0
$\begingroup$

The following question is from Stanford cryptography course final exam paper.

Suppose an attacker intercepts a ciphertext c which is the encryption of a message m ε {0, 1}^n under nonce-based counter mode. Can the attacker create the encryption of m XOR 1^n just given c? If so, explain how. If not, explain why not.

I cannot prove why that wouldn't be possible, although intuitively given it is a counter mode, I feel the attacker cannot create the encryption.

$\endgroup$

1 Answer 1

0
$\begingroup$

Yes, the ciphertext is plaintext xor pad. Since in case we want a ciphertext for a changed plaintext, the pad will not be altered since its not text-dependent. Therefore, consider how would the ciphertext change if You add 1^n to the plaintext

$\endgroup$
7
  • $\begingroup$ It is still unclear to me. Could you elaborate please? $\endgroup$ Nov 20, 2022 at 9:10
  • $\begingroup$ Which part is unclear? $\endgroup$
    – Sezzart
    Nov 20, 2022 at 9:11
  • $\begingroup$ Everything that you said. I understand that in CTR mode, we have ciphertext C = M XOR E(Nonce||Counter), where E is the encryption function. Now we have been given C and then how do we find out E(M XOR 1^n) or is it asking us to find E(M) XOR 1^n? $\endgroup$ Nov 20, 2022 at 9:34
  • $\begingroup$ You get C=Enc(M)=AES(Nonce||Counter) + M. You want to find C' = Enc(M+1^n) which will be....? $\endgroup$
    – Sezzart
    Nov 20, 2022 at 10:10
  • $\begingroup$ C'= Enc(M + 1^n) = AES(Nonce||Counter) + M + 1^n? $\endgroup$ Nov 20, 2022 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.