Recently Active 'chosen-ciphertext-attack' Questions

1

vote

1answer

60 views

Finding RSA private exponent with a chosen ciphertext attack?

Let's say there's this blackbox app that has a known modulus $N$, private exponent $e$, and takes ciphertext $C$ encrypted against $N$ and $e$ input and outputs plaintext $M$. The encryption is done ...

rsa chosen-ciphertext-attack

modified 21 hours ago

Community♦

1

0

votes

1answer

98 views

Is Cramer-Shoup Lite IND-CCA secure?

Recently, I studied about Cramer-Shoup encryption scheme. Then, I read a book which mentioned a simpler version of this scheme, the Cramer-Shoup Lite encryption scheme. I was wondering if there is ...

chosen-ciphertext-attack cramer-shoup

modified Oct 1 at 8:03

Community♦

1

3

votes

1answer

730 views

Indistinguishability versus semantic security?

I found some foundations of crypto course notes that mention that these two are equivalent statements of their own degrees of security and was given the following definitions: I was always under the ...

public-key complexity chosen-ciphertext-attack semantic-security

modified Sep 29 at 8:09

William Martens

1376 bronze badges

1

vote

1answer

129 views

How the message is decrypted in an RSA chosen ciphertext attack when it's a modulo?

During the last stage of decryption of a chosen ciphertext attack we are left off with this equation $$c = m \cdot t \pmod n$$ Removing all exponents like $d$ and $e$ where $c$ is the decrypted ...

rsa modular-arithmetic chosen-ciphertext-attack decryption

modified Aug 24 at 23:45

fgrieu♦

106k9 gold badges222 silver badges449 bronze badges

6

votes

0answers

236 views

IND-CCA1 RSA padding?

I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property. I'm restricted to RSA (any padding; for hardware ...

rsa padding chosen-plaintext-attack chosen-ciphertext-attack blinding

modified Jul 19 at 18:49

R1w

1,5022 gold badges13 silver badges36 bronze badges

1

vote

0answers

50 views

CCA Security/Decryption of PRF scheme

Let $F : \{0,1\}^n \times \{0,1\}^n \rightarrow \{0,1\}^n $ be a PRF. And let the encryption function be $Enc{_k}(m) = r\mathbin\| (F{_k}(m\bigoplus r)$ , r being a random value. Im trying to proof ...

chosen-ciphertext-attack decryption

modified Jul 11 at 21:41

kelalaka

23.5k6 gold badges58 silver badges103 bronze badges

0

votes

0answers

81 views

RNG to hide some bits

Suppose I have a sequence of bits of length M. I need to hide N out of M bits (hiding means forcing them to be 0) using RNG with a key. How I can relate the output of RNG to the number and positions ...

encryption keys random-number-generator known-plaintext-attack chosen-ciphertext-attack

modified Jun 25 at 9:47

Maarten Bodewes♦

74.2k11 gold badges113 silver badges251 bronze badges

6

votes

2answers

333 views

Why does Encrypt-Then-Sign not yield a CCA-secure public-key encryption scheme?

In symmetric cryptography, combining an IND-CPA secure symmetric encryption scheme with a secure MAC with the encrypt-then-MAC method yields a IND-CCA secure symmetric encryption scheme. I am trying ...

encryption public-key signature chosen-ciphertext-attack

answered Jun 19 at 15:15

thesquaregroot

8277 silver badges17 bronze badges

0

votes

1answer

76 views

How to prove that RSA is not IND-CCA2?

RSA is homomorphic wrt multiplication and therefore it is not IND-CCA2. But how to show it. What are the steps to win IND-CCA2 game? How is the probability of winning calculated?

rsa chosen-ciphertext-attack

answered May 23 at 10:27

cisnjxqu

2361 silver badge7 bronze badges

1

vote

1answer

47 views

Knowledge of discrete log is needed in the proof of Cramer-Shoup public key scheme?

