1
$\begingroup$

CCA-attack is possible in text-book RSA, but how the decryption key $d$ is known to anyone, as it is kept secret with receiver.

$\endgroup$
3
  • 1
    $\begingroup$ Could you describe, mathematically, the attack you are talking about? Also, are you talking textbook (unpadded) RSA? $\endgroup$
    – mikeazo
    Mar 16, 2015 at 14:19
  • 1
    $\begingroup$ Are you talking about Bleichenbacher's ACCA attack? My understanding is that it's a padding oracle attack against PKCS#1, which inherently affects RSA, rather than an attack against RSA itself. $\endgroup$
    – Polynomial
    Mar 16, 2015 at 14:19
  • $\begingroup$ In RSA, except for side channel attacks, there's no known way the decryption key $d$ (or some equivalent information) can leak, no matter how disastrous the padding or the attack model, including CCA. $\endgroup$
    – fgrieu
    Mar 16, 2015 at 15:31

1 Answer 1

3
$\begingroup$

Chosen Ciphertext Attacks against RSA (such as Bleichenbacher's Attack on PKCS #1 encryption) do not actually reveal the private key.

If they don't, they why do we say that they are a threat? Well, it's because that the keys are generally not of interest to the attacker. Instead, given an encrypted message, the attacker actually wants to know what that message says. He's interested in the key only because the keys would reveal the message. If the attacker can find a way to get the message without the key, he has won the game. Bleichenbacher gives him such a way.

$\endgroup$
3
  • $\begingroup$ i am talking about text-book RSA,and CCA-attack on it. $\endgroup$
    – Aria
    Mar 16, 2015 at 14:26
  • 1
    $\begingroup$ @Aria: same thing -- they do not reveal the keys; they might reveal the text of an encrypted message. $\endgroup$
    – poncho
    Mar 16, 2015 at 14:28
  • $\begingroup$ @Aria A CCA attack is no total break, i.e., it is not required to reveal the secret key, but only to decide which of your two messages has been encrypted as your challenge ciphertext. Look into random self reducibility of the RSA problem to see how you can exploit that for a CCA attack on textbook RSA. $\endgroup$
    – DrLecter
    Mar 16, 2015 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.