Let $k$ be uniformly sampled from $\{0,1\}^\lambda$, $F$ be a secure PRP with block length $\lambda$ and let $Enc(k, m)$ be such that it returns $c = (F(k,r), r \oplus F(k,m))$ with $r$ uniformly sampled from $\{0,1\}^\lambda$. How to prove that this scheme is not CCA secure? In particular, how can an attack be thought of?

| improve this question | | | | |
  • $\begingroup$ You mean scheme. $\endgroup$ – DannyNiu Aug 21 '19 at 8:50
  • $\begingroup$ Thanks. I think that also for these reasons there is an 'edit' button clickable by everyone :) $\endgroup$ – Bruce Wayne Aug 21 '19 at 11:15

I won't give the answer; here are some hints:

  • Suppose we have a valid cipher text $(A, B) = F(k, r), r \oplus F(k, m)$. What happens if we modify the ciphertext to be $(A, B \oplus C)$ and get that decrypted?

  • How can we use this? What can we do if we have two ciphertexts that encrypt the same message $m$?

| improve this answer | | | | |
  • $\begingroup$ Thinking about the decryption algorithm, can be $F^{-1}(k, F^{-1}(k,A) \oplus B)$, but now I can't see which $C$ can be useful in this scenario. I'll think about it $\endgroup$ – Bruce Wayne Aug 20 '19 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.