I am not sure if Counter Mode (CTR) encryption is mult-CPA (chosen-plaintext attack) secure or not.
$\begingroup$
$\endgroup$
2
-
$\begingroup$ Would you mind giving the definition of "mult-CPA" security you're using? I tried Googling for it, but the only use of that term I found was in these German lecture notes, which also say that it's equivalent to ordinary CPA security. $\endgroup$– Ilmari KaronenFeb 14, 2015 at 17:16
-
$\begingroup$ I also live in Germany and I always used Mult(multiple) CPA/KPA,... and did not know what the translation would be. I thought they should be the same cause mult is just abbreviation of multiple and means multiple encryptions are possible in CPA(page 67 of the lecture notes you sent) but anyway now I have learned its equivalent to ordinary CPA security. $\endgroup$– frhlingFeb 14, 2015 at 17:54
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
CTR mode encryption, instantiated with a secure block cipher, is IND-CPA secure under the usual definition (Bellare et al., 1997; Rogaway, 2011).
The term "mult-CPA" does not appear to be in widespread use, but it's found e.g. in these German lecture slides (Kiltz, 2011). In the slides, it is defined (on slide 66) in a similar way as ordinary IND-CPA security, except that, instead of just single messages $m_0$ and $m_1$, the attacker is allowed to submit two vectors of messages $M_0 = (m_0^1, m_0^2, \dots, m_0^t)$ and $M_1 = (m_1^1, m_1^2, \dots, m_1^t)$ of length $t$ to the challenger, where the individual messages $m_0^i$ and $m_1^i$ have the same length for all $i$, and receives a vector of encrypted messages $(E(m_b^1), E(m_b^2), \dots, E(m_b^t))$ in return.
The same slides also contain a proof that mult-CPA security, as defined above, is equivalent to ordinary IND-CPA security. The proof takes the form of a hybrid argument, and essentially shows that, if an attacker can distinguish encrypted vectors of length $t$ in the mult-CPA game with advantage $\epsilon$ over random guessing, then they can also distinguish individual encrypted messages in the ordinary IND-CPA game with advantage $\frac\epsilon t$.
answered Feb 14, 2015 at 19:02
-
1$\begingroup$ It would seem more natural to have the attacker submit pairs of messages arbitrarily many times, rather than have the attacker submit two vectors of messages just once. $\:$ However, the same hybrid argument would still work for that definition. $\;\;\;\;$ $\endgroup$– user991Feb 14, 2015 at 19:11