Questions tagged [chosen-ciphertext-attack]
A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.
212
questions
1
vote
1
answer
29
views
Question about the notation $H\leftarrow\mathcal{H}_{\mathcal{K}}$ in an IND-CCA security experiment
In the paper
"Hybrid Key Encapsulation Mechanisms and Authenticated Key Exchange"
by Bindel et al., I looked at the IND-CCA security experiment (figure 3).
In the first line of the game, ...
- 2,848
68
votes
1
answer
34k
views
Easy explanation of "IND-" security notions?
There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security.
...
- 138k
2
votes
1
answer
109
views
Why is the adversary in IND-CCA allowed to make encryption queries?
IND-CCA is an abbreviation of "Indistinguishability under chosen ciphertext attack" and generally, an adversary carrying out the chosen ciphertext attack is given a decryption oracle only. ...
- 47.5k
14
votes
5
answers
9k
views
Does Grover's algorithm really threaten symmetric security proofs?
By Shannon's theorem of perfect security, if I give you a ciphertext 'LOUPL', you can do a brute-force attack and then you would find plaintexts like 'HELLO', 'APPLE', 'SPOON', but you can't ...
- 372
0
votes
0
answers
34
views
Chosen plaintext attack on Blum–Goldwasser cryptosystem
As I was reading on some encryption schemes the other day, I stumbled upon the Blum–Goldwasser cryptosystem and read that it is vulnerable to adaptive chosen ciphertext attack.
I searched for some ...
- 33
3
votes
1
answer
171
views
Kyber-CCA-KEM - Deterministic implicit rejection
In Kyber-CCA-KEM, there's a step in the Fujisaki-Okamoto transformation, where decryption failure results in a random shared secret returned from the decapsulation call.
I have a C language project ...
- 2,116
3
votes
1
answer
119
views
Does CCA security require rejection?
It seems like every CCA-secure KEM1 has some sort of check that the decapsulator performs. Sometimes failure will result in rejection ("explicit rejection") or the decapsulator will simply ...
- 12k
1
vote
1
answer
311
views
CBC not CCA secure
I always get stuck at those kind of exercises in my Cryptography class. I just don't understand how should I build these scenarios of "sending m1 and m2 and then somehow telling if it was m1 or ...
CommunityBot
- 1
3
votes
1
answer
193
views
KYBER.CPAPKE: IND-CCA Security of Lyubashevsky, Peikert, Regev (LPR) Encryption
The NIST Kyber KEM spec. defines an encryption scheme, KYBER.CPAPKE, that's a variant of the so called Lyubashevsky, Peikert, Regev ("LPR") encryption scheme [1]. While LPR encryption is ...
- 9,001
1
vote
1
answer
413
views
Does CCA security imply perfect secrecy?
Can any encryption scheme that is CCA (Chosen Ciphertext Attack) secure be considered to achieve perfect secrecy?
- 12k
1
vote
1
answer
81
views
Are RSA-KEM key exchange material cyphertexts indistinguishable from random noise?
First of all, I know that I should not be using RSA in 2023, and that I'm better off with Elligator2 + ECIES for a variety of reasons.
However, I am thinking about whether RSA-KEM can be used for PURB-...
- 1,701
2
votes
1
answer
409
views
Is Cramer-Shoup Lite IND-CCA secure?
Recently, I studied about Cramer-Shoup encryption scheme. Then, I read a book which mentioned a simpler version of this scheme, the Cramer-Shoup Lite encryption scheme.
I was wondering if there is ...
CommunityBot
- 1
1
vote
0
answers
100
views
Which encryption method support 256 bytes block size?
I am looking at some secret encryption method that apparently uses CBC and a block size of 256 bytes. I can do a chosen-ciphertext-attack. When I modify a single byte in the ciphertext a complete ...
- 11
3
votes
0
answers
47
views
Variant of CCA security for Paillier with blinded decryption oracle
Consider a variant of the Paillier encryption scheme where the message space is restricted to $\mathbb{Z}_q$ such that the RSA modulus $N$ of the Paillier cryptosystem satisfies $N > q + q^2$. I am ...
1
vote
1
answer
114
views
How is Crystal Kyber CPA-secure algorithms converted into a CCA-secure algorithm
In Crystal Kyber specification, page no10, there are 3 algorithms namely KYBER.CCAKEM for making the CPA-secure Kyber into CCA-secure one.
Q1: How is the shared key K being generated in KYBER.CCAKEM....
- 33
1
vote
0
answers
87
views
Clarification for CCA security (or - why is the following not a Rabin CCA attack?)
In three different, highly reputable sources (e.g. "Introduction to Modern Cryptography" by Katz and Lindell, 2007), the definition of CCA attack doesn't allow the adversary to decrypt the ...
- 2,565
1
vote
1
answer
80
views
Is AES distinguishable if the attacker has an decryption oracle?
Let the following game be given:
G^IND-CCA':
Prepare a key k <- KeyGen(1^Kappa)
Choose a hidden bit h <- {0, 1} uniformly random
Prepare a decryption oracle O_Dec. Given a cipher text c, it ...
