1
$\begingroup$

I always get stuck at those kind of exercises in my Cryptography class. I just don't understand how should I build these scenarios of "sending m1 and m2 and then somehow telling if it was m1 or m2 etc..." attacks. Can someone explain to me in simple terms how can I describe a scenario for this exercise: "Show that the CBC mode is not CCA-secure by describing an attacker A and name its advantage."

And please any Book suggestions to learn those attacks, because I understand the theory, but when it comes to practice, I get stuck.

Improve this question
$\endgroup$
4
  • 1
    $\begingroup$ Suggestions for this kind of exercise: 1) Write down the definitions you work with (here, of CCA-secure, and of CBC mode); it's strongly suggested that you edit the question with that. 2) Meanwhile, make sure to use consistent notation (e.g. here, it's probably best to make the Initialization Vector part of the ciphertext so that CBC encryption matches the formalism of the CCA experiment). 3) If that does not impair the desired proof, go for the simplest (here: restricting to the less block of plaintext that make sense, e.g. one block). $\endgroup$
    – fgrieu ♦
    May 15 at 6:34
  • $\begingroup$ @fgrieu thank you:) Can you suggest me any site/book where I can practice these kind of attacks? $\endgroup$
    – gsmoke1
    May 15 at 12:22
  • 1
    $\begingroup$ The definitions you should use are those in your class, because the level of formalism and the notations vary. For CCA, the problem statement most likely is about CCA2, which is explained here (I say so because CBC is CCA1-secure). For CBC, any text source that makes IV the first block of ciphertext will do, e.g. the HAC's drawing and alg 7.13. The proof itself would have a structure similar to this (but I wish I had a better example). $\endgroup$
    – fgrieu ♦
    May 15 at 13:48
  • $\begingroup$ This answer could also help; at least, it contains a definition of IND-CCA2. $\endgroup$
    – fgrieu ♦
    May 15 at 17:35

1 Answer 1

Reset to default
2
$\begingroup$

The CPA security game involves guessing which of m1 and m2 the encryption oracle encrypted and returned as a challenge. Adversary picks both messages. They win if they do better than 50:50 random guessing. In simple terms, this means the adversary can distinguish between messages after they're encrypted.

CCA is the same but gives access to a decryption oracle that decrypts anything but the challenge value. Challenge values are obviously blacklisted or the adversary just asks for a decryption and then they know whether it was m1 or m2 and win trivially. CCA insecurity means the attacker can learn information about one encrypted message by decrypting another different chosen ciphertext.

CBC is malleable

  • bit flips in the IV flip bits in the first plaintext block
  • bit flips in ciphertext flip bits in the next plaintext block and randomise that plaintext block

CBC decryption

So the attacker can decrypt blacklisted messages by flipping one of the IV bits, submitting that to the decryption oracle, and flipping the same bit in the first block of whatever comes back. This gets them around the blacklist and wins the game with 100% probability. The attacker has learned the challenge ciphertext by decrypting a related message.

In real applications malleability has real consequences, attackers can flip bits in the first block for free and the nth block at the cost of trashing the (n-1)th block.

Improve this answer
$\endgroup$
1
  • $\begingroup$ thank you for the clarification. (sorry for the late reply) $\endgroup$
    – gsmoke1
    May 22 at 11:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.