Skip to main content

Questions tagged [chosen-ciphertext-attack]

A chosen-ciphertext attack (CCA) is an attack model for cryptanalysis in which the cryptanalyst gathers information, at least in part, by choosing a ciphertext and obtaining its decryption under an unknown key.

Filter by
Sorted by
Tagged with
3 votes
0 answers
687 views

LR-Oracle Experiment in Lindell and Katz

In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme $\pi = (Gen,Enc_K,Dec_K)$ is CPA secure for ...
Rohit Khera's user avatar
6 votes
1 answer
701 views

What is the difference between RCCA and CCA2?

Well, I know it's easy to tell CCA1 from CCA2, but I failed to find the difference between RCCA and CCA2. What is the difference?
veryflying's user avatar
1 vote
0 answers
549 views

What do you mean by Ciphertext indistinguishability [duplicate]

Wiki definition : A cryptosystem is considered secure in terms of indistinguishability if no adversary, given an encryption of a message randomly chosen from a two-element message space ...
python's user avatar
  • 151
2 votes
0 answers
277 views

How do I prove that a bit by bit PKE scheme (that is IND-CPA secure) for an n-bit message is not IND-CCA-2 secure?

Gen generates Pk and Sk (l bits each), Enc encrypts m (length l) but by bit using each bit of Pk respectively, Dec decrypts ciphertext bit by bit using each bit of Sk respectively. How do I prove this ...
user3799658's user avatar
2 votes
1 answer
201 views

Confused about how chosen ciphertext attacks work?

When performing a CCA, the adversary gets the public key. At some point, he will send a message m to the challenger, and the challenger will send back either $E_{pk}(m)$ or $E_{pk}(r)$, where r is ...
MBrown's user avatar
  • 137
2 votes
1 answer
164 views

Cracking a hash which descends to a single value after repeated hashes

Assume I have a hash function (such as the one below) and a cipher, and I know that if I repeatedly hash any string over and over again, it will eventually descend to one unique value. Is there any ...
Vedaad Shakib's user avatar
5 votes
1 answer
3k views

Given a linear block-cipher,how can an attacker decrypt any plaintext value encrypted,using 128 chosen ciphertexts

Given the linear block cipher $\operatorname{LinearCipher}(k, p) = c$ $$\operatorname{LinearCipher}(k, p_1 \oplus p_2) = \operatorname{LinearCipher}(k, p_1) \oplus \operatorname{LinearCipher}(k, p_2)$...
Dimitar Stratiev's user avatar
6 votes
2 answers
2k views

Creating own ciphertext after a padding oracle attack?

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired? ...
XeroAura's user avatar
4 votes
1 answer
2k views

How can a Encrypt-And-MAC scheme be insecure if the encryption is CCA secure?

I was presented with this seemingly paradoxical information, and am hoping someone can explain what I'm missing here. I have an encrypt-and-mac scheme here.If I want to transmit message m to Bob, I'd ...
user3277633's user avatar
4 votes
1 answer
462 views

Fixed-points in block ciphers; why don't they indicate a vulnerability?

I've seen a few questions here on fixed-points in ciphers, most asking about the possibility and existence. Most of the answers however pointed out that fixed points are not exactly a security threat. ...
Harsh's user avatar
  • 155
4 votes
2 answers
395 views

Chosen plain text and chosen ciphertext definitions clarification

I am trying to understand a concept of CPA and CCA attack and I cannot get one thing from the definition. If an attacker can execute a CPA attack for something like Send 100 dollars to attacker that ...
Ilya Chernomordik's user avatar
8 votes
1 answer
663 views

Can RSA be securely used for "blind decryption"?

Assume we have the following setup: A client with trusted storage and computing capabilities (e.g. a smartcard) A server with trusted computing and short-term storage capabilities (e.g. RAM + CPU, ...
SEJPM's user avatar
  • 46.1k
8 votes
2 answers
512 views

Is there a partially homomorphic quantum secure public key cryptosystem with IND-CCA1 security?

I recentely asked "IND-CCA1 RSA padding?" about whether there is a IND-CCA1 secure variant of RSA. The original version of the question also allowed usage of ECC which would allow usage of ElGamal, ...
SEJPM's user avatar
  • 46.1k
6 votes
0 answers
350 views

IND-CCA1 RSA padding?

I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property. I'm restricted to RSA (any padding; for hardware ...
SEJPM's user avatar
  • 46.1k
0 votes
1 answer
522 views

Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?

After the introduction of McBits, I was interested what security notions are neccessary for IND-CCA2 security of integrated encryption schemes (IES, following the key encapsulation mechanism / data ...
SEJPM's user avatar
  • 46.1k
7 votes
3 answers
1k views

What are the practical implications of ciphertext distinguishability?

