Questions tagged [chosen-ciphertext-attack]
A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.
46
questions with no upvoted or accepted answers
6
votes
0
answers
325
views
IND-CCA1 RSA padding?
I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property.
I'm restricted to RSA (any padding; for hardware ...
- 45.5k
4
votes
0
answers
537
views
Why is this scheme not IND-CCA2 secure
I know that many lattice cryptosystems cannot be made $\text{IND-CCA2}$ or even $\text{IND-CCA}$ secure without substantial overhead.
However, it seems that (when used as a KEM) that any $\text{IND-...
- 4,763
4
votes
0
answers
196
views
Does length prepending fix the key reuse problems with CBC and CBC-MAC?
As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea.
Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
- 45.5k
4
votes
0
answers
287
views
IES: What security has the asymmetric primitive to provide?
I think most of us know the notion Shoup introduced of KEM/DEM (Key Encapsulation Mechanism / Data Encapsulation Mechanism) which is used for example by the (famous) ECIES, where the key is the hash ...
- 45.5k
3
votes
0
answers
39
views
Variant of CCA security for Paillier with blinded decryption oracle
Consider a variant of the Paillier encryption scheme where the message space is restricted to $\mathbb{Z}_q$ such that the RSA modulus $N$ of the Paillier cryptosystem satisfies $N > q + q^2$. I am ...
3
votes
0
answers
44
views
CCA security in QROM for symmetric schemes
Assume that we have a symmetric encryption scheme $\Pi_s$ that is IND-CCA secure in the standard model. Does this imply that $\Pi_s$ is IND-CCA in QROM?
- 31
3
votes
0
answers
47
views
Markov ciphers - generalized group operation
I’m reading this paper of Lai and Massey where they give a very nice perspective on differential attacks in general
http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass-inspec-1991-3.pdf
They do their ...
- 305
3
votes
0
answers
822
views
Proving CCA security for scheme constructed from secure PRP
We have a $PRP : \{0,1\}^{3n} \rightarrow \{0,1\}^{3n}$ and encryption scheme constructed from this $PRP$.
$E_k(x\|r\|0^n)$, where $r$ is randomly chosen from $\{0,1\}^n$ and $0^n$ is a block of ...
- 61
3
votes
0
answers
613
views
LR-Oracle Experiment in Lindell and Katz
In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme $\pi = (Gen,Enc_K,Dec_K)$ is CPA secure for ...
- 626
3
votes
0
answers
192
views
partial-domain permutation and strong assumption
Quoting "Verified Security of Redundancy-Free Encryption
from Rabin and RSA", Chapter 2 (on page 4):
OAEP was proved IND-CCA-secure by Fujisaki et al. [28] under the assumption that the underlying ...
- 163
2
votes
0
answers
79
views
Secure CCA Encryption under Partial Key Exposure
I'm currently learning about chosen ciphertext attack and stumbled across a problem on CCA security. If I have an encryption scheme $(Gen,Enc,Dec)$, which is CCA-secure with $Enc:\{0,1\}^n\times \{0,1\...
- 21
2
votes
0
answers
155
views
Intuition for Cramer Shoup Encryption Scheme?
I was reading the Cramer Shoup CCA2 secure encryption scheme. The scheme is as follows.
Public key = $(g_1, g_2, c, d, h, hk)$, where $c = g_1^{x_1}g_2^{y_1}$, $d = g_1^{x_2}g_2^{y_2}$, $h = g_1^z$, ...
- 1,354
2
votes
0
answers
161
views
Patarin’s H-Coefficient Technique
I have come across many paper that applies Patarin’s H-Coefficient Technique in various cryptographic securities (KPA, CPA, CCA,...).
I am asking kindly if someone could explain it simple with ...
- 1,990
2
votes
0
answers
51
views
Trading Chosen-Ciphertext-Protection for Double encryption
Straight to the point: I'm trying to implement double encryption using two cipher suites. One (#1) of them is a stream cipher without any checksum/authentication guarantee, the other (#2) is an AEAD ...
- 731
2
votes
0
answers
168
views
How can I show the new crypto scheme is still IND-CCA1 in proof of “IND-CCA1 does not imply NM-CPA”?
I am trying to show IND-CCA1 does not imply NM-CPA. From what I have read the "classical" proof goes by taking an IND-CCA1 scheme $E$ and modifying it so that the encryption of the inverted ...
- 530
2
votes
0
answers
183
views
AES-128: How to find cipherkey comparing wrong and right ciphertexts?
