Questions tagged [chosen-ciphertext-attack]

A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.

2
votes
0answers
22 views

Intuition for Cramer Shoup Encryption Scheme?

I was reading the Cramer Shoup CCA2 secure encryption scheme. The scheme is as follows. Public key = $(g_1, g_2, c, d, h, hk)$, where $c = g_1^{x_1}g_2^{y_1}$, $d = g_1^{x_2}g_2^{y_2}$, $h = g_1^z$, ...
1
vote
2answers
53 views

Efficient attack on RSA with known padding scheme and public key

I am having some trouble with an assignment problem. I hope I can get some guidance here. The question provides us with a public key, $N$ and the padding scheme. This is the padding scheme "Assume ...
0
votes
0answers
69 views

Formal security-definition reference

Is there a reference where all common formal security-definitions are summarized (such as OW-CPA, IND-CPA, IND-CCA1, IND-CCA2, EUF-CMA and so on)? I need a PUBLISHED reference (paper, book) which ...
3
votes
1answer
736 views

Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?

I presented our mathematician with an idea: If you have a black box that encrypts or decrypts AES with the same 128 bit key (you don't have any direct access to the key), and you control the input ...
1
vote
0answers
85 views

Patarin’s H-Coefficient Technique

I have come across many paper that applies Patarin’s H-Coefficient Technique in various cryptographic securities (KPA, CPA, CCA,...). I am asking kindly if someone could explain it simple with ...
1
vote
1answer
49 views

Is chosen ciphertext attack used to obtain a key? [duplicate]

I don't understand what the goals are of a Chosen Ciphertext Attack. What I've read from Wikipedia is that it is an attack one can use to obtain the key that the crypto algorithm uses. However, I ...
2
votes
1answer
37 views

If TDP exist then CCA-secure PKES exist?

My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following: If trapdoor permutations exist then CCA-secure public key ...
2
votes
1answer
67 views

If DDH is hard then CCA-secure PKES exist?

My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following: If decisional Diffie-Hellman problem is hard then there ...
1
vote
0answers
76 views

CCA attack on RSA padded with random oracle

I'm trying to do the ex 11.15 of the Katz-Lindell book. Consider the RSA-based encryption scheme in which a user encrypts a message $m ∈ $ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by ...
4
votes
1answer
108 views

Does Elliptic Curve Integrated Encryption Scheme (ECIES) provide IND-CCA2 security?

I am looking for a faster alternative to RSA with OAEP as a IND-CCA2 public key scheme. Elliptic Curve Integrated Encryption Scheme might be a candidate, but I am not sure if it provides IND-CCA2 ...
5
votes
1answer
128 views

Differences between NewHope-CPA-KEM and NewHope-CCA-KEM

According to the web page for NewHope, an R-LWE post-quantum key encapsulation mechanism (KEM) candidate for standardization, it comes in types that are or IND-CPA or IND-CCA secure. I know what CPA ...
3
votes
1answer
164 views

Symetric key encryption is not Authentication?

Is there any way to show CCA-secure symmetric-key encryption does not have to be an authenticated encryption? I know you can create a setup that isn't authentication, but how will you go about it?
6
votes
1answer
460 views

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks? I have been reading about homomorphic encryption and ...
1
vote
1answer
136 views

CPA-secure of $\Pi$ implies CPA-security of $\Pi||\Pi||\ldots||\Pi$

Katz and Lindell book claim that from the theorem: Any private-key encryption scheme that is CPA-secure is also CPA-secure for multiple encryptions. Follows the fact that: If $(Gen,...
1
vote
1answer
249 views

Unforgeable CPA-secure private-key encryption scheme that is not CCA-secure

This is exercise with 4.26 in Katz and Lindell's introduction to cryptography 2nd ed. The question is: Show a CPA-secure private-key encryption scheme that is unforgeable but is not CCA-secure. ...
2
votes
1answer
79 views

GCM decryption and clear text processing

When using GCM mode decryption, is it necessary to wait for the decryption to complete, (and thus being able to see if the integrity of cipher text is OK) before beginning processing the clear text ...
0
votes
1answer
119 views

Recovery of private key in AES-CBC from two ciphertexts with different IV, but identical plantext

I have a system that encrypts messages for a given user using key K using AES-CBC in response in an external stimulus. Each message has a randomly generated IV. The user never decodes these messages,...
1
vote
1answer
666 views

Is AES-CBC mode not secure against chosen cipher-text attacks even if the IV is not predictable?

