Questions tagged [chosen-ciphertext-attack]

A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.

Filter by
Sorted by
Tagged with
0
votes
1answer
57 views

Is Cramer-Shoup Lite IND-CCA secure?

Recently, I studied about Cramer-Shoup encryption scheme. Then, I read a book which mentioned a simpler version of this scheme, the Cramer-Shoup Lite encryption scheme. I was wondering if there is ...
1
vote
1answer
38 views

Why does this attack on a simplified version of the Naor-Yung scheme not work for the original scheme?

tl;dr: We were given a homework, in which we should discuss, whether encrypting twice in the Naor-Yung scheme is actually necessary. I could prove that it is, by constructing an attacker on a scheme ...
0
votes
1answer
79 views

CCA security of this scheme

Let $k$ be uniformly sampled from $\{0,1\}^\lambda$, $F$ be a secure PRP with block length $\lambda$ and let $Enc(k, m)$ be such that it returns $c = (F(k,r), r \oplus F(k,m))$ with $r$ uniformly ...
1
vote
1answer
191 views

How to prove an encryption scheme is not CCA secure

Given the following context below, how does one show or prove the encryption scheme is NOT IND-CCA secure The IND-CPA secure private-key encryption scheme for n-bit messages can be constructed from a ...
3
votes
2answers
202 views

Attack on security model for RSA-FDH

I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is ...
0
votes
1answer
278 views

Proving the CCA-insecurity of El Gamal encryption scheme

I am trying to prove that El Gamal Encryption is not CCA-Secure. If an adversary queried the encryption oracle for the encryption of $m=1$, he'll get a pair $(c_1,c_2)=(g^y,g^{xy}\cdot m)=(g^y,g^{xy}\...
2
votes
1answer
130 views

How many required known plaintexts for an attack are considered insecure?

I stumbled over this problem when looking at symmetrical block ciphers with a relatively small block size like 32 bit. When I was looking at more common block ciphers with a 64 bit, I learned that ...
2
votes
0answers
59 views

Intuition for Cramer Shoup Encryption Scheme?

I was reading the Cramer Shoup CCA2 secure encryption scheme. The scheme is as follows. Public key = $(g_1, g_2, c, d, h, hk)$, where $c = g_1^{x_1}g_2^{y_1}$, $d = g_1^{x_2}g_2^{y_2}$, $h = g_1^z$, ...
1
vote
1answer
104 views

Is Hybrid Encryption CCA secure?

If Enc is a PKE(Public Key Encryption) with key generation algorithm KG and message space $M = \{0, 1\}^n$, and SE is a Symmetric Key Encryption(SKE) with key space $\{0, 1\}^n$ and message space $M' =...
1
vote
2answers
108 views

Efficient attack on RSA with known padding scheme and public key

I am having some trouble with an assignment problem. I hope I can get some guidance here. The question provides us with a public key, $N$ and the padding scheme. This is the padding scheme "Assume ...
0
votes
0answers
93 views

Formal security-definition reference

Is there a reference where all common formal security-definitions are summarized (such as OW-CPA, IND-CPA, IND-CCA1, IND-CCA2, EUF-CMA and so on)? I need a PUBLISHED reference (paper, book) which ...
3
votes
1answer
783 views

Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?

I presented our mathematician with an idea: If you have a black box that encrypts or decrypts AES with the same 128 bit key (you don't have any direct access to the key), and you control the input ...
1
vote
0answers
97 views

Patarin’s H-Coefficient Technique

I have come across many paper that applies Patarin’s H-Coefficient Technique in various cryptographic securities (KPA, CPA, CCA,...). I am asking kindly if someone could explain it simple with ...
1
vote
1answer
83 views

Is chosen ciphertext attack used to obtain a key? [duplicate]

I don't understand what the goals are of a Chosen Ciphertext Attack. What I've read from Wikipedia is that it is an attack one can use to obtain the key that the crypto algorithm uses. However, I ...
2
votes
1answer
50 views

If TDP exist then CCA-secure PKES exist?

My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following: If trapdoor permutations exist then CCA-secure public key ...
2
votes
1answer
78 views

If DDH is hard then CCA-secure PKES exist?

My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following: If decisional Diffie-Hellman problem is hard then there ...
1
vote
0answers
126 views

CCA attack on RSA padded with random oracle

I'm trying to do the ex 11.15 of the Katz-Lindell book. Consider the RSA-based encryption scheme in which a user encrypts a message $m ∈ $ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by ...
4
votes
1answer
195 views

Does Elliptic Curve Integrated Encryption Scheme (ECIES) provide IND-CCA2 security?