I have a .mat file which contains 10 plaintexts and 10 ciphertexts which are correctly encrypted with AES-128 algorithm. It also contains 10 more ciphertexts which are wrongly encrypted. The fault is ...
- 121
2
votes
0
answers
202
views
Proof of IND-q-CCA security
I have some questions about the paper Bounded CCA2-Secure Encryption (pdf).
On page eight "3.2 Construction", the authors have done a black-box construction of an IND-q-CCA security schema and then ...
- 31
2
votes
0
answers
263
views
How do I prove that a bit by bit PKE scheme (that is IND-CPA secure) for an n-bit message is not IND-CCA-2 secure?
Gen generates Pk and Sk (l bits each), Enc encrypts m (length l) but by bit using each bit of Pk respectively, Dec decrypts ciphertext bit by bit using each bit of Sk respectively. How do I prove this ...
- 31
2
votes
0
answers
172
views
IND-CCA2 secure schemes without Plaintext Awareness?
I have been reading up on IND-CCA2 security and was wondering: Are there efficient IND-CCA2 secure schemes that do not require plaintext awareness? I'm guessing yes - could someone point me to these ...
- 353
1
vote
1
answer
91
views
CBC not CCA secure
I always get stuck at those kind of exercises in my Cryptography class. I just don't understand how should I build these scenarios of "sending m1 and m2 and then somehow telling if it was m1 or ...
- 11
1
vote
0
answers
73
views
Which encryption method support 256 bytes block size?
I am looking at some secret encryption method that apparently uses CBC and a block size of 256 bytes. I can do a chosen-ciphertext-attack. When I modify a single byte in the ciphertext a complete ...
- 11
1
vote
0
answers
41
views
Construction of a SKE scheme based on a PRF family and on a MAC with UF-CMA security. Is the scheme secure?
Consider the following construction of a SKE scheme $\Pi^*=(Enc^*,Dec^*)$ based on a PRF family $F=\{F_k:\{0,1\}^n\rightarrow \{0,1\}^n\}_{k\in\{0,1\}^\lambda}$ and on a MAC
$ Tag:\{0,1\}^\lambda \...
- 33
1
vote
0
answers
30
views
What are the possible CCA attacks on RSA with r||m+G(r) as the padding?
I was trying to come up with simple padding functions for the RSA, then trying to break them just to have a better understanding of why we need all the pieces used in the RSA OAEP... So, I am ...
1
vote
0
answers
113
views
Bleichenbacher 1998 "Million message attack" CCA
After implementing and playing around with famous "Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1" there couple of questions which I can't really ...
1
vote
0
answers
61
views
Essential requirement for IND-CCA1 and IND-CCA2
I am learning about the concept of two security notions called IND-, which include IND-CPA, IND-CCA1 and IND-CCA2. While I got some grasp understanding about the scenarios between the challenger & ...
- 85
1
vote
0
answers
78
views
Trying to understand this Solution related to CCA security
4.25) Let F be a strong pseudorandom permutation, and define the following fixed-length encryption scheme: On input a message $m ∈ \{0,1\}^{n/2}$ and key $k ∈ \{0,1\}^n$, algorithm $Enc$ chooses a ...
- 11
1
vote
0
answers
85
views
Clarification for CCA security (or - why is the following not a Rabin CCA attack?)
In three different, highly reputable sources (e.g. "Introduction to Modern Cryptography" by Katz and Lindell, 2007), the definition of CCA attack doesn't allow the adversary to decrypt the ...
- 383
1
vote
0
answers
84
views
getting key $k_{2}$ somehow definitely compromise authentication scheme and attacker can see cipher text now...so not secure
I was going through this question of nested encryption:
Given $\Pi$ = $({Gen}, {Enc}, {Dec})$ is authentication encryption we have designed new scheme $\Pi^{'}$ = $({Gen^{'}}, {Enc{'}}, {Dec{'}})$ ...
- 49
1
vote
0
answers
288
views
IND-CCA game proof of Encrypt-then-Mac
In [BN07, Subsection 4.3], the authors show that if a symmetric scheme $\mathcal{SE}$ is IND-CPA and a MAC $\mathcal{MA}$ is EUF-CMA (though they use the SUF-CMA notation, but I think it refers to the ...
- 233
1
vote
0
answers
100
views
CCA Security/Decryption of PRF scheme
Let $F : \{0,1\}^n \times \{0,1\}^n \rightarrow \{0,1\}^n $ be a PRF. And let the encryption function be $Enc{_k}(m) = r\mathbin\| (F{_k}(m\bigoplus r)$ , r being a random value.
Im trying to proof ...
