Questions tagged [chosen-ciphertext-attack]
A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.
205
questions
6
votes
2
answers
1k
views
Why does Encrypt-Then-Sign not yield a CCA-secure public-key encryption scheme?
In symmetric cryptography, combining an IND-CPA secure symmetric encryption scheme with a secure MAC with the encrypt-then-MAC method yields a IND-CCA secure symmetric encryption scheme.
I am trying ...
- 63
1
vote
1
answer
299
views
Finding RSA private exponent with a chosen ciphertext attack?
Let's say there's this blackbox app that has a known modulus $N$, private exponent $e$, and takes ciphertext $C$ encrypted against $N$ and $e$ input and outputs plaintext $M$.
The encryption is done ...
- 11
0
votes
1
answer
668
views
How to prove that RSA is not IND-CCA2?
RSA is homomorphic wrt multiplication and therefore it is not IND-CCA2. But how to show it.
What are the steps to win IND-CCA2 game?
How is the probability of winning calculated?
- 103
3
votes
0
answers
47
views
Markov ciphers - generalized group operation
I’m reading this paper of Lai and Massey where they give a very nice perspective on differential attacks in general
http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass-inspec-1991-3.pdf
They do their ...
- 305
1
vote
1
answer
76
views
Knowledge of discrete log is needed in the proof of Cramer-Shoup public key scheme?
In the proof of the Cramer-Shoup public key scheme [1], I understand that the adversary's view can be seen as equations such as $\log c = x_1 + w x_2, \log d = y_1 + w y_2$ and so on (equation 1 and 2 ...
- 1,365
1
vote
1
answer
350
views
How can I show RSA-OAEP is not IND-CCA secure if G always outputs 0 (i.e. there is no hash function)?
Here is what I understand the algorithm to be:
Let $G, H$ be one-way functions, where G outputs the 0 string.
𝐸𝑛𝑐𝑜𝑑𝑒
Select a random $𝑘$-bit integer $𝑟$.
Pad out $𝑚$ with $0$s to length $𝑙...
- 13
2
votes
1
answer
316
views
Proofs that NM-CPA implies IND-Cpa and $\text{IND-CCA} \leftrightarrow \text{NM-CCA}$
I am looking for a proof for the following two claims from "Serious Cryptography" by Aumasson.
NM-CPA implies IND-CPA. [...] IND-CCA and NM-CCA are equivalent notions that imply the presence of the ...
3
votes
2
answers
198
views
Bleichenbacher attack test vectors
I was trying to understand the Bleichenbacher attack. I went through the paper of Bleichenbacher to understand it a bit more. However, I tried to get some test vectors to simulate this attack locally ...
- 68
2
votes
1
answer
360
views
Is Cramer-Shoup Lite IND-CCA secure?
Recently, I studied about Cramer-Shoup encryption scheme. Then, I read a book which mentioned a simpler version of this scheme, the Cramer-Shoup Lite encryption scheme.
I was wondering if there is ...
- 41
0
votes
1
answer
112
views
Trapdoors for Lattices: CCA-secure encryption
In Trapdoors for Lattices:Simpler, Tighter, Faster, Smaller, Micciancio and Peikert proposed a CCA-secure encryption.
However, I am confused about the step in decryption algorithm (p.36 Lemma 6.2.).
...
- 103
1
vote
1
answer
127
views
Why does this attack on a simplified version of the Naor-Yung scheme not work for the original scheme?
tl;dr: We were given a homework, in which we should discuss, whether encrypting twice in the Naor-Yung scheme is actually necessary. I could prove that it is, by constructing an attacker on a scheme ...
- 48
0
votes
1
answer
243
views
CCA security of this scheme
Let $k$ be uniformly sampled from $\{0,1\}^\lambda$, $F$ be a secure PRP with block length $\lambda$ and let $Enc(k, m)$ be such that it returns $c = (F(k,r), r \oplus F(k,m))$ with $r$ uniformly ...
- 111
2
votes
1
answer
2k
views
How to prove an encryption scheme is not CCA secure
Given the following context below, how does one show or prove the encryption scheme is NOT IND-CCA secure
The IND-CPA secure private-key encryption scheme for n-bit messages can be constructed from a ...
3
votes
2
answers
927
views
Attack on security model for RSA-FDH
I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen
Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is ...
- 31
0
votes
1
answer
3k
views
Proving the CCA-insecurity of El Gamal encryption scheme
I am trying to prove that El Gamal Encryption is not CCA-Secure.
If an adversary queried the encryption oracle for the encryption of $m=1$, he'll get a pair $(c_1,c_2)=(g^y,g^{xy}\cdot m)=(g^y,g^{xy}\...
user63422
2
votes
1
answer
510
views
How many required known plaintexts for an attack are considered insecure?
I stumbled over this problem when looking at symmetrical block ciphers with a relatively small block size like 32 bit.
