# Applying Trapdoor Function directly to plaintext

Suppose we have a secure trapdoor function defined on (G, F, F^-1) where G is a randomized algorithm outputs a key pair (pk, sk). Why would this trapdoor function become insecure if we apply F directly to plaintext message? E(pk,m) = c = F(pk, m)

• What exactly do you mean with "directly on plaintext"? Without a secure padding scheme or without hashing the input before encryption? Or something else?
– Nova
Mar 18, 2015 at 4:19
• It's just a very simple encryption where G() generate (pk, sk); F(pk, .) is a deterministic algorithm that defines a function X->Y ;F^-1(sk, .) defines a function Y -> X that inverts F(pk,.) Mar 18, 2015 at 4:33
• Yeah, I did understand that, but I don't know what you mean with the "apply F directly to the plaintext message" << What do you want to do instead? Hashing the message? Or applying a padding scheme like OAEP?
– Nova
Mar 18, 2015 at 4:35
• Instead of using a random hashing function to get k = H(x) where x is random and output ciphertext c = (F(pk,x), E(k,m)), the scheme above just simply outputs c= F(pk, m) Mar 18, 2015 at 4:45
• What does "secure" mean in this context? It can't be IND-CPA, because that does not work with a deterministic encryption function. It can't be in the context of signatures, because there you use $F^{-1}$ to generate the signature.
– tylo
Mar 19, 2015 at 10:05

Trapdoor functions only provide one-wayness. This means, that if one uses a trapdoor function to encrypt this may leak large parts of the plaintext. Suppose I have a trapdoor function $F(pk,m)$ for say n-bit messages $m$. I can now define an adapted trapdoor function working on $2n$ bit messages as

$F'(pk,m_1||m_2) = m_1 || F(pk,m_2)$

This is still a secure trapdoor function but, leaks half of the bits of the "plaintext".

An eavesdropper could easily test any candidate message to determine
whether or that candidate message was the plaintext message.

def test_candidate_message_(pk,c,candidate):
if c == F(pk,candidate):
return True
else:
return False

• Can you give a simple example how an eavesdropper can break this scheme? Mar 18, 2015 at 4:10
• I just did that. $\;$
– user991
Mar 18, 2015 at 4:14
• How would that change if the message was first hashed before using the trapdoor function?
– Nova
Mar 18, 2015 at 5:18
• @Nova : $\:$ The eavesdropper would first hash candidate before using the trapdoor function. $\hspace{.69 in}$
– user991
Mar 18, 2015 at 5:43
• @RickyDemer: Yes, that's right, but that is exactly what hvuong91 did ask: Why does that become insecure if we don't do that? It would not change anything, because the attacker would still be able to try that. It's both insecure, and the question asks why not hashing is insecure while hashing is secure.
– Nova
Mar 18, 2015 at 5:47