In the proof of the Cramer-Shoup public key scheme [1], I understand that the adversary's view can be seen as equations such as $\log c = x_1 + w x_2, \log d = y_1 + w y_2$ and so on (equation 1 and 2 ...

public-key discrete-logarithm chosen-ciphertext-attack cramer-shoup

modified May 22 at 6:05

Community♦

1

3

votes

0answers

38 views

Markov ciphers - generalized group operation

I’m reading this paper of Lai and Massey where they give a very nice perspective on differential attacks in general http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass-inspec-1991-3.pdf They do their ...

block-cipher chosen-ciphertext-attack differential-analysis

asked May 9 at 6:12

zz7948

1758 bronze badges

1

vote

1answer

91 views

How can I show RSA-OAEP is not IND-CCA secure if G always outputs 0 (i.e. there is no hash function)?

Here is what I understand the algorithm to be: Let $G, H$ be one-way functions, where G outputs the 0 string. 𝐸𝑛𝑐𝑜𝑑𝑒 Select a random $𝑘$-bit integer $𝑟$. Pad out $𝑚$ with $0$s to length $𝑙...

rsa chosen-ciphertext-attack

modified Apr 7 at 11:02

fgrieu♦

106k9 gold badges222 silver badges449 bronze badges

1

vote

0answers

45 views

Proofs that NM-CPA implies IND-Cpa and $\text{IND-CCA} \leftrightarrow \text{NM-CCA}$

I am looking for a proof for the following two claims from "Serious Cryptography" by Aumasson. NM-CPA implies IND-CPA. [...] IND-CCA and NM-CCA are equivalent notions that imply the presence of the ...

provable-security chosen-plaintext-attack chosen-ciphertext-attack semantic-security malleability

modified Apr 4 at 3:23

DannyNiu

3,7781 gold badge13 silver badges37 bronze badges

3

votes

2answers

112 views

Bleichenbacher-attack test vectors

I was trying to understand the Bleichenbacher-attack. I went through the paper of Bleichenbacher to understand it bit more. However I tried to get some test vectors to simulate this attack locally but ...

chosen-ciphertext-attack pkcs1

modified Mar 19 at 23:51

Maarten Bodewes♦

74.2k11 gold badges113 silver badges251 bronze badges

1

vote

1answer

57 views

Why does this attack on a simplified version of the Naor-Yung scheme not work for the original scheme?

tl;dr: We were given a homework, in which we should discuss, whether encrypting twice in the Naor-Yung scheme is actually necessary. I could prove that it is, by constructing an attacker on a scheme ...

chosen-ciphertext-attack

modified Nov 27 '19 at 20:36

Mikero

7,3861 gold badge22 silver badges31 bronze badges

0

votes

0answers

169 views

Strong pseudo random permutation implies CCA-security

Let $F$ be a strong pseudo random permutation and define a fixed-length encryption scheme $(\operatorname{Enc,Dec})$ as follows: On input $m \in \{0,1\}^{\frac{n}{2}}$ and key $k\in \{0,1\}^{n}$, ...

pseudo-random-permutation chosen-ciphertext-attack

modified Oct 27 '19 at 13:10

SEJPM♦

40.4k6 gold badges76 silver badges167 bronze badges

3

votes

2answers

339 views

Security of CFB on a public channel

Given a server that broadcasts all received data to all connected peers (except the sender), two participants can have an encrypted conversation using a self-synchronizing method like CFB and some ...

encryption chosen-ciphertext-attack transport-security cfb

modified Oct 3 '19 at 16:45

Patriot

1,9222 gold badges9 silver badges36 bronze badges

1

vote

1answer

568 views

How to prove an encryption scheme is not CCA secure

Given the following context below, how does one show or prove the encryption scheme is NOT IND-CCA secure The IND-CPA secure private-key encryption scheme for n-bit messages can be constructed from a ...

chosen-plaintext-attack chosen-ciphertext-attack

modified Sep 17 '19 at 10:00

Community♦

1

2

votes

1answer

517 views

AES-GCM secure against IND-CCA2

How would you prove that AES-GCM is secure against a chosen ciphertext attack (IND-CCA2), assuming that the attacker cannot forge AES-GCM MAC tags in less than brute force?

chosen-ciphertext-attack aes-gcm

modified Sep 13 '19 at 23:36

Patriot

1,9222 gold badges9 silver badges36 bronze badges

46

votes

1answer

20k views

Easy explanation of “IND-” security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...

provable-security chosen-plaintext-attack terminology chosen-ciphertext-attack semantic-security

modified Sep 12 '19 at 21:13

kelalaka

23.5k6 gold badges58 silver badges103 bronze badges

2

votes

1answer

202 views

How many required known plaintexts for an attack are considered insecure?

