# Tag Info

2

First off, your definition is not IND-CPA: In the IND-CPA setting, the adversary has access to an encryption oracle. As you have already determined, no deterministic encryption scheme can be IND-CPA secure. I don't think IND-CPA is widely used for symmetric encryption though (although I might be wrong), semantic security might be a better option. For public ...

1

Yes, according to NIST SP 800-56A revision 2, a KDF based on HMAC-SHA-256 is a suitable option. The basic idea behind using a Key Based Key Derivation Function KBKDF is that the output of the the primitive within the key agreement protocol (DH, ECDH) returns enough entropy for a key to be created. However that entropy may still be distinguishable from ...

3

GMAC is quite simply GCM mode where all data is supplied as AAD (or additional authenticated data), or as NIST SP 800-38D puts it: If the GCM input is restricted to data that is not to be encrypted, the resulting specialization of GCM, called GMAC, is simply an authentication mode on the input data. If you don't have access to a cryptographic provider ...

0

It doesn't work without further restrictions. For simplification, let's assume Alice encrypts a bunch of files but doesn't have to send all of them to Bob. She can still decide to re-order the files or leave out some. Then she can encode the secret shared key between Alice and Bob in the least significant bits of the ciphertexts without changing the files. ...

0

What you want is a protocol where Alice sends a message to Bob without being able to control any ciphertext bits. This would be possible if either The message and encryption are completely deterministic and give Alice no freedom to choose between two ciphertexts, or Alice is unable to predict the ciphertext without sending a message. The first could be ...

2

I've found an answer to my question, I'm going to post it because it can be useful to someone out there. The point is that, if we assume that $\mbox{Prob}[\mbox{Priv}_{\mathcal{A},\Pi}^{\mbox{eav}}(n)=1]\leq 1/2+negl(n)$, then $\mbox{Prob}[\mbox{Priv}_{\mathcal{A},\Pi}^{\mbox{eav}}(n)=0]\leq 1/2+negl(n)$ too (if this were not to happen, then we could create ...

Top 50 recent answers are included