As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [chosen-ciphertext-attack]

A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.

Filter by
Sorted by
Tagged with
1 vote
1 answer
89 views

CBC not CCA secure

I always get stuck at those kind of exercises in my Cryptography class. I just don't understand how should I build these scenarios of "sending m1 and m2 and then somehow telling if it was m1 or ...
gsmoke1's user avatar
  • 11
1 vote
0 answers
72 views

Which encryption method support 256 bytes block size?

I am looking at some secret encryption method that apparently uses CBC and a block size of 256 bytes. I can do a chosen-ciphertext-attack. When I modify a single byte in the ciphertext a complete ...
Flole's user avatar
  • 11
3 votes
0 answers
39 views

Variant of CCA security for Paillier with blinded decryption oracle

Consider a variant of the Paillier encryption scheme where the message space is restricted to $\mathbb{Z}_q$ such that the RSA modulus $N$ of the Paillier cryptosystem satisfies $N > q + q^2$. I am ...
Prashant Agrawal's user avatar
1 vote
1 answer
64 views

How is Crystal Kyber CPA-secure algorithms converted into a CCA-secure algorithm

In Crystal Kyber specification, page no10, there are 3 algorithms namely KYBER.CCAKEM for making the CPA-secure Kyber into CCA-secure one. Q1: How is the shared key K being generated in KYBER.CCAKEM....
Sujan SM's user avatar
1 vote
1 answer
62 views

Is AES distinguishable if the attacker has an decryption oracle?

Let the following game be given: G^IND-CCA': Prepare a key k <- KeyGen(1^Kappa) Choose a hidden bit h <- {0, 1} uniformly random Prepare a decryption oracle O_Dec. Given a cipher text c, it ...
Towdo's user avatar
  • 11
0 votes
1 answer
52 views

Curious about CCA attack for RSA, and Kerckhoffs's principle in general

I'm a student studying cybersecurity for the first time, and the part where our textbook explains using CCA attacks for RSAs seemed really unclear for me, so I am here seeking for clarification. Our ...
Green Ideology's user avatar
1 vote
0 answers
41 views

Construction of a SKE scheme based on a PRF family and on a MAC with UF-CMA security. Is the scheme secure?

Consider the following construction of a SKE scheme $\Pi^*=(Enc^*,Dec^*)$ based on a PRF family $F=\{F_k:\{0,1\}^n\rightarrow \{0,1\}^n\}_{k\in\{0,1\}^\lambda}$ and on a MAC $ Tag:\{0,1\}^\lambda \...
Giusy's user avatar
  • 33
1 vote
0 answers
30 views

What are the possible CCA attacks on RSA with r||m+G(r) as the padding?

I was trying to come up with simple padding functions for the RSA, then trying to break them just to have a better understanding of why we need all the pieces used in the RSA OAEP... So, I am ...
Hilder Vitor Lima Pereira's user avatar
0 votes
0 answers
63 views

CCA-Attacks in the real (and digital) world

Is any concrete and real examples of CCA-attacks in recent history. I'm aware about examples of WW2, but I'm more interested to modern examples in a digital context (for example against OFB, CBC).
Ievgeni's user avatar
  • 2,543
1 vote
0 answers
112 views

Bleichenbacher 1998 "Million message attack" CCA

After implementing and playing around with famous "Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1" there couple of questions which I can't really ...
Sergey Kaunov's user avatar
0 votes
1 answer
61 views

Is the following scheme CCA secure? I purposed a scheme and I am not sure if it is CCA secure, if not, how can it be CCA secure?

Here is my idea: Under the symmetric key encryption. Alice and Bob share the symmetric key K. Let HASH be a secure hash function and ...
kevin yang's user avatar
1 vote
1 answer
89 views

Can we achieve IND-CCA without a MAC?

In modern cryptography, IND-CPA is the lowest security we want. We want at least IND-CCAx security from encryption mode. Their relation can be found in 2007 Authenticated Encryption: Relations among ...
kelalaka's user avatar
  • 46k
0 votes
0 answers
82 views

How can I show that AES-GCM is secure under the adaptive chosen cipher-text game?

