2
$\begingroup$

I've bee learning about Rabin's cryptosystem, and I already know that Rabin's cryptosystem is vulnerable to a chosen-ciphertext attack, but I was wondering, is it also vulnerable against known-plaintext attacks? I think it's not, but I'm not sure. I would appreciate if someone could clear this up for me.

$\endgroup$
  • $\begingroup$ Is your Rabin's cryptosystem different from Rabin public-key encryption in the HAC, section 8.3? If yes, how? $\endgroup$ – fgrieu Sep 16 '14 at 6:36
2
$\begingroup$
  1. Both Rabin and RSA rely on padding for security. Proper padding prevents chosen-ciphertext attacks since modified ciphertext has a negligible chance of producing valid padding.

    If you claim Rabin (or RSA) is vulnerable to CCA attacks, you should limit that to the unpadded/textbook variants. Most deployed implementations use padding, though some paddings are still vulnerable (e.g. PKCS#1v1.5 padding for RSA).

    Another important property of padding is randomization to prevent plaintext guessing attacks, which would otherwise break low entropy messages.

    => Rabin without padding is only a building block, not something that should be used directly as secure encryption.

  2. The most basic property asymmetric encryption needs to provide is security against chosen plaintext attacks, since the attacker can encrypt arbitrary plaintexts. Security against chosen plaintext attacks trivially implies security against known plaintext attacks.

    => Any secure asymmetric encryption is secure against known plaintext attacks, this includes Rabin.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.