Questions tagged [chosen-ciphertext-attack]

A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.

Filter by
Sorted by
Tagged with
0
votes
0answers
25 views

IND-CCA game proof of Encrypt-then-Mac

In [BN07, Subsection 4.3], the authors show that if a symmetric scheme $\mathcal{SE}$ is IND-CPA and a MAC $\mathcal{MA}$ is EUF-CMA (though they use the SUF-CMA notation, but I think it refers to the ...
0
votes
0answers
37 views

Guarding against vulnerabilities for a digital signature service (RSA )

Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload. What are the possible attacks that I would need to guard against in this context (primarily assuming ...
0
votes
0answers
25 views

Extended message space public key scheme

Being $\mathcal{E}$ a public key schem,let the following encryption scheme $\mathcal{E}^2=(G^2,E^2,D^2)$, where \begin{equation*} \begin{split} G^2()&:=(pk_{0},sk_{0}) \xleftarrow{R}, (pk_{...
0
votes
0answers
33 views

Question about IND-CCA security

We are given the following securitygame $G^{\text{LOSTNAME}}$: Generate $k \leftarrow \{0,1\}^{\kappa}$ uniformly at random Choose $h \leftarrow \{0,1\}$ uniformly random Create decryption oracle $\...
1
vote
1answer
60 views

Security of Paillier against chosen ciphertext attack

Is there a proof by now that Paillier is secure against chosen-ciphertext attack? The original Paillier paper mentions that it is not.
5
votes
1answer
92 views

Is there a relation between passive/active attacks and IND-CPA/IND-CCA?

I've seen some papers drawing a connection between IND-CPA and passive attacks and IND-CCA and active attacks. Can someone explain how IND-CPA relates to passive attacks and IND-CCA relates to active ...
3
votes
1answer
79 views

Can a CCA-secure cryptosystem be used as a CMA-secure MAC?

Can every CCA-secure cryptosystem be used as a CMA-secure MAC? I know that every CCA-secure system is CPA-secure, but I'm not sure about CMA. From what I understand: for a system to be CCA-secure, it ...
0
votes
1answer
73 views

CCA secure vs AE scheme

We already know that every authenticated encryption scheme is CCA secure, I was wondering about the converse. I believe it is not true, and I am finding trouble to construct a scheme which is only CCA ...
3
votes
1answer
106 views

IND-CCA secure symmetric encryption

Although this question maybe looks silly, I have searched similar questions in this forum and googled it but got no desired answers. IND-CCA security has already been deeply studied in public ...
2
votes
0answers
36 views

Secure CCA Encryption under Partial Key Exposure

I'm currently learning about chosen ciphertext attack and stumbled across a problem on CCA security. If I have an encryption scheme $(Gen,Enc,Dec)$, which is CCA-secure with $Enc:\{0,1\}^n\times \{0,1\...
0
votes
1answer
78 views

Chosen Cipher Text Security for Double Encryption

If $E_k$ is a CCA secure encryption scheme then why is $Eโ€ฒ_{(k_1,k_2)}(M)=E_{k_2}(E_{k_1}(M))$, $Dโ€ฒ_{(k_1,k_2)}(C)=D_{k_1}(D_{k_2}(C))$ not CCA secure when $k_2$ is known. Is there a way I can make a ...
0
votes
0answers
46 views

ElGamal with massage hashed ind-cca secure?

It is well known that text book ElGamal is not IND-CCA secure, because an attacker can just have $$(Y,W)\leftarrow E_{x}(LR(M1,M2,b))$$ where M1, and M2 can be any message in the group, and than just ...
2
votes
1answer
103 views

Which attacker model is weaker? IND-CPA or OW-CCA?

I know that IND-CPA is a security goal, which is defined as the inability of an attacker to distinguish two ciphertext of some arbitrary chosen plaintexts. Unfortunately i havent found a good ...
1
vote
1answer
142 views

How the message is decrypted in an RSA chosen ciphertext attack when it's a modulo?

During the last stage of decryption of a chosen ciphertext attack we are left off with this equation $$c = m \cdot t \pmod n$$ Removing all exponents like $d$ and $e$ where $c$ is the decrypted ...
1
vote
0answers
56 views

CCA Security/Decryption of PRF scheme

Let $F : \{0,1\}^n \times \{0,1\}^n \rightarrow \{0,1\}^n $ be a PRF. And let the encryption function be $Enc{_k}(m) = r\mathbin\| (F{_k}(m\bigoplus r)$ , r being a random value. Im trying to proof ...
0
votes
0answers
82 views

RNG to hide some bits

Suppose I have a sequence of bits of length M. I need to hide N out of M bits (hiding means forcing them to be 0) using RNG with a key. How I can relate the output of RNG to the number and positions ...
6
votes
2answers
423 views

Why does Encrypt-Then-Sign not yield a CCA-secure public-key encryption scheme?