I've seen questions where people have asked if AES-CBC mode is vulnerable to chosen cipher-text attacks if the IV is predictable. But is it guaranteed to be secure against chosen cipher text attacks ...
2
votes
0answers
32 views

Trading Chosen-Ciphertext-Protection for Double encryption

Straight to the point: I'm trying to implement double encryption using two cipher suites. One (#1) of them is a stream cipher without any checksum/authentication guarantee, the other (#2) is an AEAD ...
1
vote
0answers
303 views

Cryptanalysis affine cipher and substitution cipher

1) Consider the chosen-plaintext attack on the simple substitution cipher. How many chosen plaintext characters suffice to uniquely determine the key? My answer was: 26! 2) Consider the chosen-...
8
votes
2answers
826 views

Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?

I have written a code to encrypt a plaintext as below. Here I am using bouncycastle crypto provider and referring to the RSA+OAEP for that. ...
0
votes
1answer
136 views

Proof that a modified public-key encryption scheme is not CCA secure

Let $\mathcal{E} = (G, E, D)$ be a CCA-secure public-key encryption scheme defined over $(\mathcal{M, C})$ where $\mathcal{C} := \{0, 1\}^\ell$. Let $\mathcal{E'} = (G, E', D')$ be a scheme (over $(\...
3
votes
1answer
287 views

RSA-CCA security of $m || H(m)$ as input to modular exponentiation

If we encrypt a message $m$ as $m || H(m)$ using textbook RSA encryption algorithm, $H$ is random oracle modeled. In this case the message can be recovered. Is this encryption CCA secure? If so how ...
3
votes
1answer
159 views

Why is the lite version of Cramer-Shoup not IND-CCA2 secure?

In the lite version of Cramer-Shoup we have a group $G$ with generators $g_1$ and $g_2$, private key $a_1, a_2, b_1, b_2$, and public key $A = g_1^{a_1} g_2^{a_2}$, $B = g_1^{b_1} g_2^{b_2}$. ...
0
votes
1answer
218 views

Relationship between CCA/CPA-security and PRFs

I'm a bit confused about the relationship between CCA/CPA-security and PRFs and particularly when do we think of encryption and decryption as a PRF. Assume we have an encryption scheme $\Pi = (Enc, ...
1
vote
0answers
75 views

PKI Challenge Response: why is $h(r) = x$ enough to protect against chosen text attacks?

I think the question was asked somewhere else but not answered very precisely. Quoting from the "Handbook of applied cryptography": Identification based on PK decryption and witness. Consider ...
2
votes
1answer
63 views

Is there a way to double the size of ciphertexts of a public-key scheme which is IND-CCA2

Let $\Pi = \left( \mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec} \right)$ a public-key scheme which is secure in the sense of IND-CCA2. Assume the ciphertexts space is $\mathcal{C} \subset \{0,1\}^{n}$. Can ...
1
vote
2answers
728 views

Can I obtain the hashing algorithm if I know both the input and the output?

Suppose I have a string "Hello World". And I pass it through an unknown function which gives output as "6Xbhkfo520/78". So, ...
4
votes
1answer
693 views

Encrypt-and-mac IND-CCA security

I have been stuck all day trying to understand how to show that an Encrypt-and-Mac ($SE_{EaM}$) scheme is not IND-CCA secure. I have seen this similar post, however it is slightly different and the ...
0
votes
1answer
55 views

The differences between the attackers in the definitions of IND-ATK and NM-ATK

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
2
votes
0answers
87 views

How can I show the new crypto scheme is still IND-CCA1 in proof of “IND-CCA1 does not imply NM-CPA”?

I am trying to show IND-CCA1 does not imply NM-CPA. From what I have read the "classical" proof goes by taking an IND-CCA1 scheme $E$ and modifying it so that the encryption of the inverted plaintext ...
2
votes
1answer
241 views

Attack on AES-CBC with small pool of IV

Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$. I know that if we can predict next IV with 100% probability there is attack that completely breaks ...
4
votes
0answers
263 views

Why is this scheme not IND-CCA2 secure

I know that many lattice cryptosystems cannot be made $\text{IND-CCA2}$ or even $\text{IND-CCA}$ secure without substantial overhead. However, it seems that (when used as a KEM) that any $\text{IND-...
3
votes
1answer
217 views

CCA2-secure encryption based on LWE/Ring-LWE

As I understand it, cryptosystems based on LWE/Ring-LWE are typically only IND-CPA, and fail to satisfy IND-CCA2. In fact, it appears that chosen ciphertext attacks could allow secret key recovery (!)...
1
vote
0answers
70 views

Can I overcome ElGamal malleability with AES preprocessing?

