Linked Questions
67 questions linked to/from Easy explanation of "IND-" security notions?
33
votes
2
answers
12k
views
7zip : Why does encrypting the same file with AES-256 not give the same output?
Using 7-zip 19.00, on Windows 10 1909, build 18363.592, I encrypted a text file with the contents "hello there" using AES-256 and the password "123". I did this two times, the exact same procedure, ...
32
votes
1
answer
10k
views
What do the signature security abbreviations like EUF-CMA mean?
From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes.
The most common ones are the *UF-* ...
18
votes
1
answer
30k
views
Bit Flipping Attack on CBC Mode
To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
11
votes
5
answers
2k
views
What is the purely mathematical definition of encryption strength?
An encryption function can be used to obfuscate pieces of information and later on retrieve them.
What is the yardstick for measuring how well the function encrypts the information ? Given any ...
10
votes
2
answers
1k
views
What do NM-CPA and NM-CCA mean?
When I've been researching authenticated encryption, the following terms keep showing up:
NM-CPA
NM-CCA
....without any definition as to what they mean. I've tried searching the web for their ...
8
votes
1
answer
2k
views
How to prove security of a randomized encryption algorithm?
I have designed an random encryption in public key setting. I am convinced about its security guarantee but I need a formal way to prove its robustness. How can I prove the security of this random-...
7
votes
3
answers
2k
views
Does adding complexity mean a more secure cipher?
I have a cryptography workshop question I'm having trouble with as follows;
Person A creates a cipher $E_k(m)$ which produces a ciphertext from message $m$ using key $k$. The function inside $E$ is ...
7
votes
3
answers
645
views
Is there a cryptographic approach to availability
Background
Cryptography can be said to provide the tools used to fulfill the goals of information security.
The three pillars of information security are confidentiality, integrity, and ...
7
votes
1
answer
558
views
Which attacks are possible against raw/textbook elliptic curve?
A quick question, we know that raw RSA is a no go. To solve this we have different PKCS standards forcing structure on the input messages.
For EC the story is something else. For signatures we have ...
6
votes
1
answer
3k
views
Is ElGamal IND-CCA1?
We all know that textbook ElGamal falls due to chosen ciphertext attacks, because of its multiplicative homomorphic property ($E(A)*E(B)=E(AB)$).
However these attacks require the ciphertext ($E(A)$ ...
6
votes
3
answers
1k
views
Reusing AES-CTR Keys and IVs for File Encryption
I’m implementing some file encryption module with random-access capability and AES-CTR seems the right way to go.
I understand that reusing Keys and IVs can expose the file to ‘Stream Cipher Attacks’ ...
6
votes
2
answers
1k
views
Why does Encrypt-Then-Sign not yield a CCA-secure public-key encryption scheme?
In symmetric cryptography, combining an IND-CPA secure symmetric encryption scheme with a secure MAC with the encrypt-then-MAC method yields a IND-CCA secure symmetric encryption scheme.
I am trying ...
5
votes
1
answer
2k
views
The essential differences between IND-CCA1 and IND-CCA2?
For some encryption scheme $(\mathcal{E}, \mathcal{D})$:
In the definition of IND-CCA, the adversary $\mathcal{A}$ can access the decryption oracle $\mathcal{D}$. The deep reason of this setting is to ...
4
votes
1
answer
9k
views
What is the meaning of IND-CCA secure under standard model? [duplicate]
I notice that in many research papers (viz. "Universal hash proofs and a paradigm for adaptive chosen ciphertext secure public-key encryption" by Cramer and Shoup) the authors showed that their ...
4
votes
2
answers
387
views
Chosen plain text and chosen ciphertext definitions clarification
I am trying to understand a concept of CPA and CCA attack and I cannot get one thing from the definition.
If an attacker can execute a CPA attack for something like Send 100 dollars to attacker that ...
4
votes
1
answer
730
views
Can you help me understand indistinguishably as described in the CPA security definition?
When I read the definition of the CPA indistinguishably encryption scheme, I see that the adversary can use an oracle as many times (to get as many encryptions of any messages it choose). An the end ...
4
votes
1
answer
606
views
Does Elliptic Curve Integrated Encryption Scheme (ECIES) provide IND-CCA2 security?
I am looking for a faster alternative to RSA with OAEP as a IND-CCA2 public key scheme. Elliptic Curve Integrated Encryption Scheme might be a candidate, but I am not sure if it provides IND-CCA2 ...
3
votes
3
answers
5k
views
How can a system be non-deterministic?
Newbie here, so forgive me if this is a stupid question.
In math class we learned about RSA encryption (as a practical application of what we learned about the Euler phi function and Fermats little ...
3
votes
2
answers
2k
views
Does having a hash of the plaintext compromise the ciphertext?
If I have a SHA512 hash of my plaintext, does it weaken or break the encryption of my ciphertext?
3
votes
1
answer
6k
views
ElGamal CPA secure
I understand that if DDH (Decisional Diffie–Hellman) is hard then ElGamal is CPA secure. But I'm having confusion on what part the DDH applies to.
So, given $pk=(G, g, y), y=g^x$ and $sk=(pk,x), x \...
3
votes
1
answer
344
views
Is the secret key kept constant in IND-CPA game?
I read the Wikipedia Page on ciphertext indistinguishability. Here it gives the following outline of the IND-CPA game:
The challenger generates a key pair PK, SK based on some security parameter k (e....
2
votes
3
answers
949
views
Can public key help attackers to break RSA encryption faster?
I have two, closely related questions:
Can a really good attacker (hacker) use the public key for his advantage and break RSA encryption faster? My point is that in RSA "communication" public key is ...
2
votes
1
answer
905
views
Security definition for IND-CPA of public key encryption
In the security game between the challenger and the adversary for the security definition of public key encryption, the challenger creates and gives the public key pk to the adversary. The adversary ...
2
votes
1
answer
138
views
How bad exactly are repetitions in the plaintext?
When the last n bytes of the plaintext are themselves suitably random, but predictably repeat m times in the same message - how bad is that? I'm convinced it is detrimental, but I am uncertain how ...
2
votes
1
answer
923
views
What does AES-GCM provide?
I am wondering does AES-GCM which uses Authenticated Encryption provide us with all 3 properties (Authenticity, Confidentiality, and Integrity), or does it not provide integrity?
2
votes
1
answer
652
views
Homemade Randomized RSA
Considering the following encryption scheme where RSA is used to encrypt a plaintext m and then we choose a random r and compute: $$A = r + m^e \bmod N$$ and $$B = r^e \bmod N$$ So the ciphertext is ...
2
votes
1
answer
128
views
Why is the adversary in IND-CCA allowed to make encryption queries?
IND-CCA is an abbreviation of "Indistinguishability under chosen ciphertext attack" and generally, an adversary carrying out the chosen ciphertext attack is given a decryption oracle only. ...
2
votes
1
answer
851
views
Chosen Plain text attack [closed]
I have a course work for university, the question is:
Consider a symmetric encryption scheme with its encryption operation written as
$$C = E(K, R||P)$$
where $E$ is a block cipher encryption ...
2
votes
1
answer
247
views
How can CPA-secure LWE cryptosystem be broken by an active attacker?
The LWE-cryptosystem is only CPA-secure as for example stated in A Decade of Lattice-Based Cryptography. Consider the following system described there (Section 5.2)
The secret key is a uniform LWE ...
2
votes
0
answers
78
views
Asymmetric encryption property required in an authentication protocol
We want to choose an asymmetric encryption scheme for use as follows:
A device holds its private key, with the corresponding public key known and trusted by all.
The device also holds a small $b$-bit ...