- 447
0
votes
1
answer
68
views
Curious about CCA attack for RSA, and Kerckhoffs's principle in general
I'm a student studying cybersecurity for the first time, and the part where our textbook explains using CCA attacks for RSAs seemed really unclear for me, so I am here seeking for clarification.
Our ...
- 21.2k
1
vote
0
answers
61
views
Construction of a SKE scheme based on a PRF family and on a MAC with UF-CMA security. Is the scheme secure?
Consider the following construction of a SKE scheme $\Pi^*=(Enc^*,Dec^*)$ based on a PRF family $F=\{F_k:\{0,1\}^n\rightarrow \{0,1\}^n\}_{k\in\{0,1\}^\lambda}$ and on a MAC
$ Tag:\{0,1\}^\lambda \...
- 33
1
vote
0
answers
37
views
What are the possible CCA attacks on RSA with r||m+G(r) as the padding?
I was trying to come up with simple padding functions for the RSA, then trying to break them just to have a better understanding of why we need all the pieces used in the RSA OAEP... So, I am ...
0
votes
0
answers
82
views
CCA-Attacks in the real (and digital) world
Is any concrete and real examples of CCA-attacks in recent history.
I'm aware about examples of WW2, but I'm more interested to modern examples in a digital context (for example against OFB, CBC).
- 2,565
1
vote
0
answers
124
views
Bleichenbacher 1998 "Million message attack" CCA
After implementing and playing around with famous "Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1" there couple of questions which I can't really ...
0
votes
1
answer
85
views
Is the following scheme CCA secure? I purposed a scheme and I am not sure if it is CCA secure, if not, how can it be CCA secure?
Here is my idea:
Under the symmetric key encryption. Alice and Bob share the symmetric key K. Let HASH be a secure hash function and ...
- 2,848
2
votes
1
answer
411
views
CPA secure to CCA secure encryption
Can we use a MAC to transform a CPA secure encryption scheme into CCA secure one?
- 2,848
2
votes
1
answer
120
views
Can we achieve IND-CCA without a MAC?
In modern cryptography, IND-CPA is the lowest security we want. We want at least IND-CCAx security from encryption mode. Their relation can be found in
2007 Authenticated Encryption: Relations among ...
- 12k
1
vote
0
answers
95
views
Essential requirement for IND-CCA1 and IND-CCA2
I am learning about the concept of two security notions called IND-, which include IND-CPA, IND-CCA1 and IND-CCA2. While I got some grasp understanding about the scenarios between the challenger & ...
- 85
0
votes
1
answer
174
views
Can we force a chosen ciphertext to be decrypted to a chosen plaintext while controlling only $e(=3)$ in RSA? [duplicate]
I have bumped into this challenge from a well known CTF site. I don't want to make a reference to it because I don't want this to be a hint for anyone. And also to avoid giving out the source code of ...
- 21.9k
1
vote
0
answers
114
views
Trying to understand this Solution related to CCA security
4.25) Let F be a strong pseudorandom permutation, and define the following fixed-length encryption scheme: On input a message $m ∈ \{0,1\}^{n/2}$ and key $k ∈ \{0,1\}^n$, algorithm $Enc$ chooses a ...
- 21.2k
0
votes
1
answer
49
views
QR-PKE not CCA secure
Due to a comment stating "... QR-PKE is secure (CPA)..." I've been thinking of how to prove that it's not CCA secure, and would like to understand whether my proof is correct.
Here's the QR-...
- 383
1
vote
1
answer
216
views
Analysis of the Vigenere cipher
Im just starting out learning some cryptoanalysis techniques. I came across an idea which analyzes the vigenere cipher. Essentially the video explains that there is a standard english probability ...
CommunityBot
- 1
0
votes
1
answer
132
views
Proving that RSA CCA is possible
I'm reading from William Stalling's Cryptography & Network Security - 7th Edition
To me the first line suggests
$$(M^e\bmod n)\times(2^e\bmod n)=((2M)^e\bmod n)$$
which means that if we want to ...
- 138k
1
vote
2
answers
378
views
How can we measure the security levels of post-quantum cryptographic algorithms? Is there a standard way of this measurement?
How do we measure the security levels of Post Quantum Cryptographic algorithms such as: NTRU Prime, Saber, Kyber,...that are submited to NIST PQC Standardization Process(Competition) in general?
I ...
- 46
5
votes
1
answer
2k
views
The essential differences between IND-CCA1 and IND-CCA2?
For some encryption scheme $(\mathcal{E}, \mathcal{D})$:
In the definition of IND-CCA, the adversary $\mathcal{A}$ can access the decryption oracle $\mathcal{D}$. The deep reason of this setting is to ...
- 138k
0
votes
1
answer
112
views
Do attackers need to know what ciphers are being used when conducting ciphertext-only, known plaintext, chosen plaintext, and chosen ciphertext attack
I am trying to understand the basic ingredients needed to conduct various types of cryptanalytical attacks.