I stumbled over this problem when looking at symmetrical block ciphers with a relatively small block size like 32 bit. When I was looking at more common block ciphers with a 64 bit, I learned that ...

block-cipher known-plaintext-attack chosen-ciphertext-attack blocksize

modified Aug 25 '19 at 7:38

forest

10.6k1 gold badge32 silver badges66 bronze badges

0

votes

1answer

126 views

CCA security of this scheme

Let $k$ be uniformly sampled from $\{0,1\}^\lambda$, $F$ be a secure PRP with block length $\lambda$ and let $Enc(k, m)$ be such that it returns $c = (F(k,r), r \oplus F(k,m))$ with $r$ uniformly ...

chosen-ciphertext-attack distinguisher

modified Aug 21 '19 at 11:15

Bruce Wayne

1114 bronze badges

0

votes

1answer

569 views

Proving the CCA-insecurity of El Gamal encryption scheme

I am trying to prove that El Gamal Encryption is not CCA-Secure. If an adversary queried the encryption oracle for the encryption of $m=1$, he'll get a pair $(c_1,c_2)=(g^y,g^{xy}\cdot m)=(g^y,g^{xy}\...

elgamal-encryption chosen-ciphertext-attack

modified Aug 16 '19 at 21:11

SY_R

34 bronze badges

3

votes

2answers

298 views

Attack on security model for RSA-FDH

I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is ...

rsa signature chosen-plaintext-attack chosen-ciphertext-attack rsa-pss

answered Aug 16 '19 at 11:55

Josiah

8895 silver badges8 bronze badges

1

vote

1answer

195 views

Is Hybrid Encryption CCA secure?

If Enc is a PKE(Public Key Encryption) with key generation algorithm KG and message space $M = \{0, 1\}^n$, and SE is a Symmetric Key Encryption(SKE) with key space $\{0, 1\}^n$ and message space $M' =...

chosen-ciphertext-attack hybrid-encryption

answered Aug 11 '19 at 16:12

Mikero

7,3861 gold badge22 silver badges31 bronze badges

0

votes

1answer

418 views

Hash ElGamal CCA approach

With this Elgamal variant defined below, we have covered in lecture but I do not still understand how a CCA could work against it. Is the use of the homomorphic nature of the encryption something you ...

hash elgamal-encryption chosen-ciphertext-attack

modified Aug 11 '19 at 15:53

Patriot

1,9222 gold badges9 silver badges36 bronze badges

9

votes

1answer

1k views

AES-CTR mode and the Biclique Attack

The biclique attacks that break AES (Biclique Cryptanalysis of the full AES) appear to require decryption oracles to work, presumably because the key schedule of AES is weaker in the decryption ...

cryptanalysis modes-of-operation chosen-plaintext-attack chosen-ciphertext-attack

modified Aug 9 '19 at 17:11

Patriot

1,9222 gold badges9 silver badges36 bronze badges

6

votes

1answer

325 views

Differences between NewHope-CPA-KEM and NewHope-CCA-KEM

According to the web page for NewHope, an R-LWE post-quantum key encapsulation mechanism (KEM) candidate for standardization, it comes in types that are IND-CPA or IND-CCA secure. I know what CPA and ...

post-quantum-cryptography chosen-plaintext-attack chosen-ciphertext-attack kem newhope

modified Jul 15 '19 at 9:29

forest

10.6k1 gold badge32 silver badges66 bronze badges

2

votes

0answers

85 views

Intuition for Cramer Shoup Encryption Scheme?

