Timeline for Indistinguishability of symmetric encryption under CCA
Current License: CC BY-SA 4.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 16, 2022 at 20:21 | vote | accept | driewguy | ||
| Feb 16, 2022 at 17:38 | comment | added | Mikero | yet another way to understand CCA: suppose I accept a ciphertext $c$ and I am willing to reveal the answer to one tiny question about $\textsf{Dec}(c)$. CCA ensures that I'm only revealing what I want. Without CCA, if I answer that question about $c$ and $c_1$ and $c_2$ etc, then it might reveal more than I wanted about $c$. Without CCA, information about $c$ can "leak into" other ciphertexts $c_i$, so that the answer to this question about $c_i$ lets the attacker learn more about what's inside $c$. | |
| Feb 16, 2022 at 16:07 | comment | added | driewguy | Great explanation! I understood some of the rationale behind the security notions. I can see how IND-CCA1 security would be relevant. But IND-CCA2 notion, where adversary can choose cipher texts to send to decryption oracle based on unknown cipher texts, still seems far fetched. What scenarios do IND-CCA2 notion model? After seeing an unknown cipher text if adversary is allowed to choose cipher texts what prevents him to choose the unknown cipher text as query to the decryption oracle and learn about plain text? Again,I understand the need of such restriction in formal definition of experiment | |
| Feb 16, 2022 at 15:31 | history | answered | Mikero | CC BY-SA 4.0 |