I've bee learning about Rabin's cryptosystem, and I already know that Rabin's cryptosystem is vulnerable to a chosen-ciphertext attack, but I was wondering, is it also vulnerable against known-plaintext attacks? I think it's not, but I'm not sure. I would appreciate if someone could clear this up for me.

  • $\begingroup$ Is your Rabin's cryptosystem different from Rabin public-key encryption in the HAC, section 8.3? If yes, how? $\endgroup$
    – fgrieu
    Sep 16, 2014 at 6:36

1 Answer 1

  1. Both Rabin and RSA rely on padding for security. Proper padding prevents chosen-ciphertext attacks since modified ciphertext has a negligible chance of producing valid padding.

    If you claim Rabin (or RSA) is vulnerable to CCA attacks, you should limit that to the unpadded/textbook variants. Most deployed implementations use padding, though some paddings are still vulnerable (e.g. PKCS#1v1.5 padding for RSA).

    Another important property of padding is randomization to prevent plaintext guessing attacks, which would otherwise break low entropy messages.

    => Rabin without padding is only a building block, not something that should be used directly as secure encryption.

  2. The most basic property asymmetric encryption needs to provide is security against chosen plaintext attacks, since the attacker can encrypt arbitrary plaintexts. Security against chosen plaintext attacks trivially implies security against known plaintext attacks.

    => Any secure asymmetric encryption is secure against known plaintext attacks, this includes Rabin.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.