I was reading the Cramer Shoup CCA2 secure encryption scheme. The scheme is as follows. Public key = $(g_1, g_2, c, d, h, hk)$, where $c = g_1^{x_1}g_2^{y_1}$, $d = g_1^{x_2}g_2^{y_2}$, $h = g_1^z$, ...

encryption elgamal-encryption chosen-ciphertext-attack cramer-shoup

modified Jun 15 '19 at 19:33

satya

1,1225 silver badges20 bronze badges

1

vote

2answers

284 views

Efficient attack on RSA with known padding scheme and public key

I am having some trouble with an assignment problem. I hope I can get some guidance here. The question provides us with a public key, $N$ and the padding scheme. This is the padding scheme "Assume ...

encryption rsa chosen-ciphertext-attack

answered Jun 1 '19 at 9:52

Henno Brandsma

3,64413 silver badges18 bronze badges

1

vote

1answer

595 views

Unforgeable CPA-secure private-key encryption scheme that is not CCA-secure

This is exercise with 4.26 in Katz and Lindell's introduction to cryptography 2nd ed. The question is: Show a CPA-secure private-key encryption scheme that is unforgeable but is not CCA-secure. ...

symmetric authenticated-encryption chosen-plaintext-attack chosen-ciphertext-attack

modified May 15 '19 at 13:56

Myath

5983 silver badges15 bronze badges

4

votes

3answers

10k views

Chosen plaintext vs Chosen ciphertext

What is the difference between chosen plaintext and chosen ciphertext attack? In both of these adversary has access to paintext-ciphertext pairs.Then where lies the difference?

chosen-plaintext-attack chosen-ciphertext-attack

answered Apr 24 '19 at 15:20

Ahmadreza Sezavar

1

0

votes

0answers

125 views

Formal security-definition reference

Is there a reference where all common formal security-definitions are summarized (such as OW-CPA, IND-CPA, IND-CCA1, IND-CCA2, EUF-CMA and so on)? I need a PUBLISHED reference (paper, book) which ...

reference-request chosen-plaintext-attack security-definition chosen-ciphertext-attack

modified Apr 8 '19 at 8:44

Lying Dancer

233 bronze badges

3

votes

1answer

862 views

Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?

I presented our mathematician with an idea: If you have a black box that encrypts or decrypts AES with the same 128 bit key (you don't have any direct access to the key), and you control the input ...

aes chosen-plaintext-attack chosen-ciphertext-attack key-recovery

modified Apr 6 '19 at 16:04

kelalaka

23.5k6 gold badges58 silver badges103 bronze badges

1

vote

0answers

436 views

Cryptanalysis affine cipher and substitution cipher

1) Consider the chosen-plaintext attack on the simple substitution cipher. How many chosen plaintext characters suffice to uniquely determine the key? My answer was: 26! 2) Consider the chosen-...

cryptanalysis chosen-plaintext-attack chosen-ciphertext-attack substitution-cipher affine-cipher

modified Mar 19 '19 at 1:15

Maarten Bodewes♦

74.2k11 gold badges113 silver badges251 bronze badges

4

votes

1answer

1k views

Security proof of FO(Fujisaki-Okamoto) hybrid encryption

The proof of FO hybrid encryption is hard to understand. $\:$ Especially, how does the challenger respond to the decryption queries when the challenger can only have some encryption queries?

provable-security chosen-ciphertext-attack

modified Mar 17 '19 at 7:41

Jiangtao LI

1598 bronze badges

1

vote

0answers

115 views

Patarin’s H-Coefficient Technique

I have come across many paper that applies Patarin’s H-Coefficient Technique in various cryptographic securities (KPA, CPA, CCA,...). I am asking kindly if someone could explain it simple with ...

pseudo-random-function chosen-plaintext-attack chosen-ciphertext-attack

modified Mar 13 '19 at 14:25

AleksanderRas

5,8553 gold badges16 silver badges49 bronze badges

1

vote

1answer

132 views

Is chosen ciphertext attack used to obtain a key? [duplicate]

I don't understand what the goals are of a Chosen Ciphertext Attack. What I've read from Wikipedia is that it is an attack one can use to obtain the key that the crypto algorithm uses. However, I ...

attack chosen-ciphertext-attack

modified Mar 7 '19 at 16:04

fgrieu♦

106k9 gold badges222 silver badges449 bronze badges

2

votes

1answer

93 views

If DDH is hard then CCA-secure PKES exist?

My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following: If decisional Diffie-Hellman problem is hard then there ...

diffie-hellman complexity chosen-ciphertext-attack

modified Feb 26 '19 at 10:18

Maeher

5,5121 gold badge27 silver badges39 bronze badges

2

votes

1answer

72 views

If TDP exist then CCA-secure PKES exist?

