# Questions tagged [chosen-ciphertext-attack]

A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.

207 questions
Filter by
Sorted by
Tagged with
5k views

### Can I obtain the hashing algorithm if I know both the input and the output?

Suppose I have a string "Hello World". And I pass it through an unknown function which gives output as "6Xbhkfo520/78". So, ...
2k views

### Encrypt-and-mac IND-CCA security

I have been stuck all day trying to understand how to show that an Encrypt-and-Mac ($SE_{EaM}$) scheme is not IND-CCA secure. I have seen this similar post, however it is slightly different and the ...
• 63
107 views

### The differences between the attackers in the definitions of IND-ATK and NM-ATK

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
• 1,572
1 vote
298 views

### CCA-Security Proof of a Particular Scheme

Suppose we have a scheme that works so: $\mathcal{P}_k =:\{P_k\colon \{0,1\}^{2n} \to \{0,1\}^{2n} \}$ is a strong PRP family. Encryption: $\operatorname{Enc}(k,m)=P_k(m\mathbin\Vert r)$, where $\Vert$...
1k views

### Indistinguishability versus semantic security?

I found some foundations of crypto course notes that mention that these two are equivalent statements of their own degrees of security and was given the following definitions: I was always under the ...
• 415
168 views

### How can I show the new crypto scheme is still IND-CCA1 in proof of “IND-CCA1 does not imply NM-CPA”?

I am trying to show IND-CCA1 does not imply NM-CPA. From what I have read the "classical" proof goes by taking an IND-CCA1 scheme $E$ and modifying it so that the encryption of the inverted ...
• 530
416 views

### Attack on AES-CBC with small pool of IV

Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$. I know that if we can predict next IV with 100% probability there is attack that completely breaks ...
• 249
537 views

• 646
919 views

### Build a scheme that is CCA secure but not authenticated

Trying to understand a solution from this paper: Summary: $E'_K=0||E_K(m)$ and $D'_K(0||c)=D_K(c)$ and $D'_K(1||c)=1$ IND-CCA secure (how?) as $1||c$ and $0||c$ are are easily decryptable Not ...
• 507
923 views

### Hash ElGamal CCA approach

With this Elgamal variant defined below, we have covered in lecture but I do not still understand how a CCA could work against it. Is the use of the homomorphic nature of the encryption something you ...
4k views

### How to break AES CBC PADDING with chosen ciphertext attack

I'm doing a penetration testing for a web application that uses AES CBC PADDING encryption for the parameter ?email=ciphertext then it's printing the plaintext email on html body. I would like to ...
1 vote
432 views

### To which game-based security definition is Perfect Secrecy equivalent?

We all know the classic definitions of perfect secrecy, being $$\Pr[M=m|C=c]=\Pr[M=m]$$ and $$H(M|C)=H(M)$$ But now what I've asked myself: If we were to remove the polynomial restriction on the ...
• 45.5k
618 views

### Can you help me understand indistinguishably as described in the CPA security definition?

When I read the definition of the CPA indistinguishably encryption scheme, I see that the adversary can use an oracle as many times (to get as many encryptions of any messages it choose). An the end ...
• 353
537 views

### Prove if it is a CCA secure Commitment

Assume we have a IND-CCA-secure PKC (Public-Key-Cryption) and we construct a commitment-scheme(commit, reveal) with that IND-CCA-secure PKC (so that commitment should be IND-CCA-secure too). But how ...
113 views

### How any attack on a cipher carried out? Are these practical or only theoretical?

I have been reading about successful attacks on AES and other ciphers. One such mention is here (see excerpt below): AES was published under the name Rijndael in 1998. Refereed cryptanalytic ...
• 571
1 vote
1k views

### CBC mode is not IND-CCA2 secure with no prediction of IV

How can it be explained that CBC mode is not IND-CCA2 secure, in case that the IV can't be predicted by adversary. Edit: In decryption of CBC, for each block it is XORed with previous block's cipher ...
• 11
711 views

• 129
489 views

### Why Boneh-Franklin BasicIdent IBE is not chosen-ciphertext secure? Why use random oracle?

I don't know why BasicIdent is not chosen-ciphertext secure. If there are anybody who knows well, please explain it to me with example. Moreover, I don't know random oracle and its usage for security ...
• 321
613 views

### LR-Oracle Experiment in Lindell and Katz

In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme $\pi = (Gen,Enc_K,Dec_K)$ is CPA secure for ...
• 626
668 views

### What is the difference between RCCA and CCA2?

Well, I know it's easy to tell CCA1 from CCA2, but I failed to find the difference between RCCA and CCA2. What is the difference?
1 vote
547 views

### What do you mean by Ciphertext indistinguishability [duplicate]

Wiki definition : A cryptosystem is considered secure in terms of indistinguishability if no adversary, given an encryption of a message randomly chosen from a two-element message space ...
• 151
263 views

### How do I prove that a bit by bit PKE scheme (that is IND-CPA secure) for an n-bit message is not IND-CCA-2 secure?

Gen generates Pk and Sk (l bits each), Enc encrypts m (length l) but by bit using each bit of Pk respectively, Dec decrypts ciphertext bit by bit using each bit of Sk respectively. How do I prove this ...
200 views

### Confused about how chosen ciphertext attacks work?

When performing a CCA, the adversary gets the public key. At some point, he will send a message m to the challenger, and the challenger will send back either $E_{pk}(m)$ or $E_{pk}(r)$, where r is ...
• 137
161 views

### Cracking a hash which descends to a single value after repeated hashes

Assume I have a hash function (such as the one below) and a cipher, and I know that if I repeatedly hash any string over and over again, it will eventually descend to one unique value. Is there any ...
Given the linear block cipher $\operatorname{LinearCipher}(k, p) = c$ \operatorname{LinearCipher}(k, p_1 \oplus p_2) = \operatorname{LinearCipher}(k, p_1) \oplus \operatorname{LinearCipher}(k, p_2)\$...