When I was looking at more common block ciphers with a 64 bit, I learned that ...
- 123
2
votes
0
answers
155
views
Intuition for Cramer Shoup Encryption Scheme?
I was reading the Cramer Shoup CCA2 secure encryption scheme. The scheme is as follows.
Public key = $(g_1, g_2, c, d, h, hk)$, where $c = g_1^{x_1}g_2^{y_1}$, $d = g_1^{x_2}g_2^{y_2}$, $h = g_1^z$, ...
- 1,354
1
vote
1
answer
553
views
Is Hybrid Encryption CCA secure?
If Enc is a PKE(Public Key Encryption) with key generation algorithm KG and message space $M = \{0, 1\}^n$, and SE is a Symmetric Key Encryption(SKE) with key space $\{0, 1\}^n$ and message space $M' =...
- 31
1
vote
2
answers
2k
views
Efficient attack on RSA with known padding scheme and public key
I am having some trouble with an assignment problem. I hope I can get some guidance here. The question provides us with a public key, $N$ and the padding scheme.
This is the padding scheme "Assume ...
- 11
0
votes
0
answers
197
views
Formal security-definition reference
Is there a reference where all common formal security-definitions are summarized (such as OW-CPA, IND-CPA, IND-CCA1, IND-CCA2, EUF-CMA and so on)? I need a PUBLISHED reference (paper, book) which ...
- 123
3
votes
1
answer
1k
views
Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?
I presented our mathematician with an idea:
If you have a black box that encrypts or decrypts AES with the same 128 bit key (you don't have any direct access to the key), and you control the input ...
- 45
9
votes
2
answers
1k
views
What do NM-CPA and NM-CCA mean?
When I've been researching authenticated encryption, the following terms keep showing up:
NM-CPA
NM-CCA
....without any definition as to what they mean. I've tried searching the web for their ...
2
votes
0
answers
161
views
Patarin’s H-Coefficient Technique
I have come across many paper that applies Patarin’s H-Coefficient Technique in various cryptographic securities (KPA, CPA, CCA,...).
I am asking kindly if someone could explain it simple with ...
- 1,990
1
vote
1
answer
315
views
Is chosen ciphertext attack used to obtain a key? [duplicate]
I don't understand what the goals are of a Chosen Ciphertext Attack.
What I've read from Wikipedia is that it is an attack one can use to obtain the key that the crypto algorithm uses.
However, I ...
- 111
2
votes
1
answer
131
views
If TDP exist then CCA-secure PKES exist?
My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following:
If trapdoor permutations exist then CCA-secure public key ...
- 1,233
2
votes
1
answer
148
views
If DDH is hard then CCA-secure PKES exist?
My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following:
If decisional Diffie-Hellman problem is hard then there ...
- 1,233
0
votes
0
answers
592
views
Strong pseudo random permutation implies CCA-security
Let $F$ be a strong pseudo random permutation and define a fixed-length encryption scheme $(\operatorname{Enc,Dec})$ as follows:
On input $m \in \{0,1\}^{\frac{n}{2}}$ and key $k\in \{0,1\}^{n}$, ...
- 123
1
vote
0
answers
327
views
CCA attack on RSA padded with random oracle
I'm trying to do the ex 11.15 of the Katz-Lindell book.
Consider the RSA-based encryption scheme
in which a user encrypts a message $m ∈ $ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by ...
- 11
4
votes
1
answer
511
views
Does Elliptic Curve Integrated Encryption Scheme (ECIES) provide IND-CCA2 security?
I am looking for a faster alternative to RSA with OAEP as a IND-CCA2 public key scheme. Elliptic Curve Integrated Encryption Scheme might be a candidate, but I am not sure if it provides IND-CCA2 ...
- 317
6
votes
1
answer
486
views
Differences between NewHope-CPA-KEM and NewHope-CCA-KEM
According to the web page for NewHope, an R-LWE post-quantum key encapsulation mechanism (KEM) candidate for standardization, it comes in types that are IND-CPA or IND-CCA secure. I know what CPA and ...
- 14.9k
3
votes
1
answer
220
views
Symmetric Key Encryption is not Authentication?
Is there any way to show CCA-secure symmetric-key encryption does not have to be an authenticated encryption?
I know you can create a set up that isn't authenticated, but how will you go about it?
- 31
8
votes
1
answer
584
views
Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?
Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?
I have been reading about homomorphic encryption and ...
- 83
1
vote
1
answer
1k
views
CPA-secure of $\Pi$ implies CPA-security of $\Pi||\Pi||\ldots||\Pi$
Katz and Lindell book claim that from the theorem:
Any private-key encryption scheme that is CPA-secure is also
CPA-secure for multiple encryptions.
Follows the fact that:
If $(Gen,...
- 1,233
3
votes
1
answer
1k
views
AES-GCM secure against IND-CCA2
How would you prove that AES-GCM is secure against a chosen ciphertext attack (IND-CCA2), assuming that the attacker cannot forge AES-GCM MAC tags in less than brute force?
