It seems that several file encryption systems do NOT use authenticated encryption. (E.g. gpg --symmetric and boxcryptor as far as I can determine). I understand that this is generally considered insecure, but is not demanded of full disk encryption. But for individual file encryption, for example where one is storing tax files for their own use later, it does seem that ciphertext indistinguishably under chosen ciphertext attack (IND-CCA) is too strong (I am not providing an oracle). Is there any notion between IND-CPA and IND-CCA that one should consider?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
Yes. $\:$ NME-CPA is such a notion, and is equivalent to modifying the IND-CCA notion so that
$\;$ the adversary can submit more than one ciphertext simultaneously
$\;\;\;\;$ and
$\;$ the adversary can only submit ciphertext(s) one time
$\;\;\;\;$ and
$\;$ that time must be after receiving the challenge ciphertext
$\;\;\;\;$ and
$\;$ after submitting ciphertext(s), the adversary also can't submit any plaintexts
.
-
1$\begingroup$ 503 error on the link, can you provide a more complete reference? $\endgroup$ Commented May 28, 2015 at 22:00
-
$\begingroup$ Yes. ${}{}{}\;$ $\endgroup$– user991Commented May 28, 2015 at 22:40