I'm trying to understand how the messages $m_0$ and $m_1$ can be distinguished here. I understand the adversary game, so in short: Adv chooses $m_0$ and $m_1$, one them is encrypted and Adv is able to tell which one has been encrypted.

My understanding is that (ignoring the ctr for the moment, because its the same for each encryption):

$F_k(1+ m_{01}) = F_k(1111), F_k(2+m_{02})= F_k(1111)...$ $F_k(1+ m_{11}) = F_k(0001), F_k(2+m_{12})= F_k(0010)...$

We know if $m_0$ is encrypted then each block will be the same, if $m_1$ is encrypted instead we should get some random. If someone could explain if my understanding of $F_k$ is correct and if there is some significance in $m_1$ and why it's all 0. Or am I overthinking this...


Your understanding is correct. There is no particular significance to $m_1$ being all zeroes, it is just a simple and convenient way to ensure that the inputs to $F_k$ will be all distinct, which is what we need in order to produce a pseudorandom string.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.