1
$\begingroup$

If I got it right, chosen ciphertext security implies also CPA security. In other words, attacker can submit plaintexts to the challenger (along with ciphertexts).

enter image description here

I do not understand why encryption system (E,D) where D(k,0)=0 is considered as ciphertext secure.

Imagine CPA security game where an attacker just submits two plaintexts, m0 = 0 and m1 = (any value != 0). In that case if poor challenger returns 0 then we are certain that we're in experiment 0 and win CPA game.

What I am missing here?

$\endgroup$
8
  • $\begingroup$ Where do you get the idea from that such a scheme would be CCA secure? $\endgroup$
    – Maeher
    Feb 2 '15 at 8:39
  • $\begingroup$ Such schemes can't provide plaintext integrity (and thus also can't provide ciphertext integrity), but that has very little to do with IND-CPA. $\;$ $\endgroup$
    – user991
    Feb 2 '15 at 8:40
  • $\begingroup$ @Maeher, I added a screenshot. $\endgroup$
    – lstipakov
    Feb 2 '15 at 8:49
  • $\begingroup$ Where does it state in the screenshot that such a scheme is secure? $\endgroup$
    – Maeher
    Feb 2 '15 at 8:56
  • $\begingroup$ @Maeher, it does not state here that D(k,0)=0 is considered as ciphertext secure. However it was stated in the problem set in crypto class. I gave apparently wrong answer, and as an explanation I got "Consider a chosen ciphertext secure encryption system (E,D) where D(k,0)=0." $\endgroup$
    – lstipakov
    Feb 2 '15 at 9:01
3
$\begingroup$

The important thing to note here is that $\mathsf{D}(k,0)=0$ does not necessarily imply that $\mathsf{E}(k,0)=0$. That is the reason why your attack does not work in general.

To illustrate, let $(\mathsf{E},\mathsf{D})$ be a CCA secure encryption scheme. We then construct a new encryption scheme $(\mathsf{E'},\mathsf{D'})$ as follows: $$\mathsf{E'}(k,m) = 1\Vert \mathsf{E}(k,m)$$ and $$\mathsf{D'}(k,b\Vert c) = \left\{\begin{array}{ll} 0& \text{if } b = 0\\ \mathsf{D}(k,c)& \text{if } b = 1\end{array}\right.$$

It is trivial to show via reduction that $(\mathsf{E'},\mathsf{D'})$ inherits the CCA security from $(\mathsf{E},\mathsf{D})$, but still it has the property that $\mathsf{D'}(k,0)=0$.

As you can see, your attack does not work, because $0$ is never encrypted to $0$ by the challenger.

$\endgroup$
1
  • $\begingroup$ ... and D'(k,empty_string)=0. $\;$ $\endgroup$
    – user991
    Feb 2 '15 at 10:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.