I am looking for a faster alternative to RSA with OAEP as a IND-CCA2 public key scheme. Elliptic Curve Integrated Encryption Scheme might be a candidate, but I am not sure if it provides IND-CCA2 ...
6
votes
1answer
208 views

Differences between NewHope-CPA-KEM and NewHope-CCA-KEM

According to the web page for NewHope, an R-LWE post-quantum key encapsulation mechanism (KEM) candidate for standardization, it comes in types that are IND-CPA or IND-CCA secure. I know what CPA and ...
3
votes
1answer
172 views

Symetric key encryption is not Authentication?

Is there any way to show CCA-secure symmetric-key encryption does not have to be an authenticated encryption? I know you can create a setup that isn't authentication, but how will you go about it?
6
votes
1answer
470 views

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks? I have been reading about homomorphic encryption and ...
1
vote
1answer
268 views

CPA-secure of $\Pi$ implies CPA-security of $\Pi||\Pi||\ldots||\Pi$

Katz and Lindell book claim that from the theorem: Any private-key encryption scheme that is CPA-secure is also CPA-secure for multiple encryptions. Follows the fact that: If $(Gen,...
1
vote
1answer
373 views

AES-GCM secure against IND-CCA2

How would you prove that AES-GCM is secure against a chosen ciphertext attack (IND-CCA2), assuming that the attacker cannot forge AES-GCM MAC tags in less than brute force?
1
vote
1answer
378 views

Unforgeable CPA-secure private-key encryption scheme that is not CCA-secure

This is exercise with 4.26 in Katz and Lindell's introduction to cryptography 2nd ed. The question is: Show a CPA-secure private-key encryption scheme that is unforgeable but is not CCA-secure. ...
2
votes
1answer
101 views

GCM decryption and clear text processing

When using GCM mode decryption, is it necessary to wait for the decryption to complete, (and thus being able to see if the integrity of cipher text is OK) before beginning processing the clear text ...
0
votes
1answer
179 views

Recovery of private key in AES-CBC from two ciphertexts with different IV, but identical plantext

I have a system that encrypts messages for a given user using key K using AES-CBC in response in an external stimulus. Each message has a randomly generated IV. The user never decodes these messages,...
1
vote
1answer
999 views

Is AES-CBC mode not secure against chosen cipher-text attacks even if the IV is not predictable?

I've seen questions where people have asked if AES-CBC mode is vulnerable to chosen cipher-text attacks if the IV is predictable. But is it guaranteed to be secure against chosen cipher text attacks ...
2
votes
0answers
37 views

Trading Chosen-Ciphertext-Protection for Double encryption

Straight to the point: I'm trying to implement double encryption using two cipher suites. One (#1) of them is a stream cipher without any checksum/authentication guarantee, the other (#2) is an AEAD ...
1
vote
0answers
397 views

Cryptanalysis affine cipher and substitution cipher

1) Consider the chosen-plaintext attack on the simple substitution cipher. How many chosen plaintext characters suffice to uniquely determine the key? My answer was: 26! 2) Consider the chosen-...
9
votes
2answers
1k views

Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?

I have written a code to encrypt a plaintext as below. Here I am using bouncycastle crypto provider and referring to the RSA+OAEP for that. ...
0
votes
1answer
237 views

Proof that a modified public-key encryption scheme is not CCA secure

Let $\mathcal{E} = (G, E, D)$ be a CCA-secure public-key encryption scheme defined over $(\mathcal{M, C})$ where $\mathcal{C} := \{0, 1\}^\ell$. Let $\mathcal{E'} = (G, E', D')$ be a scheme (over $(\...
3
votes
1answer
333 views

RSA-CCA security of $m || H(m)$ as input to modular exponentiation

If we encrypt a message $m$ as $m || H(m)$ using textbook RSA encryption algorithm, $H$ is random oracle modeled. In this case the message can be recovered. Is this encryption CCA secure? If so how ...
3
votes
1answer
414 views

Why is the lite version of Cramer-Shoup not IND-CCA2 secure?

In the lite version of Cramer-Shoup we have a group $G$ with generators $g_1$ and $g_2$, private key $a_1, a_2, b_1, b_2$, and public key $A = g_1^{a_1} g_2^{a_2}$, $B = g_1^{b_1} g_2^{b_2}$. ...
0
votes
1answer
329 views

Relationship between CCA/CPA-security and PRFs

I'm a bit confused about the relationship between CCA/CPA-security and PRFs and particularly when do we think of encryption and decryption as a PRF. Assume we have an encryption scheme $\Pi = (Enc, ...
1
vote
0answers
91 views

PKI Challenge Response: why is $h(r) = x$ enough to protect against chosen text attacks?