How can I show that AES-GCM is secure under the adaptive chosen ciphertext game? This is assuming the GHASH Mac tag can't be forged faster than brute force?
CryptoGuru's user avatar
1 vote
0 answers
59 views

Essential requirement for IND-CCA1 and IND-CCA2

I am learning about the concept of two security notions called IND-, which include IND-CPA, IND-CCA1 and IND-CCA2. While I got some grasp understanding about the scenarios between the challenger & ...
John Pham's user avatar
0 votes
0 answers
18 views

Transforming BGN to non-malleable

Is there a way to transform the BGN encryption into non-malleable (i.e., IND-CCA2) without the use of symmetric encryption or signature? I thought that simply publishing a proof of knowledge (via non ...
Doron's user avatar
  • 79
0 votes
1 answer
93 views

Can we force a chosen ciphertext to be decrypted to a chosen plaintext while controlling only $e(=3)$ in RSA? [duplicate]

I have bumped into this challenge from a well known CTF site. I don't want to make a reference to it because I don't want this to be a hint for anyone. And also to avoid giving out the source code of ...
JAAAY's user avatar
  • 826
2 votes
1 answer
333 views

CPA secure to CCA secure encryption

Can we use a MAC to transform a CPA secure encryption scheme into CCA secure one?
user104304's user avatar
1 vote
0 answers
77 views

Trying to understand this Solution related to CCA security

4.25) Let F be a strong pseudorandom permutation, and define the following fixed-length encryption scheme: On input a message $m ∈ \{0,1\}^{n/2}$ and key $k ∈ \{0,1\}^n$, algorithm $Enc$ chooses a ...
Carlos73's user avatar
0 votes
1 answer
41 views

QR-PKE not CCA secure

Due to a comment stating "... QR-PKE is secure (CPA)..." I've been thinking of how to prove that it's not CCA secure, and would like to understand whether my proof is correct. Here's the QR-...
Anon's user avatar
  • 373
1 vote
0 answers
85 views

Clarification for CCA security (or - why is the following not a Rabin CCA attack?)

In three different, highly reputable sources (e.g. "Introduction to Modern Cryptography" by Katz and Lindell, 2007), the definition of CCA attack doesn't allow the adversary to decrypt the ...
Anon's user avatar
  • 373
0 votes
1 answer
116 views

Proving that RSA CCA is possible

I'm reading from William Stalling's Cryptography & Network Security - 7th Edition To me the first line suggests $$(M^e\bmod n)\times(2^e\bmod n)=((2M)^e\bmod n)$$ which means that if we want to ...
Essam's user avatar
  • 103
0 votes
1 answer
93 views

Do attackers need to know what ciphers are being used when conducting ciphertext-only, known plaintext, chosen plaintext, and chosen ciphertext attack

I am trying to understand the basic ingredients needed to conduct various types of cryptanalytical attacks. For instance, I understand that for Ciphertext-Only Attacks (COA) an attacker only has ...
Leviel's user avatar
  • 3
3 votes
1 answer
1k views

The essential differences between IND-CCA1 and IND-CCA2?

For some encryption scheme $(\mathcal{E}, \mathcal{D})$: In the definition of IND-CCA, the adversary $\mathcal{A}$ can access the decryption oracle $\mathcal{D}$. The deep reason of this setting is to ...
Max1z's user avatar
  • 125
1 vote
1 answer
202 views

Analysis of the Vigenere cipher

Im just starting out learning some cryptoanalysis techniques. I came across an idea which analyzes the vigenere cipher. Essentially the video explains that there is a standard english probability ...
ThreadBucks's user avatar
4 votes
1 answer
557 views

Indistinguishability of symmetric encryption under CCA

I am learning about symmetric encryption and its security properties. One of the security notion is security against chosen cipher-text attacks (CCA), particularly IND-CCA notion. Under this notion, ...
driewguy's user avatar
1 vote
2 answers
275 views

How can we measure the security levels of post-quantum cryptographic algorithms? Is there a standard way of this measurement?

