Timeline for Chosen plain text and chosen ciphertext definitions clarification
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 31, 2015 at 13:26 | comment | added | mephisto | Your main fault is that you do not add the security model name. The models for plain encryption are SEM-CPA, IND-CPA, SEM-CCA, IND-CCA,... here, SEM / IND describes which goal is modelled (privacy of encryption) and CPA / CCA models the capabilities of the attacker. For authenticated encryption the schemes have to fulfill additional properties like INT-CTXT which models the integrity property. However, this property has to be reached IN ADDITION to IND-CPA for example. For these models the goal is to generate a forged ciphertext that the adversary did not learn from the user... | |
| Aug 31, 2015 at 13:10 | comment | added | Ilya Chernomordik | What about the CCA security for the authenticated encryption? I am following Dan Boneh lections on coursera and he defined CCA security for the authenticated encryption with the same limitation of not reusing the message there... | |
| Aug 31, 2015 at 13:01 | comment | added | mephisto | @IlyaChernomordik You seem to have fallen for the common misconception that encryption provides integrity / authenticity. That's not the case! If you want these properties you have to add a message authentication code (MAC) in the symmetric or a signature in the asymmetric setting. For plain encryption we only ask for the privacy of an encrypted message which is modelled by IND or semantic security. For that reason the above model does not include a goal for the adversary that says "forge an encryption". | |
| Aug 31, 2015 at 11:29 | comment | added | Dillinur | Because the goal is not to "manipulate the server", it's to break the crypto-system. So the question is more like "If the attacker have an encryption oracle, does that help him to decrypt any arbitrary ciphertext?". | |
| Aug 31, 2015 at 7:13 | comment | added | Ilya Chernomordik | Thanks for additional explanations but I still did not get how this model the situation I described: when an adversary has an encryption oracle and encrypts a forged message, why he can't just use it to manipulate the server? | |
| Aug 31, 2015 at 4:15 | history | answered | mephisto | CC BY-SA 3.0 |