1
$\begingroup$

I'm trying to do the ex 11.15 of the Katz-Lindell book.

Consider the RSA-based encryption scheme in which a user encrypts a message $m ∈ $ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by computing $m' := H(m)||m$ and outputting the ciphertext $c' := m'^e modN $. $(H : $ {$0, 1$}$^l → ${$0, 1$}$^n$ and assume $l + n < ||N||$, $||N||$ is the bit-length of N). The receiver recovers $m'$ in the usual way and verifies that it has the correct form before outputting the $l$ least-significant bits as $m$. Prove or disprove that this scheme is CCA-secure if $H$ is modeled as a random oracle.

I know that this scheme isn't CCA-secure because it's deterministic.

But I tried to transform the cyphertext without success, because if I modify the second part of $m'$ let's say computing $m''$, using another cyphertext and multiplying it to $c'$, then I need $H(m'')$ to compose a correct cyphertext but since I don't know $m'$ I'm not able to query $H(m'')$.

||improve this question
$\endgroup$
  • 2
    $\begingroup$ An attack against CPA security is an attack against CCA security which just chooses not to take advantage of the decryption oracle. $\endgroup$ – Mikero Jan 16 '19 at 4:32
  • $\begingroup$ Thanks for the reply. But how could it be attacked with CPA attack? $\endgroup$ – Processss Jan 16 '19 at 9:01
  • 2
    $\begingroup$ You already observed that the scheme is deterministic. What does that tell you? $\endgroup$ – Maeher Jan 16 '19 at 10:01
  • $\begingroup$ So I can just ask for the encryption of the messages (m0,m1) in the CPA-security game? $\endgroup$ – Processss Jan 16 '19 at 10:03
  • 1
    $\begingroup$ There's no need to ask. You can just compute it yourself. $\endgroup$ – Maeher Jan 16 '19 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.