I think the question was asked somewhere else but not answered very precisely. Quoting from the "Handbook of applied cryptography": Identification based on PK decryption and witness. Consider ...
2
votes
1answer
69 views

Is there a way to double the size of ciphertexts of a public-key scheme which is IND-CCA2

Let $\Pi = \left( \mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec} \right)$ a public-key scheme which is secure in the sense of IND-CCA2. Assume the ciphertexts space is $\mathcal{C} \subset \{0,1\}^{n}$. Can ...
1
vote
2answers
1k views

Can I obtain the hashing algorithm if I know both the input and the output?

Suppose I have a string "Hello World". And I pass it through an unknown function which gives output as "6Xbhkfo520/78". So, ...
4
votes
1answer
936 views

Encrypt-and-mac IND-CCA security

I have been stuck all day trying to understand how to show that an Encrypt-and-Mac ($SE_{EaM}$) scheme is not IND-CCA secure. I have seen this similar post, however it is slightly different and the ...
0
votes
1answer
66 views

The differences between the attackers in the definitions of IND-ATK and NM-ATK

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
2
votes
0answers
122 views

How can I show the new crypto scheme is still IND-CCA1 in proof of “IND-CCA1 does not imply NM-CPA”?

I am trying to show IND-CCA1 does not imply NM-CPA. From what I have read the "classical" proof goes by taking an IND-CCA1 scheme $E$ and modifying it so that the encryption of the inverted plaintext ...
2
votes
1answer
266 views

Attack on AES-CBC with small pool of IV

Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$. I know that if we can predict next IV with 100% probability there is attack that completely breaks ...
4
votes
0answers
327 views

Why is this scheme not IND-CCA2 secure

I know that many lattice cryptosystems cannot be made $\text{IND-CCA2}$ or even $\text{IND-CCA}$ secure without substantial overhead. However, it seems that (when used as a KEM) that any $\text{IND-...
3
votes
1answer
245 views

CCA2-secure encryption based on LWE/Ring-LWE

As I understand it, cryptosystems based on LWE/Ring-LWE are typically only IND-CPA, and fail to satisfy IND-CCA2. In fact, it appears that chosen ciphertext attacks could allow secret key recovery (!)...
1
vote
0answers
83 views

Can I overcome ElGamal malleability with AES preprocessing?

So textbook ElGamal is known to be vulnerable to CPA, and although there are several proposals (DHAES/EIES) for modifications none of those are formally accepted or standardized. My question is ...
1
vote
1answer
205 views

Does security against a CCA1 attacker imply security against a CPA attacker?

I've seen it mentioned multiple times, but have not seen a formal proof of how security of an encryption scheme against a non adaptive chosen-ciphertext attacker (under non-malleability or ciphertext ...
2
votes
3answers
384 views

Invalid challenge-ciphertext in IND-CPA and IND-CCA games

Consider the IND-CPA game between a challenger $C$ and an adversary $A$ for a given public-key encryption scheme $PKE$: $C$ generates a key pair $(pk,sk)$ based on some security parameter $n$, and ...
0
votes
1answer
619 views

many time pad attack [duplicate]

I am a beginner in cryptography. I studied many time pad attack and now I want to solve a popular exercise, It consists 11 ciphertexts (s1,s2,...,s11), that encrypted by a same key and I want to find ...
11
votes
2answers
1k views

Are common (secure) stream ciphers CCA1-secure?

My latest question and especially Ricky Demer's comment on the answer got me thinking: This homomorphic tranformation of RSA is most likely IND-CPA and maybe even IND-CCA1, but if it could be IND-CCA1,...
2
votes
1answer
339 views

Why is adaptive security stronger than CCA1 security, and weaker than CCA2 security?

We know in CCA1 security, after seeing the challenge ciphertext, no more decryption oracles are allowed to the adversary. But in adaptive security, what should the adversary do? ​ Please help me ...
2
votes
0answers
160 views

AES-128: How to find cipherkey comparing wrong and right ciphertexts?

I have a .mat file which contains 10 plaintexts and 10 ciphertexts which are correctly encrypted with AES-128 algorithm. It also contains 10 more ciphertexts which are wrongly encrypted. The fault is ...