Questions tagged [chosen-ciphertext-attack]
A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.
207
questions
2
votes
2
answers
5k
views
Can I obtain the hashing algorithm if I know both the input and the output?
Suppose I have a string "Hello World".
And I pass it through an unknown function which gives output as "6Xbhkfo520/78".
So, ...
- 21
4
votes
1
answer
2k
views
Encrypt-and-mac IND-CCA security
I have been stuck all day trying to understand how to show that an Encrypt-and-Mac ($SE_{EaM}$) scheme is not IND-CCA secure. I have seen this similar post, however it is slightly different and the ...
- 63
0
votes
1
answer
107
views
The differences between the attackers in the definitions of IND-ATK and NM-ATK
I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
- 1,572
1
vote
1
answer
298
views
CCA-Security Proof of a Particular Scheme
Suppose we have a scheme that works so:
$\mathcal{P}_k =:\{P_k\colon \{0,1\}^{2n} \to \{0,1\}^{2n} \}$ is a strong PRP family.
Encryption: $\operatorname{Enc}(k,m)=P_k(m\mathbin\Vert r)$, where $\Vert$...
4
votes
1
answer
1k
views
Indistinguishability versus semantic security?
I found some foundations of crypto course notes that mention that these two are equivalent statements of their own degrees of security and was given the following definitions:
I was always under the ...
- 415
2
votes
0
answers
168
views
How can I show the new crypto scheme is still IND-CCA1 in proof of “IND-CCA1 does not imply NM-CPA”?
I am trying to show IND-CCA1 does not imply NM-CPA. From what I have read the "classical" proof goes by taking an IND-CCA1 scheme $E$ and modifying it so that the encryption of the inverted ...
- 530
3
votes
1
answer
416
views
Attack on AES-CBC with small pool of IV
Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$.
I know that if we can predict next IV with 100% probability there is attack that completely breaks ...
- 249
4
votes
0
answers
537
views
Why is this scheme not IND-CCA2 secure
I know that many lattice cryptosystems cannot be made $\text{IND-CCA2}$ or even $\text{IND-CCA}$ secure without substantial overhead.
However, it seems that (when used as a KEM) that any $\text{IND-...
- 4,763
3
votes
1
answer
386
views
CCA2-secure encryption based on LWE/Ring-LWE
As I understand it, cryptosystems based on LWE/Ring-LWE are typically only IND-CPA, and fail to satisfy IND-CCA2. In fact, it appears that chosen ciphertext attacks could allow secret key recovery (!)...
- 4,763
1
vote
0
answers
108
views
Can I overcome ElGamal malleability with AES preprocessing?
So textbook ElGamal is known to be vulnerable to CPA, and although there are several proposals (DHAES/EIES) for modifications none of those are formally accepted or standardized.
My question is ...
- 11
1
vote
1
answer
285
views
Does security against a CCA1 attacker imply security against a CPA attacker?
I've seen it mentioned multiple times, but have not seen a formal proof of how security of an encryption scheme against a non adaptive chosen-ciphertext attacker (under non-malleability or ciphertext ...
- 411
2
votes
3
answers
697
views
Invalid challenge-ciphertext in IND-CPA and IND-CCA games
Consider the IND-CPA game between a challenger $C$ and an adversary $A$ for a given public-key encryption scheme $PKE$:
$C$ generates a key pair $(pk,sk)$ based on some security parameter $n$, and ...
- 486
0
votes
1
answer
1k
views
many time pad attack [duplicate]
I am a beginner in cryptography. I studied many time pad attack and now I want to solve a popular exercise, It consists 11 ciphertexts (s1,s2,...,s11), that encrypted by a same key and I want to find ...
12
votes
2
answers
2k
views
Are common (secure) stream ciphers CCA1-secure?
My latest question and especially Ricky Demer's comment on the answer got me thinking: This homomorphic tranformation of RSA is most likely IND-CPA and maybe even IND-CCA1, but if it could be IND-CCA1,...
- 45.5k
2
votes
1
answer
660
views
Why is adaptive security stronger than CCA1 security, and weaker than CCA2 security?
We know in CCA1 security, after seeing the challenge ciphertext,
no more decryption oracles are allowed to the adversary.
But in adaptive security, what should the adversary do? Please help me ...
- 343
2
votes
0
answers
183
views
AES-128: How to find cipherkey comparing wrong and right ciphertexts?
I have a .mat file which contains 10 plaintexts and 10 ciphertexts which are correctly encrypted with AES-128 algorithm. It also contains 10 more ciphertexts which are wrongly encrypted. The fault is ...