For instance, I understand that for Ciphertext-Only Attacks (COA) an attacker only has ...
- 145k
4
votes
1
answer
655
views
Indistinguishability of symmetric encryption under CCA
I am learning about symmetric encryption and its security properties. One of the security notion is security against chosen cipher-text attacks (CCA), particularly IND-CCA notion.
Under this notion, ...
- 12k
0
votes
1
answer
554
views
Rabin Cryptosystem: Chosen-Ciphertext Attack
I read in literature that Rabin Cryptosystem can be broken using chosen-ciphertext attack. It is described that after chosen ciphertext is decrypted attacker can factorize public key $n$ by using ...
- 145k
4
votes
1
answer
2k
views
Encrypt-and-mac IND-CCA security
I have been stuck all day trying to understand how to show that an Encrypt-and-Mac ($SE_{EaM}$) scheme is not IND-CCA secure. I have seen this similar post, however it is slightly different and the ...
- 1,082
1
vote
1
answer
335
views
Finding RSA private exponent with a chosen ciphertext attack?
Let's say there's this blackbox app that has a known modulus $N$, private exponent $e$, and takes ciphertext $C$ encrypted against $N$ and $e$ input and outputs plaintext $M$.
The encryption is done ...
CommunityBot
- 1
3
votes
0
answers
49
views
CCA security in QROM for symmetric schemes
Assume that we have a symmetric encryption scheme $\Pi_s$ that is IND-CCA secure in the standard model. Does this imply that $\Pi_s$ is IND-CCA in QROM?
- 31
2
votes
1
answer
187
views
CPA + one-time strong signature --> CCA?
Does combining a CPA PKE (public key encryption) scheme with a one-time strong signature construct a CCA PKE scheme? More specifically, let $(Enc,Dec)$ be a CPA PKE scheme, and $(V,S)$ be a one-time ...
- 12k
3
votes
1
answer
314
views
Can CPA secure scheme be converted to CCA secure?
I would like to know if there are some methods or techniques that can convert a public key encryption scheme from CPA secure to CCA secure?
- 5,133
3
votes
2
answers
231
views
Bleichenbacher attack test vectors
I was trying to understand the Bleichenbacher attack. I went through the paper of Bleichenbacher to understand it a bit more. However, I tried to get some test vectors to simulate this attack locally ...
- 3,102
1
vote
1
answer
328
views
CCA-Security Proof of a Particular Scheme
Suppose we have a scheme that works so:
$\mathcal{P}_k =:\{P_k\colon \{0,1\}^{2n} \to \{0,1\}^{2n} \}$ is a strong PRP family.
Encryption: $\operatorname{Enc}(k,m)=P_k(m\mathbin\Vert r)$, where $\Vert$...
- 3,102
3
votes
1
answer
228
views
Symmetric Key Encryption is not Authentication?
Is there any way to show CCA-secure symmetric-key encryption does not have to be an authenticated encryption?
I know you can create a set up that isn't authenticated, but how will you go about it?
- 3,102
0
votes
1
answer
149
views
When is a PQ key-exchange algorithm suitable for use with long-term static keys?
I took a look at Cloudflare Circl because I'm curious which Post-Quantum algorithms are implemented in Go, which could be used to exchange a key.
I read this comment that SIDH is only good for ...
- 12k
0
votes
1
answer
4k
views
Proving the CCA-insecurity of El Gamal encryption scheme
I am trying to prove that El Gamal Encryption is not CCA-Secure.
If an adversary queried the encryption oracle for the encryption of $m=1$, he'll get a pair $(c_1,c_2)=(g^y,g^{xy}\cdot m)=(g^y,g^{xy}\...
0
votes
0
answers
647
views
Strong pseudo random permutation implies CCA-security
Let $F$ be a strong pseudo random permutation and define a fixed-length encryption scheme $(\operatorname{Enc,Dec})$ as follows:
On input $m \in \{0,1\}^{\frac{n}{2}}$ and key $k\in \{0,1\}^{n}$, ...
- 45.7k
19
votes
5
answers
3k
views
AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?
Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense.
Context: I'm doing some crypto as a ...
- 646
2
votes
1
answer
388
views
Proofs that NM-CPA implies IND-Cpa and $\text{IND-CCA} \leftrightarrow \text{NM-CCA}$
I am looking for a proof for the following two claims from "Serious Cryptography" by Aumasson.
NM-CPA implies IND-CPA. [...] IND-CCA and NM-CCA are equivalent notions that imply the presence of the ...
- 111
1
vote
0
answers
84
views
getting key $k_{2}$ somehow definitely compromise authentication scheme and attacker can see cipher text now...so not secure
I was going through this question of nested encryption:
Given $\Pi$ = $({Gen}, {Enc}, {Dec})$ is authentication encryption we have designed new scheme $\Pi^{'}$ = $({Gen^{'}}, {Enc{'}}, {Dec{'}})$ ...
- 49