0
$\begingroup$

Usually a Pseudo Random Generator is supposed to be IND-CPA secure.

But apparently, it is not in some cases such as the following:

  • A PseudoRandom Generator $G$ has expansion factor $n + 2$.

  • Encrypt $m \space \in \{0,1\} ^ {n+2}$

  • Choose a random value $v \leftarrow \{0,1\}^n$

  • Then send $(v, G(v) \oplus m)$

The question is why is it not IND-CPA secure and also not IND-EAV secure?

Improve this question
$\endgroup$
  • 2
    $\begingroup$ Sorry, this is probably me, but doesn't have a PRG just have a single input: the seed? I presume we are talking about some stream cipher or PRF here? Otherwise, how can IND-CPA even apply? $\endgroup$ – Maarten Bodewes♦ Sep 1 '19 at 12:18
  • 5
    $\begingroup$ IND-CPA is a property of encryption schemes, not of PRGs. $\endgroup$ – fkraiem Sep 1 '19 at 23:11
  • $\begingroup$ @MaartenBodewes Acronym mix-up? A PRG (which is different from a PRNG) uses a key and one other input. $\endgroup$ – Future Security Sep 3 '19 at 0:38
  • $\begingroup$ OK, in that case Wikipedia on PRG seems way off. That might be just Wikipedia though. Alternatively, the cipher based on the PRG called $G$ may not be IND-CPA secure? In that case, what happens if $n=0$ or $n=1$? $\endgroup$ – Maarten Bodewes♦ Sep 3 '19 at 1:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.