I don't really get how this problem should be solved. My main issue is with the random oracle generally, a short explanation of ROs and how they are used in such proofs maybe with this example will hopefully clear that up.

Consider the RSA-based encryption scheme in which a user encrypts a message $m ∈ \{0,1\}^{l}$ with respect to the public key $(N, e)$ by computing $$m':= H(m)\|m$$ and outputting the ciphertext $$c:=m'^{e} \mod N.$$ (Here,let $H:=\{0,1\}^{l}→ \{0,1\}^{n}$ and assume $l+n<\|N\|$, the bit-length of $N$). The receiver recovers m' in the usual way and verifies that it has the correct form before outputting the $l$ least-significant bits as $m$. Prove or disprove that this scheme is CCA-secure if H is modeled as a random oracle.

  • $\begingroup$ Random oracle (RO) quite clear, right? $\endgroup$ – kelalaka Jan 16 at 22:08
  • $\begingroup$ @kelalaka yes, as a concept on its own.. don't know how to use it practically in the example. $\endgroup$ – randomMe Jan 16 at 22:17

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.