Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I am newbie to the crypto world, but my question is, If block cipher BLOCK satisfies the following relation (where ENC is encrypt and "+" means XOR): For ever pair of blocks of input A and B, ENC(A+B) = ENC(A) + ENC(B).
I was wondering what would be the security of BLOCK? Assuming the key is of fixed size and that you have unfetterd access to the ENC function. In other words, how hard is it to decrypt a given ciphertext without knowing the details of BLOCK.
In other words, how hard is it to decrypt a given ciphertext without knowing the details of BLOCK.
Pretty easy; all you'd need to do is ask for:
ENC(0x000..0001)
ENC(0x000..0002)
ENC(0x000..0004)
ENC(0x000..0008)
ENC(0x000..0010)
...
ENC(0x400..0000)
ENC(0x800..0000)
For an $n$-bit block cipher, that's $n$ queries.
Then, you find the linear combination of the above values that gives you the known value ENC(BLOCK) (for example, by Gaussian Elimination); by the homomorphic property you listed, that immediately gives you the value of BLOCK
This same strategy can be devised as a known ciphertext attack, using $n+\epsilon$ random known plaintexts, that'll allow you to decrypt any ciphertext with high probability.
Sorry, but that's not a block cipher. A block cipher is a keyed permutation. That is: it consists of $2^n$ of relationships between plaintext and ciphertext blocks where $n$ is the blocksize in bits. The specific relationship is chosen by the key. Now in your case the relationship of A and B does not only seem to depend on the key but also on the plaintext; there is clearly a relationship between A, B and A + B.
When it comes to security, no this is not secure. In general a cipher should be secure even if an attacker can perform chosen plaintext attacks. So if an attacker wants to crack ENC(A) the attacker should not be able to request encryption for B and A + B (guessing A) and then get confirmation that A is indeed the plaintext.
So this block cipher would not be usable for building a secure cipher (using generic constructs) as the result would not be IND_CPA secure.