Commonly there are four ways to "break" a secrecy-focused cryptosystem: Recover the secret key Recover the message Distinguish an encryption from random noise Distinguish the encryption of two ...
SEJPM's user avatar
  • 46.1k
4 votes
0 answers
295 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key Encapsulation Mechanism / Data Encapsulation Mechanism) which is used for example by the (famous) ECIES, where the key is the hash ...
SEJPM's user avatar
  • 46.1k
7 votes
1 answer
3k views

Is ElGamal IND-CCA1?

We all know that textbook ElGamal falls due to chosen ciphertext attacks, because of its multiplicative homomorphic property ($E(A)*E(B)=E(AB)$). However these attacks require the ciphertext ($E(A)$ ...
SEJPM's user avatar
  • 46.1k
6 votes
2 answers
8k views

ElGamal against chosen ciphertext attacks

In Hoffstein, Pipher, and Silverman's book An Introduction to Mathematical Cryptography, the authors make the following remark: An attack in which Eve has access to an oracle that decrypts ...
GrahamGoudeau's user avatar
73 votes
1 answer
36k views

Easy explanation of "IND-" security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
SEJPM's user avatar
  • 46.1k
7 votes
1 answer
751 views

Secret key and Decryption oracle in the revised Fujisaki-Okamoto transformation

Recently, Fujisaki and Okamoto provided a revised version of the Fujisaki-Okamoto transformation [1], a generic transformation for achieving IND-CCA2 security in the Random Oracle model. This new ...
cygnusv's user avatar
  • 5,002
3 votes
1 answer
139 views

What is the right notion of security to use for file encryption?

It seems that several file encryption systems do NOT use authenticated encryption. (E.g. gpg --symmetric and boxcryptor as far as I can determine). I understand that this is generally considered ...
DrEntropy's user avatar
  • 163
2 votes
1 answer
142 views

Does failure of indistinguishability of encryptions imply lack of CPA-security?

Suppose we have an encryption scheme that fails the indistinguishability of encryptions test. That is, given messages $m_0, m_1$ and a ciphertext $c_b = Enc_k(m_b)$, where $b \in \{0, 1\}$, the ...
Gordon's user avatar
  • 517
1 vote
1 answer
848 views

CCA secure or not?

Let $F : \{0,1\}^n \times \{0,1\}^n \rightarrow \{0,1\}^n $ be a PRF. And let the encryption function be $Enc{_k}(m) = r || (F{_k}(m) \bigoplus r \bigoplus 0^n)$ , where r's value is random. Is this ...
Lucian Tarna's user avatar
3 votes
1 answer
364 views

How to make PKCS conformation oracle for trying Bleichenbacher’s RSA attack?

I was trying to understand Bleichenbacher’s CCA attack and thought of work it out in python. Can some one throw some light on the the logic behind the oracle used to check PKCS conformation? Will a ...
vishnuvp's user avatar
  • 418
5 votes
1 answer
818 views

Secure ElGamal with OAEP

Is it possible to make ElGamal IND-CCA2 using OAEP or OAEP+? (OAEP+ from: "OAEP Reconsiderd" by Shoup) The reason I ask is that I recently answered this question and it came to my mind that OAEP or ...
SEJPM's user avatar
  • 46.1k
1 vote
1 answer
1k views

CCA-attack is possible in RSA, but how the decryption key $d$ is known to anyone

CCA-attack is possible in text-book RSA, but how the decryption key $d$ is known to anyone, as it is kept secret with receiver.
Aria's user avatar
  • 711
1 vote
1 answer
1k views

Definition of ciphertext security

If I got it right, chosen ciphertext security implies also CPA security. In other words, attacker can submit plaintexts to the challenger (along with ciphertexts). I do not understand why encryption ...
lstipakov's user avatar
  • 113
4 votes
1 answer
4k views

Definition of the Decryption oracle

In the context of public-key encryption, what would be a formal definition of the decryption oracle? I know the informal definition (i.e., a function that is available to the adversary and that ...
cygnusv's user avatar
  • 5,002
6 votes
3 answers
18k views

Chosen plaintext vs Chosen ciphertext

What is the difference between chosen plaintext and chosen ciphertext attack? In both of these adversary has access to paintext-ciphertext pairs.Then where lies the difference?
Kiran's user avatar
  • 193
1 vote
1 answer
1k views

Secure double encryption using CPA and CCA

Do you mind if you give me any hints, links or ideas about how to improve the security of double regular encryption and decryption, by using CPA game and CCA game, it sounds interesting question, and ...
Adam's user avatar
  • 13
1 vote
0 answers
228 views

CCA security of a system that splits messages and encrypts each packet

Propose a symmetric key based crypto-system for implementing a secure email system. This system is based on AES and CCA secure. Suppose that you have to encrypt a large message and that this message ...
user3754216's user avatar
2 votes
0 answers
181 views

IND-CCA2 secure schemes without Plaintext Awareness?

