Questions tagged [chosen-ciphertext-attack]
A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.
169
questions
0
votes
0answers
27 views
Guarding against vulnerabilities for a digital signature service (RSA )
Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload.
What are the possible attacks that I would need to guard against in this context (primarily assuming ...
0
votes
0answers
24 views
Extended message space public key scheme
Being $\mathcal{E}$ a public key schem,let the following encryption scheme $\mathcal{E}^2=(G^2,E^2,D^2)$, where
\begin{equation*}
\begin{split}
G^2()&:=(pk_{0},sk_{0}) \xleftarrow{R}, (pk_{...
8
votes
2answers
572 views
What do NM-CPA and NM-CCA mean?
When I've been researching authenticated encryption, the following terms keep showing up:
NM-CPA
NM-CCA
....without any definition as to what they mean. I've tried searching the web for their ...
1
vote
1answer
98 views
Finding RSA private exponent with a chosen ciphertext attack?
Let's say there's this blackbox app that has a known modulus $N$, private exponent $e$, and takes ciphertext $C$ encrypted against $N$ and $e$ input and outputs plaintext $M$.
The encryption is done ...
0
votes
0answers
32 views
Question about IND-CCA security
We are given the following securitygame $G^{\text{LOSTNAME}}$:
Generate $k \leftarrow \{0,1\}^{\kappa}$ uniformly at random
Choose $h \leftarrow \{0,1\}$ uniformly random
Create decryption oracle $\...
4
votes
1answer
316 views
Does Elliptic Curve Integrated Encryption Scheme (ECIES) provide IND-CCA2 security?
I am looking for a faster alternative to RSA with OAEP as a IND-CCA2 public key scheme. Elliptic Curve Integrated Encryption Scheme might be a candidate, but I am not sure if it provides IND-CCA2 ...
0
votes
1answer
165 views
Is Cramer-Shoup Lite IND-CCA secure?
Recently, I studied about Cramer-Shoup encryption scheme. Then, I read a book which mentioned a simpler version of this scheme, the Cramer-Shoup Lite encryption scheme.
I was wondering if there is ...
0
votes
1answer
86 views
Trapdoors for Lattices: CCA-secure encryption
In Trapdoors for Lattices:Simpler, Tighter, Faster, Smaller, Micciancio and Peikert proposed a CCA-secure encryption.
However, I am confused about the step in decryption algorithm (p.36 Lemma 6.2.).
...
2
votes
1answer
762 views
Semantic Security Active or Passive attacks?
I'm reading A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack and here define Semantic Security ...
Semantic security, dened by Goldwasser and Micali [14]...
1
vote
1answer
60 views
Security of Paillier against chosen ciphertext attack
Is there a proof by now that Paillier is secure against chosen-ciphertext attack? The original Paillier paper mentions that it is not.
5
votes
1answer
90 views
Is there a relation between passive/active attacks and IND-CPA/IND-CCA?
I've seen some papers drawing a connection between IND-CPA and passive attacks and IND-CCA and active attacks. Can someone explain how IND-CPA relates to passive attacks and IND-CCA relates to active ...
0
votes
1answer
71 views
CCA secure vs AE scheme
We already know that every authenticated encryption scheme is CCA secure, I was wondering about the converse.
I believe it is not true, and I am finding trouble to construct a scheme which is only CCA ...
3
votes
1answer
79 views
Can a CCA-secure cryptosystem be used as a CMA-secure MAC?
Can every CCA-secure cryptosystem be used as a CMA-secure MAC?
I know that every CCA-secure system is CPA-secure, but I'm not sure about CMA. From what I understand: for a system to be CCA-secure, it ...
3
votes
1answer
105 views
IND-CCA secure symmetric encryption
Although this question maybe looks silly, I have searched similar questions in this forum and googled it but got no desired answers.
IND-CCA security has already been deeply studied in public ...
13
votes
1answer
4k views
Why do we encrypt-then mac but sign-then-encrypt?
This question was asked in comments on my answer to should we sign then encrypt or encrypt then sign. I think posing the question as a separate entity is best, so:
The general advice for applying ...
2
votes
0answers
36 views
Secure CCA Encryption under Partial Key Exposure
I'm currently learning about chosen ciphertext attack and stumbled across a problem on CCA security. If I have an encryption scheme $(Gen,Enc,Dec)$, which is CCA-secure with $Enc:\{0,1\}^n\times \{0,1\...