My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following: If trapdoor permutations exist then CCA-secure public key ...

rsa chosen-ciphertext-attack trapdoor

answered Feb 26 '19 at 9:01

Maeher

5,5121 gold badge27 silver badges39 bronze badges

4

votes

1answer

3k views

RSA Blind Signature Attack

In Information Security Class I learned a non-adaptive chosen ciphertext attack using "blinding" but I just can't follow the proof and therefore can't reconstruct it. From what I've found out, it ...

rsa chosen-ciphertext-attack blind-signature

modified Feb 17 '19 at 18:11

Nasim Al Goni

1

vote

0answers

170 views

CCA attack on RSA padded with random oracle

I'm trying to do the ex 11.15 of the Katz-Lindell book. Consider the RSA-based encryption scheme in which a user encrypts a message $m ∈ $ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by ...

rsa padding chosen-ciphertext-attack

asked Jan 16 '19 at 1:36

Processss

111 bronze badge

4

votes

1answer

288 views

Does Elliptic Curve Integrated Encryption Scheme (ECIES) provide IND-CCA2 security?

I am looking for a faster alternative to RSA with OAEP as a IND-CCA2 public key scheme. Elliptic Curve Integrated Encryption Scheme might be a candidate, but I am not sure if it provides IND-CCA2 ...

public-key elliptic-curves chosen-ciphertext-attack

modified Jan 4 '19 at 13:33

Maarten Bodewes♦

74.2k11 gold badges113 silver badges251 bronze badges

3

votes

1answer

179 views

Symetric key encryption is not Authentication?

Is there any way to show CCA-secure symmetric-key encryption does not have to be an authenticated encryption? I know you can create a setup that isn't authentication, but how will you go about it?

authenticated-encryption chosen-ciphertext-attack

answered Dec 17 '18 at 8:55

mephisto

2,66216 silver badges28 bronze badges

21

votes

2answers

19k views

How does a padding oracle attack work?

I am unsure of how a padding oracle attack works. What I am not getting is how changing one bit at one time allows one to exploit(get keys) ASP.NET machines. Can anyone explain this?

cryptanalysis chosen-ciphertext-attack padding-oracle

modified Dec 3 '18 at 8:17

comepradz

776 bronze badges

8

votes

1answer

503 views

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks? I have been reading about homomorphic encryption and ...

homomorphic-encryption provable-security chosen-ciphertext-attack malleability

modified Nov 26 '18 at 22:19

Mikero

7,3861 gold badge22 silver badges31 bronze badges

1

vote

1answer

422 views

CPA-secure of $\Pi$ implies CPA-security of $\Pi||\Pi||\ldots||\Pi$

Katz and Lindell book claim that from the theorem: Any private-key encryption scheme that is CPA-secure is also CPA-secure for multiple encryptions. Follows the fact that: If $(Gen,...

chosen-plaintext-attack chosen-ciphertext-attack

answered Nov 19 '18 at 6:08

Yehuda Lindell

22.8k1 gold badge49 silver badges70 bronze badges

5

votes

1answer

584 views

Secure ElGamal with OAEP

Is it possible to make ElGamal IND-CCA2 using OAEP or OAEP+? (OAEP+ from: "OAEP Reconsiderd" by Shoup) The reason I ask is that I recently answered this question and it came to my mind that OAEP or ...

elgamal-encryption chosen-ciphertext-attack oaep

modified Oct 29 '18 at 13:13

SEJPM♦

40.4k6 gold badges76 silver badges167 bronze badges

2

votes

1answer

136 views

GCM decryption and clear text processing

When using GCM mode decryption, is it necessary to wait for the decryption to complete, (and thus being able to see if the integrity of cipher text is OK) before beginning processing the clear text ...

gcm chosen-ciphertext-attack

modified Oct 5 '18 at 13:07

Maarten Bodewes♦

74.2k11 gold badges113 silver badges251 bronze badges

4

votes

0answers

242 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key Encapsulation Mechanism / Data Encapsulation Mechanism) which is used for example by the (famous) ECIES, where the key is the hash ...

algorithm-design chosen-plaintext-attack chosen-ciphertext-attack

modified Oct 3 '18 at 19:16

Ella Rose

18.6k5 gold badges47 silver badges92 bronze badges

Questions tagged [chosen-ciphertext-attack]

Related Tags