruct the random seed), we can modify it, say flip the first bit, and ask the decryption oracle for a decryption of the modified message (which will have the same y!), which we will get. Then the original message can easily be obtained: we get the ... 2 Depending on how malleability is defined, the question actually has some merit. Given to the Wikipedia definition of malleability, a cipher is malleable if there exists at least one function g over the set of possible cipher texts, and one function f over the set of possible plain texts, such that given any cipher text c_0, the cipher text c_1 = ... 2 The answer to your question is contained in the Authenticity bound (Theorem 5.1). This is because Authenticity implies non-malleability (see e.g. http://eprint.iacr.org/2011/092.pdf). Note that only one term in the bound refers to the length of the tag (referred to by the variable \tau):$$\mathbf{Adv}_{OCB}^{auth}[\mathrm{Perm}(n), \tau] (A) \leq ...

1

What you are referring to is the same weakness in regard to malleability that is also applicable to (non-hashed schoolbook) RSA. In Elgamal an attacker can (in practice) not decrypt the transferred and encrypted message, but he can modify (factor) it and is able to determine the effect of his modification. Let $y$ be the original encrypted message of the ...

1

With the usual definition of AES-CTR or Xsalsa20, no, it is not possible to reliably perform some arithmetic operation $\odot$ (such as addition or multiplication) with a known constant $a$ on ciphertext, without some additional knowledge or restriction. In these stream ciphers, the ciphertext is the exclusive-OR of plaintext with some unknown keystream $K$, ...

Only top voted, non community-wiki answers of a minimum length are eligible