In symmetric cryptography, combining an IND-CPA secure symmetric encryption scheme with a secure MAC with the encrypt-then-MAC method yields a IND-CCA secure symmetric encryption scheme. I am trying ...
1
vote
1answer
98 views

Finding RSA private exponent with a chosen ciphertext attack?

Let's say there's this blackbox app that has a known modulus $N$, private exponent $e$, and takes ciphertext $C$ encrypted against $N$ and $e$ input and outputs plaintext $M$. The encryption is done ...
0
votes
1answer
161 views

How to prove that RSA is not IND-CCA2?

RSA is homomorphic wrt multiplication and therefore it is not IND-CCA2. But how to show it. What are the steps to win IND-CCA2 game? How is the probability of winning calculated?
3
votes
0answers
38 views

Markov ciphers - generalized group operation

Iโ€™m reading this paper of Lai and Massey where they give a very nice perspective on differential attacks in general http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass-inspec-1991-3.pdf They do their ...
1
vote
1answer
57 views

Knowledge of discrete log is needed in the proof of Cramer-Shoup public key scheme?

In the proof of the Cramer-Shoup public key scheme [1], I understand that the adversary's view can be seen as equations such as $\log c = x_1 + w x_2, \log d = y_1 + w y_2$ and so on (equation 1 and 2 ...
1
vote
1answer
112 views

How can I show RSA-OAEP is not IND-CCA secure if G always outputs 0 (i.e. there is no hash function)?

Here is what I understand the algorithm to be: Let $G, H$ be one-way functions, where G outputs the 0 string. ๐ธ๐‘›๐‘๐‘œ๐‘‘๐‘’ Select a random $๐‘˜$-bit integer $๐‘Ÿ$. Pad out $๐‘š$ with $0$s to length $๐‘™...
2
votes
0answers
68 views

Proofs that NM-CPA implies IND-Cpa and $\text{IND-CCA} \leftrightarrow \text{NM-CCA}$

I am looking for a proof for the following two claims from "Serious Cryptography" by Aumasson. NM-CPA implies IND-CPA. [...] IND-CCA and NM-CCA are equivalent notions that imply the presence of the ...
3
votes
2answers
117 views

Bleichenbacher-attack test vectors

I was trying to understand the Bleichenbacher-attack. I went through the paper of Bleichenbacher to understand it bit more. However I tried to get some test vectors to simulate this attack locally but ...
0
votes
1answer
165 views

Is Cramer-Shoup Lite IND-CCA secure?

Recently, I studied about Cramer-Shoup encryption scheme. Then, I read a book which mentioned a simpler version of this scheme, the Cramer-Shoup Lite encryption scheme. I was wondering if there is ...
0
votes
1answer
87 views

Trapdoors for Lattices: CCA-secure encryption

In Trapdoors for Lattices:Simpler, Tighter, Faster, Smaller, Micciancio and Peikert proposed a CCA-secure encryption. However, I am confused about the step in decryption algorithm (p.36 Lemma 6.2.). ...
1
vote
1answer
69 views

Why does this attack on a simplified version of the Naor-Yung scheme not work for the original scheme?

tl;dr: We were given a homework, in which we should discuss, whether encrypting twice in the Naor-Yung scheme is actually necessary. I could prove that it is, by constructing an attacker on a scheme ...
0
votes
1answer
151 views

CCA security of this scheme

Let $k$ be uniformly sampled from $\{0,1\}^\lambda$, $F$ be a secure PRP with block length $\lambda$ and let $Enc(k, m)$ be such that it returns $c = (F(k,r), r \oplus F(k,m))$ with $r$ uniformly ...
1
vote
1answer
925 views

How to prove an encryption scheme is not CCA secure

Given the following context below, how does one show or prove the encryption scheme is NOT IND-CCA secure The IND-CPA secure private-key encryption scheme for n-bit messages can be constructed from a ...
3
votes
2answers
394 views

Attack on security model for RSA-FDH

I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is ...
0
votes
1answer
913 views

Proving the CCA-insecurity of El Gamal encryption scheme

I am trying to prove that El Gamal Encryption is not CCA-Secure. If an adversary queried the encryption oracle for the encryption of $m=1$, he'll get a pair $(c_1,c_2)=(g^y,g^{xy}\cdot m)=(g^y,g^{xy}\...
2
votes
1answer
237 views

How many required known plaintexts for an attack are considered insecure?

