Let F be a pseudorandom function (length preserving). We have the following scheme: To encrypt $ m \in \{0,1\}^{2n}$, parse m as $m_1||m_2$ with $|m_1|=|m_2|$, then choose $r\leftarrow\{0,1\}^n$ and output the ciphertext $(r, m_1\oplus F_k(r), m_2 \oplus F_k(r))$. Is this scheme EAV secure? I think that it is not EAV secure because we use twice the pseudorandom function with the same r, but I can not prove it formaly.

  • 2
    $\begingroup$ What happens if you try to xor some of the ciphertext components? $\endgroup$ – Maeher Nov 25 '20 at 9:56
  • $\begingroup$ Note that you don't need much of a proof to show insecurity. The system is EAV or CPA secure if every P.P.T. adversary has negligible advantage. If you find an adversary that has non-negligible advantage, this suffices for a formal proof of insecurity $\endgroup$ – 0kp Nov 25 '20 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.