How do we measure the security levels of Post Quantum Cryptographic algorithms such as: NTRU Prime, Saber, Kyber,...that are submited to NIST PQC Standardization Process(Competition) in general? I ...
esra's user avatar
  • 879
0 votes
1 answer
444 views

Rabin Cryptosystem: Chosen-Ciphertext Attack

I read in literature that Rabin Cryptosystem can be broken using chosen-ciphertext attack. It is described that after chosen ciphertext is decrypted attacker can factorize public key $n$ by using ...
test_user's user avatar
3 votes
0 answers
44 views

CCA security in QROM for symmetric schemes

Assume that we have a symmetric encryption scheme $\Pi_s$ that is IND-CCA secure in the standard model. Does this imply that $\Pi_s$ is IND-CCA in QROM?
FermaX's user avatar
  • 31
2 votes
1 answer
157 views

CPA + one-time strong signature --> CCA?

Does combining a CPA PKE (public key encryption) scheme with a one-time strong signature construct a CCA PKE scheme? More specifically, let $(Enc,Dec)$ be a CPA PKE scheme, and $(V,S)$ be a one-time ...
Huanhuan Chen's user avatar
3 votes
1 answer
269 views

Can CPA secure scheme be converted to CCA secure?

I would like to know if there are some methods or techniques that can convert a public key encryption scheme from CPA secure to CCA secure?
Naz's user avatar
  • 85
0 votes
1 answer
130 views

When is a PQ key-exchange algorithm suitable for use with long-term static keys?

I took a look at Cloudflare Circl because I'm curious which Post-Quantum algorithms are implemented in Go, which could be used to exchange a key. I read this comment that SIDH is only good for ...
hdev's user avatar
  • 151
18 votes
5 answers
3k views

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense. Context: I'm doing some crypto as a ...
ShellCode's user avatar
  • 283
1 vote
0 answers
84 views

getting key $k_{2}$ somehow definitely compromise authentication scheme and attacker can see cipher text now...so not secure

I was going through this question of nested encryption: Given $\Pi$ = $({Gen}, {Enc}, {Dec})$ is authentication encryption we have designed new scheme $\Pi^{'}$ = $({Gen^{'}}, {Enc{'}}, {Dec{'}})$ ...
Sam's user avatar
  • 49
0 votes
0 answers
53 views

Not getting idea how to formally chose chosen cipher attack so adversay wins with non-negligible probability

I was going through this question and intuition came that same message can be used to break security but I an not able formalize it well...can someone help how to create chosen ciphertext attack ...
Sam's user avatar
  • 49
0 votes
1 answer
519 views

IND-CCA insecurity of modified CBC encrypt + MAC scheme

I've been puzzling over the following proof for the past couple of days. Since a block cipher in CBC mode can be used to build both an IND-CPA secure encryption scheme and a EUF-CMA secure block, a ...
Quinn Norton's user avatar
1 vote
1 answer
109 views

Question on the disprove of CCA security

I have a question on the disprove of the CCA-security given in Katz & Lindell's textbook (2nd edition) in chapter 3.7 on page 97. It works like this: Consider our construction based on PRFs: $\...
Titanlord's user avatar
  • 2,020
1 vote
0 answers
284 views

IND-CCA game proof of Encrypt-then-Mac

In [BN07, Subsection 4.3], the authors show that if a symmetric scheme $\mathcal{SE}$ is IND-CPA and a MAC $\mathcal{MA}$ is EUF-CMA (though they use the SUF-CMA notation, but I think it refers to the ...
Tristan Nemoz's user avatar
0 votes
0 answers
131 views

Guarding against vulnerabilities for a digital signature service (RSA )

Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload. What are the possible attacks that I would need to guard against in this context (primarily assuming ...
Ravindra HV's user avatar
0 votes
0 answers
183 views

