Let $k$ be uniformly sampled from $\{0,1\}^\lambda$, $F$ be a secure PRP with block length $\lambda$ and let $Enc(k, m)$ be such that it returns $c = (F(k,r), r \oplus F(k,m))$ with $r$ uniformly sampled from $\{0,1\}^\lambda$. How to prove that this scheme is not CCA secure? In particular, how can an attack be thought of?

  • $\begingroup$ You mean scheme. $\endgroup$ – DannyNiu Aug 21 at 8:50
  • $\begingroup$ Thanks. I think that also for these reasons there is an 'edit' button clickable by everyone :) $\endgroup$ – Bruce Wayne Aug 21 at 11:15

I won't give the answer; here are some hints:

  • Suppose we have a valid cipher text $(A, B) = F(k, r), r \oplus F(k, m)$. What happens if we modify the ciphertext to be $(A, B \oplus C)$ and get that decrypted?

  • How can we use this? What can we do if we have two ciphertexts that encrypt the same message $m$?

  • $\begingroup$ Thinking about the decryption algorithm, can be $F^{-1}(k, F^{-1}(k,A) \oplus B)$, but now I can't see which $C$ can be useful in this scenario. I'll think about it $\endgroup$ – Bruce Wayne Aug 20 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.