0
votes
1answer
75 views
Chosen Cipher Text Security for Double Encryption
If $E_k$ is a CCA secure encryption scheme then why is $Eā²_{(k_1,k_2)}(M)=E_{k_2}(E_{k_1}(M))$, $Dā²_{(k_1,k_2)}(C)=D_{k_1}(D_{k_2}(C))$ not CCA secure when $k_2$ is known. Is there a way I can make a ...
0
votes
0answers
46 views
ElGamal with massage hashed ind-cca secure?
It is well known that text book ElGamal is not IND-CCA secure, because an attacker can just have $$(Y,W)\leftarrow E_{x}(LR(M1,M2,b))$$ where M1, and M2 can be any message in the group, and than just ...
2
votes
1answer
98 views
Which attacker model is weaker? IND-CPA or OW-CCA?
I know that IND-CPA is a security goal, which is defined as the inability of an attacker to distinguish two ciphertext of some arbitrary chosen plaintexts.
Unfortunately i havent found a good ...
3
votes
1answer
815 views
Indistinguishability versus semantic security?
I found some foundations of crypto course notes that mention that these two are equivalent statements of their own degrees of security and was given the following definitions:
I was always under the ...
1
vote
1answer
140 views
How the message is decrypted in an RSA chosen ciphertext attack when it's a modulo?
During the last stage of decryption of a chosen ciphertext attack we are left off with this equation
$$c = m \cdot t \pmod n$$
Removing all exponents like $d$ and $e$ where $c$ is the decrypted ...
6
votes
0answers
249 views
IND-CCA1 RSA padding?
I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property.
I'm restricted to RSA (any padding; for hardware ...
1
vote
0answers
56 views
CCA Security/Decryption of PRF scheme
Let $F : \{0,1\}^n \times \{0,1\}^n \rightarrow \{0,1\}^n $ be a PRF. And let the encryption function be $Enc{_k}(m) = r\mathbin\| (F{_k}(m\bigoplus r)$ , r being a random value.
Im trying to proof ...
0
votes
0answers
82 views
RNG to hide some bits
Suppose I have a sequence of bits of length M. I need to hide N out of M bits (hiding means forcing them to be 0) using RNG with a key. How I can relate the output of RNG to the number and positions ...
6
votes
2answers
414 views
Why does Encrypt-Then-Sign not yield a CCA-secure public-key encryption scheme?
In symmetric cryptography, combining an IND-CPA secure symmetric encryption scheme with a secure MAC with the encrypt-then-MAC method yields a IND-CCA secure symmetric encryption scheme.
I am trying ...
0
votes
1answer
161 views
How to prove that RSA is not IND-CCA2?
RSA is homomorphic wrt multiplication and therefore it is not IND-CCA2. But how to show it.
What are the steps to win IND-CCA2 game?
How is the probability of winning calculated?
1
vote
1answer
57 views
Knowledge of discrete log is needed in the proof of Cramer-Shoup public key scheme?
In the proof of the Cramer-Shoup public key scheme [1], I understand that the adversary's view can be seen as equations such as $\log c = x_1 + w x_2, \log d = y_1 + w y_2$ and so on (equation 1 and 2 ...
3
votes
0answers
38 views
Markov ciphers - generalized group operation
Iām reading this paper of Lai and Massey where they give a very nice perspective on differential attacks in general
http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass-inspec-1991-3.pdf
They do their ...
1
vote
1answer
110 views
How can I show RSA-OAEP is not IND-CCA secure if G always outputs 0 (i.e. there is no hash function)?
Here is what I understand the algorithm to be:
Let $G, H$ be one-way functions, where G outputs the 0 string.
šøššššš
Select a random $š$-bit integer $š$.
Pad out $š$ with $0$s to length $š...
2
votes
0answers
67 views
Proofs that NM-CPA implies IND-Cpa and $\text{IND-CCA} \leftrightarrow \text{NM-CCA}$
I am looking for a proof for the following two claims from "Serious Cryptography" by Aumasson.
NM-CPA implies IND-CPA. [...] IND-CCA and NM-CCA are equivalent notions that imply the presence of the ...
3
votes
2answers
117 views
Bleichenbacher-attack test vectors
I was trying to understand the Bleichenbacher-attack. I went through the paper of Bleichenbacher to understand it bit more. However I tried to get some test vectors to simulate this attack locally but ...
1
vote
1answer
68 views
Why does this attack on a simplified version of the Naor-Yung scheme not work for the original scheme?
tl;dr: We were given a homework, in which we should discuss, whether encrypting twice in the Naor-Yung scheme is actually necessary. I could prove that it is, by constructing an attacker on a scheme ...
