1
$\begingroup$

Consider the following scenario: an adversary $A$ with access to an encryption oracle $\mathcal{O}$ is able to choose $n \in \mathbb{N}$ and pick $p_1,\dots,p_n$ such that $\forall i \in \{1,\dots,n\}:$ $A$ queries $\mathcal{O}$ with $p_i$ in order to obtain ciphertext $c_i := \texttt{AES_CTR_ENC}(p_i,k,IV)$ for some unkown key $k$ and initialization vector $IV$ (n padding scheme). Furthermore, assume that $|p_i| \neq |p_j|$ $\forall i\neq j $.

Is it possible that the abovementioned encryption scheme (AES-CTR without padding) is somehow resistant to this type of attack?

$\endgroup$
  • $\begingroup$ I assume you mean AES_CTR_ENC under a single key $k$, but how many $IV$s are there in the game? $\endgroup$ – DannyNiu Nov 1 '17 at 11:15
  • $\begingroup$ @DannyNiu you can assume that the pair (k,IV) does not ever repeat. $\endgroup$ – Ricardo Miranda Nov 1 '17 at 11:47
1
$\begingroup$

Your fundamental misunderstanding is that encryption does NOT provide security for plaintexts of different lengths. This is explicit in the definition, where indistinguishability only holds as long as the challenge plaintexts (of which one is encrypted) are of the same length.

In practice, in cases where length reveals information, one needs to pad.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.