# Questions tagged [chosen-ciphertext-attack]

A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.

46 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
325 views

I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property. I'm restricted to RSA (any padding; for hardware ...
537 views

155 views

### Intuition for Cramer Shoup Encryption Scheme?

I was reading the Cramer Shoup CCA2 secure encryption scheme. The scheme is as follows. Public key = $(g_1, g_2, c, d, h, hk)$, where $c = g_1^{x_1}g_2^{y_1}$, $d = g_1^{x_2}g_2^{y_2}$, $h = g_1^z$, ...
161 views

### Patarin’s H-Coefficient Technique

I have come across many paper that applies Patarin’s H-Coefficient Technique in various cryptographic securities (KPA, CPA, CCA,...). I am asking kindly if someone could explain it simple with ...
51 views

### Trading Chosen-Ciphertext-Protection for Double encryption

Straight to the point: I'm trying to implement double encryption using two cipher suites. One (#1) of them is a stream cipher without any checksum/authentication guarantee, the other (#2) is an AEAD ...
168 views

### How can I show the new crypto scheme is still IND-CCA1 in proof of “IND-CCA1 does not imply NM-CPA”?

I am trying to show IND-CCA1 does not imply NM-CPA. From what I have read the "classical" proof goes by taking an IND-CCA1 scheme $E$ and modifying it so that the encryption of the inverted ...
183 views

### AES-128: How to find cipherkey comparing wrong and right ciphertexts?

I have a .mat file which contains 10 plaintexts and 10 ciphertexts which are correctly encrypted with AES-128 algorithm. It also contains 10 more ciphertexts which are wrongly encrypted. The fault is ...
202 views

### Proof of IND-q-CCA security

I have some questions about the paper Bounded CCA2-Secure Encryption (pdf). On page eight "3.2 Construction", the authors have done a black-box construction of an IND-q-CCA security schema and then ...
263 views

### How do I prove that a bit by bit PKE scheme (that is IND-CPA secure) for an n-bit message is not IND-CCA-2 secure?

Gen generates Pk and Sk (l bits each), Enc encrypts m (length l) but by bit using each bit of Pk respectively, Dec decrypts ciphertext bit by bit using each bit of Sk respectively. How do I prove this ...
172 views

### IND-CCA2 secure schemes without Plaintext Awareness?

I have been reading up on IND-CCA2 security and was wondering: Are there efficient IND-CCA2 secure schemes that do not require plaintext awareness? I'm guessing yes - could someone point me to these ...
1 vote
91 views

### CBC not CCA secure

I always get stuck at those kind of exercises in my Cryptography class. I just don't understand how should I build these scenarios of "sending m1 and m2 and then somehow telling if it was m1 or ...
1 vote
73 views

### Which encryption method support 256 bytes block size?

I am looking at some secret encryption method that apparently uses CBC and a block size of 256 bytes. I can do a chosen-ciphertext-attack. When I modify a single byte in the ciphertext a complete ...
1 vote
41 views

89 views

### RNG to hide some bits

Suppose I have a sequence of bits of length M. I need to hide N out of M bits (hiding means forcing them to be 0) using RNG with a key. How I can relate the output of RNG to the number and positions ...
Let $F$ be a strong pseudo random permutation and define a fixed-length encryption scheme $(\operatorname{Enc,Dec})$ as follows: On input $m \in \{0,1\}^{\frac{n}{2}}$ and key $k\in \{0,1\}^{n}$, ...