1
$\begingroup$

Let $F : \{0,1\}^n \times \{0,1\}^n \rightarrow \{0,1\}^n $ be a PRF. And let the encryption function be $Enc{_k}(m) = r\mathbin\| (F{_k}(m\bigoplus r)$ , r being a random value.

Im trying to proof that this scheme is not CCA-secure, however I'm already failing at finding a correct decryption. Since a PRF is not invertible, how is it possible to recover the $m$ from the ciphertext?

Improve this question
$\endgroup$
2
  • 2
    $\begingroup$ What you have there can in general not be decrypted. Where did you find this supposed scheme? Are you sure it's not supposed to be $(r,F_k(r) \oplus m)$? $\endgroup$
    – Maeher
    Jul 11, 2020 at 20:24
  • $\begingroup$ Hint: Do you understand why CBC mode is not CCA secure? Notice that this scheme is CBC mode restricted to a single plaintext block (assuming F is a PRP). $\endgroup$
    – Mikero
    Oct 12, 2021 at 2:09

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.