Timeline for Are common (secure) stream ciphers CCA1-secure?
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 31, 2017 at 13:37 | vote | accept | SEJPM | ||
| Mar 28, 2017 at 10:24 | comment | added | Yehuda Lindell | @fgrieu The place that this appears is (implicitly) due to the fact that decryption queries for IVs that didn't appear in the past are answered as random. | |
| Mar 28, 2017 at 10:17 | comment | added | fgrieu♦ | I fully agree with the claim in the second sentence of the above comment, and the fact in the third. What I still do not get is the answer's proof sketch that CTR mode with random IV is IND-CCA1. I read it as starting from the established fact that this stream cipher is IND-CPA, and trying to prove IND-CCA1 from that; I accordingly read "the CPA oracle" in the answer's 1 and 3 as any hypothetical CPA attack algorithm against the stream cipher, that is being tentatively upgraded into a CCA1 attack algorithm. Doesn't my counterexample prove this can't be done? | |
| Mar 28, 2017 at 8:44 | history | edited | Yehuda Lindell | CC BY-SA 3.0 |
added 19 characters in body
|
| Mar 28, 2017 at 8:44 | comment | added | Yehuda Lindell | @fgrieu I did not claim that all stream-cipher type modes have the property that CPA implies CCA1. I merely claimed that for CTR with random IV, I believe that it does. Your counterexample does not change this. | |
| Mar 28, 2017 at 5:58 | comment | added | fgrieu♦ | I read this answer as suggesting that under the model of stream ciphers used for block ciphers in CTR mode, IND-CPA security implies IND-CCA1 security. I disagree. Proof sketch: I exhibit a small variant of CTR that's secure under CPA but not CCA, by making the block cipher output the key specifically when the input block is all-zero (decryption no longer works for the block cipher, but it still works for the stream cipher). Under the CCA1 game, the key is recovered by submitting a ciphertext with zero IV and first block; while the stream cipher is still demonstrably IND-CPA. | |
| Mar 27, 2017 at 18:30 | history | answered | Yehuda Lindell | CC BY-SA 3.0 |