- 121
5
votes
2
answers
718
views
Bleichenbacher attack, binary search, formula for $s_i$
Reading an excellent article explaining Bleichenbacher attack I came across the following statements under the formula for $s_i$:
if we pick $r ≥ 2(bs_{i-1} - 2B) / n$, we obtain
$(2B + 2(bs_{...
- 646
0
votes
1
answer
919
views
Build a scheme that is CCA secure but not authenticated
Trying to understand a solution from this paper:
Summary:
$E'_K=0||E_K(m)$ and $D'_K(0||c)=D_K(c)$ and $D'_K(1||c)=1$
IND-CCA secure (how?) as $1||c$ and $0||c$ are are easily decryptable
Not ...
- 507
0
votes
1
answer
923
views
Hash ElGamal CCA approach
With this Elgamal variant defined below, we have covered in lecture but I do not still understand how a CCA could work against it. Is the use of the homomorphic nature of the encryption something you ...
- 21
0
votes
1
answer
4k
views
How to break AES CBC PADDING with chosen ciphertext attack
I'm doing a penetration testing for a web application that uses AES CBC PADDING encryption for the parameter ?email=ciphertext then it's printing the plaintext email on html body.
I would like to ...
1
vote
1
answer
432
views
To which game-based security definition is Perfect Secrecy equivalent?
We all know the classic definitions of perfect secrecy, being
$$\Pr[M=m|C=c]=\Pr[M=m]$$
and
$$H(M|C)=H(M)$$
But now what I've asked myself:
If we were to remove the polynomial restriction on the ...
- 45.5k
4
votes
1
answer
618
views
Can you help me understand indistinguishably as described in the CPA security definition?
When I read the definition of the CPA indistinguishably encryption scheme, I see that the adversary can use an oracle as many times (to get as many encryptions of any messages it choose). An the end ...
- 353
0
votes
1
answer
537
views
Prove if it is a CCA secure Commitment
Assume we have a IND-CCA-secure PKC (Public-Key-Cryption) and we construct a commitment-scheme(commit, reveal) with that IND-CCA-secure PKC (so that commitment should be IND-CCA-secure too). But how ...
- 31
2
votes
1
answer
113
views
How any attack on a cipher carried out? Are these practical or only theoretical?
I have been reading about successful attacks on AES and other ciphers. One such mention is here (see excerpt below):
AES was published under the name Rijndael in 1998. Refereed
cryptanalytic ...
- 571
1
vote
0
answers
1k
views
CBC mode is not IND-CCA2 secure with no prediction of IV
How can it be explained that CBC mode is not IND-CCA2 secure, in case that the IV can't be predicted by adversary.
Edit:
In decryption of CBC, for each block it is XORed with previous block's cipher ...
- 11
0
votes
1
answer
711
views
IND-CCA Security of a encryption scheme which is combination of two schemes
I have two public key encryption scheme $\Pi_0$ and $\Pi_1$ and one of them is IND-CCA secure, another one is IND-CPA secure. Let $\Pi$ be a public key encryption scheme, which is a combination of $\...
2
votes
0
answers
202
views
Proof of IND-q-CCA security
I have some questions about the paper Bounded CCA2-Secure Encryption (pdf).
On page eight "3.2 Construction", the authors have done a black-box construction of an IND-q-CCA security schema and then ...
- 31
0
votes
1
answer
498
views
Chosen Ciphertext Attack on the Public Key in PGP
In Secrets & Lies (2000), Schneier describes a chosen ciphertext attack on the public key under PGP:
"Since RSA and ElGamal are malleable, known changes can be made to the symmetric key that is ...
- 155
4
votes
1
answer
802
views
Is a chosen ciphertext attack on PGP still possible?
In a paper from 2002 (pdf), Jallad et al describe a chosen ciphertext attack on PGP by taking advantage of the CFB mode that the block ciphers use under PGP. It's quite a devastating attack.
Is this ...
- 155
2
votes
1
answer
1k
views
What is the random tape?
I am reading the paper "Toward plaintext-aware public-key encryption without random oracles" by Bellare and Palacio. So I can't understand what is the tape and random tape?
- 21
3
votes
0
answers
822
views
Proving CCA security for scheme constructed from secure PRP
We have a $PRP : \{0,1\}^{3n} \rightarrow \{0,1\}^{3n}$ and encryption scheme constructed from this $PRP$.
$E_k(x\|r\|0^n)$, where $r$ is randomly chosen from $\{0,1\}^n$ and $0^n$ is a block of ...
- 61
2
votes
1
answer
2k
views
How do you prove an encryption scheme is IND-CPA or IND-CCA?
I know for proving a scheme is not IND-CPA or not IND-CCA you can construct an Adversary which has an unfair advantage in an experiment/game, but how would you prove a scheme is IND-CPA or IND-CCA?
