As of May 31, 2023, we have updated our Code of Conduct.

# Questions tagged [chosen-ciphertext-attack]

A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.

205 questions
Filter by
Sorted by
Tagged with
1k views

### Why does Encrypt-Then-Sign not yield a CCA-secure public-key encryption scheme?

In symmetric cryptography, combining an IND-CPA secure symmetric encryption scheme with a secure MAC with the encrypt-then-MAC method yields a IND-CCA secure symmetric encryption scheme. I am trying ...
1 vote
299 views

### Finding RSA private exponent with a chosen ciphertext attack?

Let's say there's this blackbox app that has a known modulus $N$, private exponent $e$, and takes ciphertext $C$ encrypted against $N$ and $e$ input and outputs plaintext $M$. The encryption is done ...
668 views

### How to prove that RSA is not IND-CCA2?

RSA is homomorphic wrt multiplication and therefore it is not IND-CCA2. But how to show it. What are the steps to win IND-CCA2 game? How is the probability of winning calculated?
• 103
47 views

### Markov ciphers - generalized group operation

I’m reading this paper of Lai and Massey where they give a very nice perspective on differential attacks in general http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass-inspec-1991-3.pdf They do their ...
• 305
1 vote
76 views

### Knowledge of discrete log is needed in the proof of Cramer-Shoup public key scheme?

In the proof of the Cramer-Shoup public key scheme [1], I understand that the adversary's view can be seen as equations such as $\log c = x_1 + w x_2, \log d = y_1 + w y_2$ and so on (equation 1 and 2 ...
• 1,365
1 vote
350 views

510 views

### How many required known plaintexts for an attack are considered insecure?

I stumbled over this problem when looking at symmetrical block ciphers with a relatively small block size like 32 bit. When I was looking at more common block ciphers with a 64 bit, I learned that ...
• 123
155 views

### Intuition for Cramer Shoup Encryption Scheme?

I was reading the Cramer Shoup CCA2 secure encryption scheme. The scheme is as follows. Public key = $(g_1, g_2, c, d, h, hk)$, where $c = g_1^{x_1}g_2^{y_1}$, $d = g_1^{x_2}g_2^{y_2}$, $h = g_1^z$, ...
• 1,354
1 vote
553 views

• 1,233
1k views

### AES-GCM secure against IND-CCA2

How would you prove that AES-GCM is secure against a chosen ciphertext attack (IND-CCA2), assuming that the attacker cannot forge AES-GCM MAC tags in less than brute force?
• 33
1 vote
1k views

### Unforgeable CPA-secure private-key encryption scheme that is not CCA-secure

This is exercise with 4.26 in Katz and Lindell's introduction to cryptography 2nd ed. The question is: Show a CPA-secure private-key encryption scheme that is unforgeable but is not CCA-secure. ...
• 835
179 views

### GCM decryption and clear text processing

When using GCM mode decryption, is it necessary to wait for the decryption to complete, (and thus being able to see if the integrity of cipher text is OK) before beginning processing the clear text ...
• 23
827 views

### Recovery of private key in AES-CBC from two ciphertexts with different IV, but identical plantext

I have a system that encrypts messages for a given user using key K using AES-CBC in response in an external stimulus. Each message has a randomly generated IV. The user never decodes these messages,...
4k views

### Is AES-CBC mode not secure against chosen cipher-text attacks even if the IV is not predictable?

I've seen questions where people have asked if AES-CBC mode is vulnerable to chosen cipher-text attacks if the IV is predictable. But is it guaranteed to be secure against chosen cipher text attacks ...
51 views

### Trading Chosen-Ciphertext-Protection for Double encryption

Straight to the point: I'm trying to implement double encryption using two cipher suites. One (#1) of them is a stream cipher without any checksum/authentication guarantee, the other (#2) is an AEAD ...
• 731
1 vote
155 views

### What is the connection between "replay attack" to CCA security?

Often in analyzing systems, the emulation of Replay Attack becomes important. Are systems that protected against CCA attacks also immune against replay attack, or it is a different criterion? Thanks
• 1,068
1 vote
507 views

### Cryptanalysis affine cipher and substitution cipher

1) Consider the chosen-plaintext attack on the simple substitution cipher. How many chosen plaintext characters suffice to uniquely determine the key? My answer was: 26! 2) Consider the chosen-...
• 359
3k views

### Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?

I have written a code to encrypt a plaintext as below. Here I am using bouncycastle crypto provider and referring to the RSA+OAEP for that. ...
• 91
579 views

1 vote
141 views

### PKI Challenge Response: why is $h(r) = x$ enough to protect against chosen text attacks?

I think the question was asked somewhere else but not answered very precisely. Quoting from the "Handbook of applied cryptography": Identification based on PK decryption and witness. Consider ...
• 11
92 views

### Is there a way to double the size of ciphertexts of a public-key scheme which is IND-CCA2

Let $\Pi = \left( \mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec} \right)$ a public-key scheme which is secure in the sense of IND-CCA2. Assume the ciphertexts space is $\mathcal{C} \subset \{0,1\}^{n}$. Can ...
• 1,572
I have been stuck all day trying to understand how to show that an Encrypt-and-Mac ($SE_{EaM}$) scheme is not IND-CCA secure. I have seen this similar post, however it is slightly different and the ...