# Tag Info

As mikeazo notes in the comments, RSA operates on the ring $\mathbb Z / n\mathbb Z$ of integers modulo $n$, for a given modulus $n = pq$. In this ring, $$E(m) \cdot t^e \equiv m^e \cdot t^e \equiv (mt)^e \equiv E(mt)\ \pmod n.$$ In particular, for $n = 35$, $e = 23$, $$17^{23} \cdot 2^{23} \equiv 33 \cdot 18 \equiv 594 \equiv 34 \equiv 34^{23}\ ... 4 Yes. Assume that the attacker knows the ciphertext c = c_1 \mathbin\| c_2, the initialization vector v and the plaintext m = m_1 \mathbin\| m_2. This tells them that D_k(c_1) = m_1 \oplus v and D_k(c_2) = m_2 \oplus c_1, where D_k(\cdot) denotes block cipher decryption under the (unknown) key k. In particular, this implies that, if the ... 3 I just want to add some additional information to the answer of Ilmari. As Ilmari has already described in his answer, when using RSA you work in the ring of integers {\mathbb Z}/{\mathbb Z}_n, which is also called a residue class ring. This means that it consists of the set of residue classes [i], where the i'th class is defined as the set \{a ... 3 I believe it would match the relaxed RCCA security, but it looks like it wouldn't be of much use because reencryption would not be secure. You could generate reencryptions of any ciphertext, but they would not be indistinguishable from each other, i.e. given c_1 and c_2 you can determine easily whether c_2 is a reencryption of c_1. 2 Depending on how malleability is defined, the question actually has some merit. Given to the Wikipedia definition of malleability, a cipher is malleable if there exists at least one function g over the set of possible cipher texts, and one function f over the set of possible plain texts, such that given any cipher text c_0, the cipher text c_1 = ... 2 The answer to your question is contained in the Authenticity bound (Theorem 5.1). This is because Authenticity implies non-malleability (see e.g. http://eprint.iacr.org/2011/092.pdf). Note that only one term in the bound refers to the length of the tag (referred to by the variable \tau):$$\mathbf{Adv}_{OCB}^{auth}[\mathrm{Perm}(n), \tau] (A) \leq ...
What you are referring to is the same weakness in regard to malleability that is also applicable to (non-hashed schoolbook) RSA. In Elgamal an attacker can (in practice) not decrypt the transferred and encrypted message, but he can modify (factor) it and is able to determine the effect of his modification. Let $y$ be the original encrypted message of the ...