I have been reading up on IND-CCA2 security and was wondering: Are there efficient IND-CCA2 secure schemes that do not require plaintext awareness? I'm guessing yes - could someone point me to these ...
Angela's user avatar
  • 353
4 votes
2 answers
9k views

Chosen plaintext attack on textbook RSA decryption

Let $(n,d)$ be an RSA private key and $(n,e)$ the corresponding public key. Generate a secret random $r$ from $(\mathbb{Z}/n\mathbb{Z})^*$ Compute $C’ = C (r^e) \bmod n$ Submit $C’$ as a chosen ...
Cryme Tyme's user avatar
4 votes
1 answer
4k views

RSA Blind Signature Attack

In Information Security Class I learned a non-adaptive chosen ciphertext attack using "blinding" but I just can't follow the proof and therefore can't reconstruct it. From what I've found out, it ...
Juergen's user avatar
  • 143
7 votes
1 answer
244 views

The REACT transform and Replayable CCA

Before stating my questions, let us recall the REACT transform [OP01], which enables to construct a CCA-secure hybrid PKE scheme, $\varepsilon'_{pk}$, from an OW-CPA PKE scheme $\varepsilon_{pk}^{asym}...
cygnusv's user avatar
  • 5,002
4 votes
2 answers
2k views

Does CCA security imply authenticated encryption?

Does CCA security imply authenticated encryption?
abdolahS's user avatar
  • 439
13 votes
1 answer
3k views

Can a homomorphic encryption scheme be made CCA2 Secure?

Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure? From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 ...
Misty's user avatar
  • 133
2 votes
1 answer
620 views

Chosen Ciphertext Attack with a theoretical decryption machine

Say we have an encryption algorithm that encrypts data blocks of 128 bits size, and makes them cipher blocks $C = E(P)$ without chaining. Also assume there is a linearity rule for XOR: For every pair ...
Carmageddon's user avatar
2 votes
1 answer
108 views

Do Chosen-Chiphertext attacks only apply to public-key cryptosystems?

Do Chosen-Chiphertext attacks (CCA-1/2) only apply to public-key Cryptosystem?
user13076's user avatar
13 votes
1 answer
5k views

Why do we encrypt-then-mac but sign-then-encrypt?

This question was asked in comments on my answer to Should we MAC-then-encrypt or encrypt-then-MAC? I think posing the question as a separate entity is best, so: The general advice for applying MACs ...
user avatar
5 votes
1 answer
1k views

Security proof of FO(Fujisaki-Okamoto) hybrid encryption

The proof of FO hybrid encryption is hard to understand. $\:$ Especially, how does the challenger respond to the decryption queries when the challenger can only have some encryption queries?
Jiangtao LI's user avatar
2 votes
1 answer
887 views

Semantic Security Active or Passive attacks?

I'm reading A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack and here define Semantic Security ... Semantic security, dened by Goldwasser and Micali [14]...
juaninf's user avatar
  • 2,711
17 votes
1 answer
19k views

The difference between these 4 breaking Cipher techniques?

I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ...
Scarl's user avatar
  • 445
1 vote
1 answer
192 views

Is OCB with short MAC malleable?

At the beginning of OCB's white paper [pdf], OCB is compared to other modes, and non-malleability is one of the properties advertised. At the end of the paper, it is mentioned the MAC length can be ...
Kai Elvin's user avatar
77 votes
1 answer
62k views

Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?

I've studied that the Bleichenbacher's CCA attack on PKCS#1 v1.5. is a base to many versions of attacks in the area. I'm trying to understand that attack, but every explanation I saw starts with the ...
Bush's user avatar
  • 2,140
3 votes
1 answer
322 views

What is a Message Transmission Scheme?

I've been given as an exercise to show an encryption scheme that is CCA-secure but is not a secure message transmission scheme. What is a message transmission scheme, and how does it differ from a ...
Bush's user avatar
  • 2,140
2 votes
1 answer
266 views

hybrid PKE scheme CCA2 insecurity

I'm reading "An Efficient CCA2-Secure Variant of the McEliece Cryptosystem in the standard model" by Rastaghi which states: As we know, in hybrid PKE schemes XOR alone cannot perfectly hide ...
juaninf's user avatar
  • 2,711
10 votes
1 answer
2k views

AES-CTR mode and the Biclique Attack

The biclique attacks that break AES (Biclique Cryptanalysis of the full AES) appear to require decryption oracles to work, presumably because the key schedule of AES is weaker in the decryption ...
J.D.'s user avatar
  • 4,455
3 votes
0 answers
209 views

partial-domain permutation and strong assumption

Quoting "Verified Security of Redundancy-Free Encryption from Rabin and RSA", Chapter 2 (on page 4): OAEP was proved IND-CCA-secure by Fujisaki et al. [28] under the assumption that the underlying ...
habillqabill's user avatar