0
$\begingroup$

enter image description here(E,D) is a CPA-secure cipher defined over (K,M,C).H: C → T is collision resistant hash functions. E(k,m):=E(k,m), H(c)), D=(k,c1,c2):=D(k,c1) if H(c1)==C2 otherwise Reject.

ps:the question is from the book <A Graduate Course in Applied Cryptography[Boneh]> exercise 9.2 can use cpa and cca to proof

Improve this question
$\endgroup$
7
  • 1
    $\begingroup$ Hint: Can you somehow modify a ciphertext and make the changed one be accepted? $\endgroup$ – SEJPM♦ Dec 18 '20 at 13:40
  • $\begingroup$ If I'm reading this correctly, what you're describing is Encrypt-then-Hash. $\endgroup$ – Maeher Dec 18 '20 at 13:48
  • $\begingroup$ It's a bit hard to read, I think something got lost in translation. C2 seems to be the authentication tag? Strange variable name, C was the input to the hash before, and is likely the ciphertext (?). $\endgroup$ – Maarten Bodewes♦ Dec 18 '20 at 13:55
  • $\begingroup$ I'm sorry for my bad English. I have upload the picture of the problem. I aggre with the second comment , but I don't know how to show it use cca or cpa. $\endgroup$ – Redomichelan Dec 19 '20 at 6:13
  • $\begingroup$ first one is simple as $H_1{(m)}$ leaks the information about the message in the ciphertext. So it is not CPA secure. $\endgroup$ – SSA Dec 19 '20 at 8:04
0
$\begingroup$

  • first one is simple as ${H_1(m)}$ leaks the information about the message in the ciphertext. So it is not CPA secure.

  • second one , the scheme will be under CCA. as @SEJPM mentioned attacker can modify the c1 such that new ciphertext c2 will be the result of ${H_2(c1)=c2}$, so ciphertext integrity is not preserved, required in AE.

Improve this answer
$\endgroup$
4
  • $\begingroup$ in second one.In my view, it if just change C1 and let c2=H2(c1), the ciphertext(c1,c2) could pass the first "if". and then it will calculate D(k,c1), c1 is changed, it might be not legal ciphertext.It means input changed (c1,c2),can't output readable message $\endgroup$ – Redomichelan Dec 19 '20 at 12:09
  • $\begingroup$ yes, right. Here, ${H_2}$ doesn't seem to be not one-way function. we know that ${H_2^{-1}(c_2)=c_1}$, we have both value (c1,c2) then ${H_2}$ is a function C to C. ${H_2:C--> C}$. $\endgroup$ – SSA Dec 19 '20 at 14:01
  • $\begingroup$ We have two things , (E,D) a CPA-secure cipher and a Hash function. consider m1 is having same length as single block of CBC mode. once Attacker receives the ${c_1}$ along with IV it will modify IV as ${IV \oplus 1}$ , this new ${c_1}'$ will be given to Hash function to get ${c_2}'$. now modified ${c_1}$ will be given for decryption and he will receive ${m_1 \oplus 1}$ . $\endgroup$ – SSA Dec 20 '20 at 2:20
  • $\begingroup$ got it, thank you very much $\endgroup$ – Redomichelan Dec 20 '20 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.