0
votes
0answers
225 views
Strong pseudo random permutation implies CCA-security
Let $F$ be a strong pseudo random permutation and define a fixed-length encryption scheme $(\operatorname{Enc,Dec})$ as follows:
On input $m \in \{0,1\}^{\frac{n}{2}}$ and key $k\in \{0,1\}^{n}$, ...
3
votes
2answers
355 views
Security of CFB on a public channel
Given a server that broadcasts all received data to all connected peers (except the sender), two participants can have an encrypted conversation using a self-synchronizing method like CFB and some ...
1
vote
1answer
907 views
How to prove an encryption scheme is not CCA secure
Given the following context below, how does one show or prove the encryption scheme is NOT IND-CCA secure
The IND-CPA secure private-key encryption scheme for n-bit messages can be constructed from a ...
2
votes
1answer
689 views
AES-GCM secure against IND-CCA2
How would you prove that AES-GCM is secure against a chosen ciphertext attack (IND-CCA2), assuming that the attacker cannot forge AES-GCM MAC tags in less than brute force?
47
votes
1answer
22k views
Easy explanation of “IND-” security notions?
There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security.
...
2
votes
1answer
236 views
How many required known plaintexts for an attack are considered insecure?
I stumbled over this problem when looking at symmetrical block ciphers with a relatively small block size like 32 bit.
When I was looking at more common block ciphers with a 64 bit, I learned that ...
0
votes
1answer
146 views
CCA security of this scheme
Let $k$ be uniformly sampled from $\{0,1\}^\lambda$, $F$ be a secure PRP with block length $\lambda$ and let $Enc(k, m)$ be such that it returns $c = (F(k,r), r \oplus F(k,m))$ with $r$ uniformly ...
0
votes
1answer
904 views
Proving the CCA-insecurity of El Gamal encryption scheme
I am trying to prove that El Gamal Encryption is not CCA-Secure.
If an adversary queried the encryption oracle for the encryption of $m=1$, he'll get a pair $(c_1,c_2)=(g^y,g^{xy}\cdot m)=(g^y,g^{xy}\...
3
votes
2answers
393 views
Attack on security model for RSA-FDH
I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen
Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is ...
1
vote
1answer
250 views
Is Hybrid Encryption CCA secure?
If Enc is a PKE(Public Key Encryption) with key generation algorithm KG and message space $M = \{0, 1\}^n$, and SE is a Symmetric Key Encryption(SKE) with key space $\{0, 1\}^n$ and message space $M' =...
0
votes
1answer
534 views
Hash ElGamal CCA approach
With this Elgamal variant defined below, we have covered in lecture but I do not still understand how a CCA could work against it. Is the use of the homomorphic nature of the encryption something you ...
9
votes
1answer
1k views
AES-CTR mode and the Biclique Attack
The biclique attacks that break AES (Biclique Cryptanalysis of the full AES) appear to require decryption oracles to work, presumably because the key schedule of AES is weaker in the decryption ...
6
votes
1answer
355 views
Differences between NewHope-CPA-KEM and NewHope-CCA-KEM
According to the web page for NewHope, an R-LWE post-quantum key encapsulation mechanism (KEM) candidate for standardization, it comes in types that are IND-CPA or IND-CCA secure. I know what CPA and ...
2
votes
0answers
107 views
Intuition for Cramer Shoup Encryption Scheme?
I was reading the Cramer Shoup CCA2 secure encryption scheme. The scheme is as follows.
Public key = $(g_1, g_2, c, d, h, hk)$, where $c = g_1^{x_1}g_2^{y_1}$, $d = g_1^{x_2}g_2^{y_2}$, $h = g_1^z$, ...
1
vote
2answers
430 views
Efficient attack on RSA with known padding scheme and public key
I am having some trouble with an assignment problem. I hope I can get some guidance here. The question provides us with a public key, $N$ and the padding scheme.
This is the padding scheme "Assume ...
1
vote
1answer
786 views
Unforgeable CPA-secure private-key encryption scheme that is not CCA-secure
This is exercise with 4.26 in Katz and Lindell's introduction to cryptography 2nd ed.
The question is: Show a CPA-secure private-key encryption scheme that is unforgeable but is not CCA-secure.
...
4
votes
3answers
11k views
Chosen plaintext vs Chosen ciphertext
What is the difference between chosen plaintext and chosen ciphertext attack?
In both of these adversary has access to paintext-ciphertext pairs.Then where lies the difference?
0
votes
0answers
138 views
Formal security-definition reference
Is there a reference where all common formal security-definitions are summarized (such as OW-CPA, IND-CPA, IND-CCA1, IND-CCA2, EUF-CMA and so on)? I need a PUBLISHED reference (paper, book) which ...