I stumbled over this problem when looking at symmetrical block ciphers with a relatively small block size like 32 bit. When I was looking at more common block ciphers with a 64 bit, I learned that ...
2
votes
0answers
107 views

Intuition for Cramer Shoup Encryption Scheme?

I was reading the Cramer Shoup CCA2 secure encryption scheme. The scheme is as follows. Public key = $(g_1, g_2, c, d, h, hk)$, where $c = g_1^{x_1}g_2^{y_1}$, $d = g_1^{x_2}g_2^{y_2}$, $h = g_1^z$, ...
1
vote
1answer
251 views

Is Hybrid Encryption CCA secure?

If Enc is a PKE(Public Key Encryption) with key generation algorithm KG and message space $M = \{0, 1\}^n$, and SE is a Symmetric Key Encryption(SKE) with key space $\{0, 1\}^n$ and message space $M' =...
1
vote
2answers
445 views

Efficient attack on RSA with known padding scheme and public key

I am having some trouble with an assignment problem. I hope I can get some guidance here. The question provides us with a public key, $N$ and the padding scheme. This is the padding scheme "Assume ...
0
votes
0answers
139 views

Formal security-definition reference

Is there a reference where all common formal security-definitions are summarized (such as OW-CPA, IND-CPA, IND-CCA1, IND-CCA2, EUF-CMA and so on)? I need a PUBLISHED reference (paper, book) which ...
3
votes
1answer
911 views

Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?

I presented our mathematician with an idea: If you have a black box that encrypts or decrypts AES with the same 128 bit key (you don't have any direct access to the key), and you control the input ...
8
votes
2answers
577 views

What do NM-CPA and NM-CCA mean?

When I've been researching authenticated encryption, the following terms keep showing up: NM-CPA NM-CCA ....without any definition as to what they mean. I've tried searching the web for their ...
2
votes
0answers
121 views

Patarinโ€™s H-Coefficient Technique

I have come across many paper that applies Patarinโ€™s H-Coefficient Technique in various cryptographic securities (KPA, CPA, CCA,...). I am asking kindly if someone could explain it simple with ...
1
vote
1answer
146 views

Is chosen ciphertext attack used to obtain a key? [duplicate]

I don't understand what the goals are of a Chosen Ciphertext Attack. What I've read from Wikipedia is that it is an attack one can use to obtain the key that the crypto algorithm uses. However, I ...
2
votes
1answer
87 views

If TDP exist then CCA-secure PKES exist?

My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following: If trapdoor permutations exist then CCA-secure public key ...
2
votes
1answer
103 views

If DDH is hard then CCA-secure PKES exist?

My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following: If decisional Diffie-Hellman problem is hard then there ...
0
votes
0answers
235 views

Strong pseudo random permutation implies CCA-security

Let $F$ be a strong pseudo random permutation and define a fixed-length encryption scheme $(\operatorname{Enc,Dec})$ as follows: On input $m \in \{0,1\}^{\frac{n}{2}}$ and key $k\in \{0,1\}^{n}$, ...
1
vote
0answers
210 views

CCA attack on RSA padded with random oracle

I'm trying to do the ex 11.15 of the Katz-Lindell book. Consider the RSA-based encryption scheme in which a user encrypts a message $m โˆˆ $ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by ...
4
votes
1answer
317 views

Does Elliptic Curve Integrated Encryption Scheme (ECIES) provide IND-CCA2 security?

I am looking for a faster alternative to RSA with OAEP as a IND-CCA2 public key scheme. Elliptic Curve Integrated Encryption Scheme might be a candidate, but I am not sure if it provides IND-CCA2 ...
6
votes
1answer
356 views

Differences between NewHope-CPA-KEM and NewHope-CCA-KEM

According to the web page for NewHope, an R-LWE post-quantum key encapsulation mechanism (KEM) candidate for standardization, it comes in types that are IND-CPA or IND-CCA secure. I know what CPA and ...
3
votes
1answer
181 views

Symetric key encryption is not Authentication?

Is there any way to show CCA-secure symmetric-key encryption does not have to be an authenticated encryption? I know you can create a setup that isn't authentication, but how will you go about it?
8
votes
1answer
515 views

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks? I have been reading about homomorphic encryption and ...
1
vote
1answer
620 views

CPA-secure of $\Pi$ implies CPA-security of $\Pi||\Pi||\ldots||\Pi$

Katz and Lindell book claim that from the theorem: Any private-key encryption scheme that is CPA-secure is also CPA-secure for multiple encryptions. Follows the fact that: If $(Gen,...
2
votes
1answer
691 views

AES-GCM secure against IND-CCA2

How would you prove that AES-GCM is secure against a chosen ciphertext attack (IND-CCA2), assuming that the attacker cannot forge AES-GCM MAC tags in less than brute force?