2
$\begingroup$

I am trying to construct a proof that a scheme is not CPA-secure. In IND-CPA experiment, can the adversary generate a key(that may not be real secret key) and compute Enc(key, message)? Does the adversary knows the encryption scheme in IND-CPA experiment?

I need this as I want to prove that if a scheme B1 is not CPA-secure, a scheme B2 is not CPA-secure by the following logic: There exists an adversary A that can win IND-CPA experiment for scheme B1. Then I construct an adversary A' with the help of A to win IND-CPA experiment for scheme B2. But A' has to be able to compute Enc(key, message) for some key. I am unsure whether I can do so.

$\endgroup$
2
$\begingroup$

In IND-CPA experiment, can the adversary generate a key (that may not be real secret key) and compute Enc(key, message)?

Yes, for message available to the adversary per the rules of the game. The adversary is always assumed to be able to use as a subprogram the algorithm under attack, or any part of it (e.g. encryption, or decryption, or key generation as is the case here; or any deterministic internal block, such as a hash including when modeled as a random oracle). That's per Kerckhoffs's principle. The computation is still counted as work performed by the adversary.

The random inputs and the outputs of any internal TRNG of the scheme under attack are assumed to be supplied to the adversary only inasmuch as prescribed by the scheme (e.g. IV for encryption; that's uncommon for key generation). The adversary has unlimited randomness available (e.g. to generate new keys, collisions), except if it is explicitly specified to be deterministic.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.