- 11
1
vote
0
answers
327
views
CCA attack on RSA padded with random oracle
I'm trying to do the ex 11.15 of the Katz-Lindell book.
Consider the RSA-based encryption scheme
in which a user encrypts a message $m ∈ $ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by ...
- 11
1
vote
0
answers
508
views
Cryptanalysis affine cipher and substitution cipher
1) Consider the chosen-plaintext attack on the simple substitution
cipher. How many chosen plaintext characters suffice to uniquely
determine the key?
My answer was: 26!
2) Consider the chosen-...
- 359
1
vote
0
answers
141
views
PKI Challenge Response: why is $h(r) = x$ enough to protect against chosen text attacks?
I think the question was asked somewhere else but not answered very precisely.
Quoting from the "Handbook of applied cryptography":
Identification based on PK decryption and witness.
Consider ...
- 11
1
vote
0
answers
108
views
Can I overcome ElGamal malleability with AES preprocessing?
So textbook ElGamal is known to be vulnerable to CPA, and although there are several proposals (DHAES/EIES) for modifications none of those are formally accepted or standardized.
My question is ...
- 11
1
vote
0
answers
1k
views
CBC mode is not IND-CCA2 secure with no prediction of IV
How can it be explained that CBC mode is not IND-CCA2 secure, in case that the IV can't be predicted by adversary.
Edit:
In decryption of CBC, for each block it is XORed with previous block's cipher ...
- 11
1
vote
0
answers
225
views
CCA security of a system that splits messages and encrypts each packet
Propose a symmetric key based crypto-system for implementing a secure email system. This system is based on AES and CCA secure.
Suppose that you have to encrypt a large message and that this message ...
- 19
1
vote
1
answer
298
views
CCA-Security Proof of a Particular Scheme
Suppose we have a scheme that works so:
$\mathcal{P}_k =:\{P_k\colon \{0,1\}^{2n} \to \{0,1\}^{2n} \}$ is a strong PRP family.
Encryption: $\operatorname{Enc}(k,m)=P_k(m\mathbin\Vert r)$, where $\Vert$...
0
votes
0
answers
64
views
CCA-Attacks in the real (and digital) world
Is any concrete and real examples of CCA-attacks in recent history.
I'm aware about examples of WW2, but I'm more interested to modern examples in a digital context (for example against OFB, CBC).
- 2,542
0
votes
0
answers
82
views
How can I show that AES-GCM is secure under the adaptive chosen cipher-text game?
How can I show that AES-GCM is secure under the adaptive chosen ciphertext game?
This is assuming the GHASH Mac tag can't be forged faster than brute force?
- 151
0
votes
0
answers
18
views
Transforming BGN to non-malleable
Is there a way to transform the BGN encryption into non-malleable (i.e., IND-CCA2) without the use of symmetric encryption or signature?
I thought that simply publishing a proof of knowledge (via non ...
- 79
0
votes
0
answers
53
views
Not getting idea how to formally chose chosen cipher attack so adversay wins with non-negligible probability
I was going through this question and intuition came that same message can be used to break security but I an not able formalize it well...can someone help how to create chosen ciphertext attack ...
- 49
0
votes
0
answers
132
views
Guarding against vulnerabilities for a digital signature service (RSA )
Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload.
What are the possible attacks that I would need to guard against in this context (primarily assuming ...
- 204
0
votes
0
answers
183
views
Question about IND-CCA security
We are given the following securitygame $G^{\text{LOSTNAME}}$:
Generate $k \leftarrow \{0,1\}^{\kappa}$ uniformly at random
Choose $h \leftarrow \{0,1\}$ uniformly random
Create decryption oracle $\...
0
votes
0
answers
89
views
RNG to hide some bits
Suppose I have a sequence of bits of length M. I need to hide N out of M bits (hiding means forcing them to be 0) using RNG with a key. How I can relate the output of RNG to the number and positions ...
- 35
0
votes
0
answers
197
views
Formal security-definition reference
Is there a reference where all common formal security-definitions are summarized (such as OW-CPA, IND-CPA, IND-CCA1, IND-CCA2, EUF-CMA and so on)? I need a PUBLISHED reference (paper, book) which ...
- 123
0
votes
0
answers
592
views
Strong pseudo random permutation implies CCA-security
Let $F$ be a strong pseudo random permutation and define a fixed-length encryption scheme $(\operatorname{Enc,Dec})$ as follows:
On input $m \in \{0,1\}^{\frac{n}{2}}$ and key $k\in \{0,1\}^{n}$, ...
- 123