1
$\begingroup$

I'm trying to do the ex 11.15 of the Katz-Lindell book.

Consider the RSA-based encryption scheme in which a user encrypts a message $m ∈ $ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by computing $m' := H(m)||m$ and outputting the ciphertext $c' := m'^e modN $. $(H : $ {$0, 1$}$^l → ${$0, 1$}$^n$ and assume $l + n < ||N||$, $||N||$ is the bit-length of N). The receiver recovers $m'$ in the usual way and verifies that it has the correct form before outputting the $l$ least-significant bits as $m$. Prove or disprove that this scheme is CCA-secure if $H$ is modeled as a random oracle.

I know that this scheme isn't CCA-secure because it's deterministic.

But I tried to transform the cyphertext without success, because if I modify the second part of $m'$ let's say computing $m''$, using another cyphertext and multiplying it to $c'$, then I need $H(m'')$ to compose a correct cyphertext but since I don't know $m'$ I'm not able to query $H(m'')$.

|improve this question
$\endgroup$
  • 2
    $\begingroup$ An attack against CPA security is an attack against CCA security which just chooses not to take advantage of the decryption oracle. $\endgroup$ – Mikero Jan 16 at 4:32
  • $\begingroup$ Thanks for the reply. But how could it be attacked with CPA attack? $\endgroup$ – Processss Jan 16 at 9:01
  • 2
    $\begingroup$ You already observed that the scheme is deterministic. What does that tell you? $\endgroup$ – Maeher Jan 16 at 10:01
  • $\begingroup$ So I can just ask for the encryption of the messages (m0,m1) in the CPA-security game? $\endgroup$ – Processss Jan 16 at 10:03
  • 1
    $\begingroup$ There's no need to ask. You can just compute it yourself. $\endgroup$ – Maeher Jan 16 at 14:23

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.