So textbook ElGamal is known to be vulnerable to CPA, and although there are several proposals (DHAES/EIES) for modifications none of those are formally accepted or standardized. My question is ...
1
vote
1answer
164 views

Does security against a CCA1 attacker imply security against a CPA attacker?

I've seen it mentioned multiple times, but have not seen a formal proof of how security of an encryption scheme against a non adaptive chosen-ciphertext attacker (under non-malleability or ciphertext ...
2
votes
3answers
334 views

Invalid challenge-ciphertext in IND-CPA and IND-CCA games

Consider the IND-CPA game between a challenger $C$ and an adversary $A$ for a given public-key encryption scheme $PKE$: $C$ generates a key pair $(pk,sk)$ based on some security parameter $n$, and ...
0
votes
1answer
489 views

many time pad attack [duplicate]

I am a beginner in cryptography. I studied many time pad attack and now I want to solve a popular exercise, It consists 11 ciphertexts (s1,s2,...,s11), that encrypted by a same key and I want to find ...
11
votes
2answers
883 views

Are common (secure) stream ciphers CCA1-secure?

My latest question and especially Ricky Demer's comment on the answer got me thinking: This homomorphic tranformation of RSA is most likely IND-CPA and maybe even IND-CCA1, but if it could be IND-CCA1,...
2
votes
1answer
250 views

Why is adaptive security stronger than CCA1 security, and weaker than CCA2 security?

We know in CCA1 security, after seeing the challenge ciphertext, no more decryption oracles are allowed to the adversary. But in adaptive security, what should the adversary do? ​ Please help me ...
2
votes
0answers
144 views

AES-128: How to find cipherkey comparing wrong and right ciphertexts?

I have a .mat file which contains 10 plaintexts and 10 ciphertexts which are correctly encrypted with AES-128 algorithm. It also contains 10 more ciphertexts which are wrongly encrypted. The fault is ...
5
votes
2answers
304 views

Bleichenbacher attack, binary search, formula for $s_i$

Reading an excellent article explaining Bleichenbacher attack I came across the following statements under the formula for $s_i$: if we pick $r ≥ 2(bs_{i-1} - 2B) / n$, we obtain $(2B + 2(bs_{...
0
votes
1answer
363 views

Build a scheme that is CCA secure but not authenticated

Trying to understand a solution from this paper: Summary: $E'_K=0||E_K(m)$ and $D'_K(0||c)=D_K(c)$ and $D'_K(1||c)=1$ IND-CCA secure (how?) as $1||c$ and $0||c$ are are easily decryptable Not ...
0
votes
1answer
2k views

How to break AES CBC PADDING with chosen ciphertext attack

I'm doing a penetration testing for a web application that uses AES CBC PADDING encryption for the parameter ?email=ciphertext then it's printing the plaintext email on html body. I would like to ...
1
vote
1answer
218 views

To which game-based security definition is Perfect Secrecy equivalent?

We all know the classic definitions of perfect secrecy, being $$\Pr[M=m|C=c]=\Pr[M=m]$$ and $$H(M|C)=H(M)$$ But now what I've asked myself: If we were to remove the polynomial restriction on the ...
3
votes
1answer
126 views

Can you help me understand indistinguishably as described in the CPA security definition?

When I read the definition of the CPA indistinguishably encryption scheme, I see that the adversary can use an oracle as many times (to get as many encryptions of any messages it choose). An the end ...
0
votes
1answer
279 views

Prove if it is a CCA secure Commitment

Assume we have a IND-CCA-secure PKC (Public-Key-Cryption) and we construct a commitment-scheme(commit, reveal) with that IND-CCA-secure PKC (so that commitment should be IND-CCA-secure too). But how ...
2
votes
1answer
96 views

How any attack on a cipher carried out? Are these practical or only theoretical?

I have been reading about successful attacks on AES and other ciphers. One such mention is here (see excerpt below): AES was published under the name Rijndael in 1998. Refereed cryptanalytic ...
1
vote
0answers
644 views

CBC mode is not IND-CCA2 secure with no prediction of IV

How can it be explained that CBC mode is not IND-CCA2 secure, in case that the IV can't be predicted by adversary. Edit: In decryption of CBC, for each block it is XORed with previous block's cipher ...
0
votes
1answer
427 views

IND-CCA Security of a encryption scheme which is combination of two schemes

I have two public key encryption scheme $\Pi_0$ and $\Pi_1$ and one of them is IND-CCA secure, another one is IND-CPA secure. Let $\Pi$ be a public key encryption scheme, which is a combination of $\...