Question about IND-CCA security

We are given the following securitygame $G^{\text{LOSTNAME}}$: Generate $k \leftarrow \{0,1\}^{\kappa}$ uniformly at random Choose $h \leftarrow \{0,1\}$ uniformly random Create decryption oracle $\...
Chessn00b's user avatar
1 vote
1 answer
400 views

Security of Paillier against chosen ciphertext attack

Is there a proof by now that Paillier is secure against chosen-ciphertext attack? The original Paillier paper mentions that it is not.
Mimi's user avatar
  • 41
5 votes
1 answer
245 views

Is there a relation between passive/active attacks and IND-CPA/IND-CCA?

I've seen some papers drawing a connection between IND-CPA and passive attacks and IND-CCA and active attacks. Can someone explain how IND-CPA relates to passive attacks and IND-CCA relates to active ...
savx2's user avatar
  • 431
2 votes
1 answer
328 views

Can a CCA-secure cryptosystem be used as a CMA-secure MAC?

Can every CCA-secure cryptosystem be used as a CMA-secure MAC? I know that every CCA-secure system is CPA-secure, but I'm not sure about CMA. From what I understand: for a system to be CCA-secure, it ...
Alex's user avatar
  • 321
0 votes
1 answer
393 views

CCA secure vs AE scheme

We already know that every authenticated encryption scheme is CCA secure, I was wondering about the converse. I believe it is not true, and I am finding trouble to construct a scheme which is only CCA ...
user464732838's user avatar
3 votes
1 answer
692 views

IND-CCA secure symmetric encryption

Although this question maybe looks silly, I have searched similar questions in this forum and googled it but got no desired answers. IND-CCA security has already been deeply studied in public ...
M.Z.'s user avatar
  • 145
2 votes
0 answers
79 views

Secure CCA Encryption under Partial Key Exposure

I'm currently learning about chosen ciphertext attack and stumbled across a problem on CCA security. If I have an encryption scheme $(Gen,Enc,Dec)$, which is CCA-secure with $Enc:\{0,1\}^n\times \{0,1\...
Kim's user avatar
  • 21
0 votes
1 answer
162 views

Chosen Cipher Text Security for Double Encryption

If $E_k$ is a CCA secure encryption scheme then why is $E′_{(k_1,k_2)}(M)=E_{k_2}(E_{k_1}(M))$, $D′_{(k_1,k_2)}(C)=D_{k_1}(D_{k_2}(C))$ not CCA secure when $k_2$ is known. Is there a way I can make a ...
Alex's user avatar
  • 321
2 votes
1 answer
1k views

Which attacker model is weaker? IND-CPA or OW-CCA?

I know that IND-CPA is a security goal, which is defined as the inability of an attacker to distinguish two ciphertext of some arbitrary chosen plaintexts. Unfortunately i havent found a good ...
Fluctuation23's user avatar
1 vote
1 answer
459 views

How the message is decrypted in an RSA chosen ciphertext attack when it's a modulo?

During the last stage of decryption of a chosen ciphertext attack we are left off with this equation $$c = m \cdot t \pmod n$$ Removing all exponents like $d$ and $e$ where $c$ is the decrypted ...
KMG's user avatar
  • 403
1 vote
0 answers
100 views

CCA Security/Decryption of PRF scheme

Let $F : \{0,1\}^n \times \{0,1\}^n \rightarrow \{0,1\}^n $ be a PRF. And let the encryption function be $Enc{_k}(m) = r\mathbin\| (F{_k}(m\bigoplus r)$ , r being a random value. Im trying to proof ...
David's user avatar
  • 11
0 votes
0 answers
89 views

RNG to hide some bits

Suppose I have a sequence of bits of length M. I need to hide N out of M bits (hiding means forcing them to be 0) using RNG with a key. How I can relate the output of RNG to the number and positions ...
Riva11's user avatar
  • 35

1
2 3 4 5