1
$\begingroup$

Could you explain with an example what does it mean to be Plaintext-awareness. I have read the wiki definition. It says that "A cryptosystem is plaintext-aware if it cannot genenerate a valid ciphertext without being aware of the corresponding plaintext".

As an example, consider the RSA cryptosystem without padding. In the RSA cryptosystem, plaintexts and ciphertexts are both values modulo N (the modulus). Therefore, RSA is not plaintext aware

How on earth is it possible to generate cipher text without the plain text?

$\endgroup$

2 Answers 2

1
$\begingroup$

I think that your definition should read:

A cryptosystem is plaintext-aware if it cannot genenerate a valid ciphertext without being aware of the corresponding plaintext

With non-plaintext aware systems cipher texts can be generated bery easily; if there's no special property of cipher texts one can write down anything. For example with RSA without padding, we write down any integer modulo $N$ and it will decrypt to something. The corresponding plaintext will likely not make any sense to man nor beast, but it will be a legitimate plaintext.

It's probably more instructive to think of plaintext awareness as being the property that if one claims a plausible-looking ciphertext (which has not been directly created by the encryption process), it will almost surely be rejected by the decryptor as an invalid plaintext. For example with RSA with padding one can still write down an arbitrary integer modulo $N$ and claim it is a ciphertext. However, a legitimate decryptor on running the decryption process encounters a message with invalid padding and so is aware that the ciphertext was not valid.

Plaintext awareness is important when considering malleability where adversaries can modify ciphertexts to produce other plausible ciphertexts without going through the encryption process again. They can then gain information depending on how the decryptor reacts to the putative plaintext. This can lead to padding oracle attacks for the unwary implementor.

$\endgroup$
0
$\begingroup$

The motivating context for plaintext awareness (PA) is mainly its use in proving schemes CCA2-secure. The idea is that if the adversary cannot generate valid ciphertexts without in some sense knowing their decryption, even given some valid ciphertexts, the CCA2 decryption oracle is pointless and the CCA2-security of the cryptosystem reduces to its CPA-security.

For textbook RSA, I know that 3 is a valid ciphertext. For any public key. This breaks PA, but on its own it is not interesting. (In fact, it is possible to design CCA2-secure cryptosystems that provably do not have PA.)

To get a more interesting situation, consider a CCA2 attack on textbook RSA where we get a public key $(n,e)$ and a ciphertext $c$, and we want to find its decryption $m$. We have a decryption oracle, but it refuses to decrypt $c$. So what we do is create the ciphertext $c’ = 2^e c$. The decryption oracle willingly decrypts $c’$ to $2m$, from which we find $m$ by dividing by $2$. So we win.

The interesting point with respect to PA is that we created the valid ciphertext $c’$ that we did not know the decryption of. Therefore, the decryption oracle was useful for us.

Nowadays, PA seems to be less popular as a design paradigm.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.