- 47
0
votes
1
answer
454
views
CPA on theoretical OTP with CBC mode
Body of question
Note: this is THEORETICAL exercise. I understand OTP and CBC does not get along.
I have to find a CPA on CBC enc-mode using OTP as the encryption algorithm, s.t a new key is ...
- 365
1
vote
1
answer
729
views
Are the definitions of IND-CCA secure and of IND-CCA secure under standard model identical?
Suppose there is a public key cryptosystem based on the discrete logarithm problem and let this cryptosystem be IND-CCA secure under standard model. Does this statement mean that the given ...
0
votes
2
answers
179
views
Stripping off message authentication or signature
If attackers can strip off RSA / EC / -DSA digital signature and conduct CCA on AES-CTR or CBC payload, why can't they do the same for AES-GCM?
- 123
4
votes
1
answer
8k
views
What is the meaning of IND-CCA secure under standard model? [duplicate]
I notice that in many research papers (viz. "Universal hash proofs and a paradigm for adaptive chosen ciphertext secure public-key encryption" by Cramer and Shoup) the authors showed that their ...
4
votes
0
answers
196
views
Does length prepending fix the key reuse problems with CBC and CBC-MAC?
As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea.
Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
- 45.5k
0
votes
1
answer
245
views
CCA on PKCS#5 using error feedback
My question is about attacking PKCS#5 with CCA using the error feedback.
What we learnt in class about PKCS#5:
CBC requires padding to whole block boundary PKCS#5: standard padding
If last plaintext ...
- 365
0
votes
1
answer
881
views
Breaking One Time Pad with CCA
I was taught that:
although OTP is CPA secure, it is not the case with CCA.
I'm trying to figure how to break OTP with CCA by showing how it fails the IND test.
...
- 365
3
votes
1
answer
3k
views
Why is padded RSA not CCA-secure?
Why is the padded RSA construction given in the picture not CCA secure？
T Xie
1
vote
2
answers
327
views
Using same encryption key in different schemes
Is it safe to encrypt possibly same plaintexts with 2 different algorithms using same secret encryption key? This question is similar to this question except they use 2 keys. More formally:
$E_k(m) = ...
- 129
2
votes
1
answer
489
views
Why Boneh-Franklin BasicIdent IBE is not chosen-ciphertext secure? Why use random oracle?
I don't know why BasicIdent is not chosen-ciphertext secure. If there are anybody who knows well, please explain it to me with example.
Moreover, I don't know random oracle and its usage for security ...
- 321
3
votes
0
answers
613
views
LR-Oracle Experiment in Lindell and Katz
In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme $\pi = (Gen,Enc_K,Dec_K)$ is CPA secure for ...
- 626
6
votes
1
answer
668
views
What is the difference between RCCA and CCA2?
Well, I know it's easy to tell CCA1 from CCA2, but I failed to find the difference between RCCA and CCA2.
What is the difference?
- 61
1
vote
0
answers
547
views
What do you mean by Ciphertext indistinguishability [duplicate]
Wiki definition :
A cryptosystem is considered secure in terms of indistinguishability
if no adversary, given an encryption of a message randomly chosen from
a two-element message space ...
- 151
2
votes
0
answers
263
views
How do I prove that a bit by bit PKE scheme (that is IND-CPA secure) for an n-bit message is not IND-CCA-2 secure?
Gen generates Pk and Sk (l bits each), Enc encrypts m (length l) but by bit using each bit of Pk respectively, Dec decrypts ciphertext bit by bit using each bit of Sk respectively. How do I prove this ...
- 31
2
votes
1
answer
200
views
Confused about how chosen ciphertext attacks work?
When performing a CCA, the adversary gets the public key. At some point, he will send a message m to the challenger, and the challenger will send back either $E_{pk}(m)$ or $E_{pk}(r)$, where r is ...
- 137
2
votes
1
answer
161
views
Cracking a hash which descends to a single value after repeated hashes
Assume I have a hash function (such as the one below) and a cipher, and I know that if I repeatedly hash any string over and over again, it will eventually descend to one unique value.
Is there any ...
- 123
5
votes
1
answer
3k
views
Given a linear block-cipher,how can an attacker decrypt any plaintext value encrypted,using 128 chosen ciphertexts
Given the linear block cipher $\operatorname{LinearCipher}(k, p) = c$
$$\operatorname{LinearCipher}(k, p_1 \oplus p_2) = \operatorname{LinearCipher}(k, p_1) \oplus \operatorname{LinearCipher}(k, p_2)$...
6
votes
2
answers
2k
views
Creating own ciphertext after a padding oracle attack?
I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired?
...
- 61