- 33
1
vote
1
answer
1k
views
Unforgeable CPA-secure private-key encryption scheme that is not CCA-secure
This is exercise with 4.26 in Katz and Lindell's introduction to cryptography 2nd ed.
The question is: Show a CPA-secure private-key encryption scheme that is unforgeable but is not CCA-secure.
...
- 835
2
votes
1
answer
179
views
GCM decryption and clear text processing
When using GCM mode decryption, is it necessary to wait for the decryption to complete, (and thus being able to see if the integrity of cipher text is OK) before beginning processing the clear text ...
- 23
0
votes
1
answer
827
views
Recovery of private key in AES-CBC from two ciphertexts with different IV, but identical plantext
I have a system that encrypts messages for a given user using key K using AES-CBC in response in an external stimulus. Each message has a randomly generated IV. The user never decodes these messages,...
2
votes
1
answer
4k
views
Is AES-CBC mode not secure against chosen cipher-text attacks even if the IV is not predictable?
I've seen questions where people have asked if AES-CBC mode is vulnerable to chosen cipher-text attacks if the IV is predictable.
But is it guaranteed to be secure against chosen cipher text attacks ...
- 211
2
votes
0
answers
51
views
Trading Chosen-Ciphertext-Protection for Double encryption
Straight to the point: I'm trying to implement double encryption using two cipher suites. One (#1) of them is a stream cipher without any checksum/authentication guarantee, the other (#2) is an AEAD ...
- 731
1
vote
2
answers
155
views
What is the connection between "replay attack" to CCA security?
Often in analyzing systems, the emulation of Replay Attack becomes important. Are systems that protected against CCA attacks also immune against replay attack, or it is a different criterion?
Thanks
- 1,068
1
vote
0
answers
507
views
Cryptanalysis affine cipher and substitution cipher
1) Consider the chosen-plaintext attack on the simple substitution
cipher. How many chosen plaintext characters suffice to uniquely
determine the key?
My answer was: 26!
2) Consider the chosen-...
- 359
9
votes
2
answers
3k
views
Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?
I have written a code to encrypt a plaintext as below. Here I am using bouncycastle crypto provider and referring to the RSA+OAEP for that.
...
- 91
0
votes
1
answer
579
views
Proof that a modified public-key encryption scheme is not CCA secure
Let $\mathcal{E} = (G, E, D)$ be a CCA-secure public-key encryption scheme defined
over $(\mathcal{M, C})$ where $\mathcal{C} := \{0, 1\}^\ell$.
Let $\mathcal{E'} = (G, E', D')$ be a scheme (over $(\...
- 437
3
votes
1
answer
509
views
RSA-CCA security of $m || H(m)$ as input to modular exponentiation
If we encrypt a message $m$ as $m || H(m)$ using textbook RSA encryption algorithm, $H$ is random oracle modeled. In this case the message can be recovered.
Is this encryption CCA secure? If so how ...
- 29
3
votes
1
answer
867
views
Why is the lite version of Cramer-Shoup not IND-CCA2 secure?
In the lite version of Cramer-Shoup we have a group $G$ with generators $g_1$ and $g_2$, private key $a_1, a_2, b_1, b_2$, and public key $A = g_1^{a_1} g_2^{a_2}$, $B = g_1^{b_1} g_2^{b_2}$. ...
- 530
0
votes
1
answer
1k
views
Relationship between CCA/CPA-security and PRFs
I'm a bit confused about the relationship between CCA/CPA-security and PRFs and particularly when do we think of encryption and decryption as a PRF. Assume we have an encryption scheme $\Pi = (Enc, ...
- 13
1
vote
0
answers
141
views
PKI Challenge Response: why is $h(r) = x$ enough to protect against chosen text attacks?
I think the question was asked somewhere else but not answered very precisely.
Quoting from the "Handbook of applied cryptography":
Identification based on PK decryption and witness.
Consider ...
- 11
3
votes
1
answer
92
views
Is there a way to double the size of ciphertexts of a public-key scheme which is IND-CCA2
Let $\Pi = \left( \mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec} \right)$ a public-key scheme which is secure in the sense of IND-CCA2.
Assume the ciphertexts space is $\mathcal{C} \subset \{0,1\}^{n}$.
Can ...
- 1,572
2
votes
2
answers
5k
views
Can I obtain the hashing algorithm if I know both the input and the output?
Suppose I have a string "Hello World".
And I pass it through an unknown function which gives output as "6Xbhkfo520/78".
So, ...
- 21
4
votes
1
answer
2k
views
Encrypt-and-mac IND-CCA security
I have been stuck all day trying to understand how to show that an Encrypt-and-Mac ($SE_{EaM}$) scheme is not IND-CCA secure. I have seen this similar post, however it is slightly different and the ...
- 63