2022 Developer Survey is open! Take survey.

Questions tagged [chosen-plaintext-attack]

The attacker can specify his own plain text and encrypt or sign it.

Filter by
Sorted by
Tagged with
1 vote
0 answers
91 views

Show that block cipher with CTR is a good PRNG

Assume that block cipher scheme $(KeyGen, Enc, Dec)$ is CPA-secure. Show that $CTR_{Enc_k(0^n)}$ is a good PRNG. Counter mode works as follows: $Y_i = Enc_k(IV + f(i))$ $C_i = Y_i \bigoplus P_i = Y_i \...
user avatar
  • 123
0 votes
0 answers
15 views

BB - IBE and the BDDH assumption

Given the BB-IBE scheme how can changing the hash fnc. result in the scheme no longer being IND-SID-CPA secure?
user avatar
  • 35
0 votes
1 answer
45 views

Do attackers need to know what ciphers are being used when conducting ciphertext-only, known plaintext, chosen plaintext, and chosen ciphertext attack

I am trying to understand the basic ingredients needed to conduct various types of cryptanalytical attacks. For instance, I understand that for Ciphertext-Only Attacks (COA) an attacker only has ...
user avatar
  • 3
0 votes
1 answer
36 views

Adversaries knowledge of the encryption algorithms internal workings in CPA

If I want to prove that an encryption algorithm is CPA secure (or that it isn't), then how much am I allowed to assume the attacker to know about the internal workings of the algorithm? Do I need to ...
user avatar
  • 1
1 vote
1 answer
29 views

OFB mode discussion

In OFB mode, I understand that a bit flip in $c_i$ for $i > 0$ only causes a bit flip in message block $m_i$. However, how is it possible for a bit flip in $c_0$ (i.e, in IV) will result in all the ...
user avatar
  • 13
2 votes
1 answer
100 views

The essential differences between IND-CCA1 and IND-CCA2?

For some encryption scheme $(\mathcal{E}, \mathcal{D})$: In the definition of IND-CCA, the adversary $\mathcal{A}$ can access the decryption oracle $\mathcal{D}$. The deep reason of this setting is to ...
user avatar
  • 115
0 votes
1 answer
50 views

Is it possible to perform CPA attack against CBC changing IV by last ciphertext block?

I was trying to do a simple CPA attack against this scheme, to understand better the concept. Instead of using a new 𝐼𝑉 each time, we decide to use the last block of the previous ciphertext as an ...
user avatar
0 votes
0 answers
73 views

Breaking an SPN Cipher where the permutation is just the identity permutation

I've had this problem that I've been trying to figure out for a while. Can a SPN cipher be broken by a chosen-plain text attack if the permutation for the SPN is just the identity permutation? For ...
user avatar
0 votes
2 answers
131 views

How can we measure the security levels of post-quantum cryptographic algorithms? Is there a standard way of this measurement?

How do we measure the security levels of Post Quantum Cryptographic algorithms such as: NTRU Prime, Saber, Kyber,...that are submited to NIST PQC Standardization Process(Competition) in general? I ...
user avatar
  • 859
2 votes
1 answer
60 views

Does Enc and Dec need to be a pseudo-random function for a scheme to be CPA secure?

I am currently going through past finals' questions as exercises for my exam and there are no solutions provided. The question I am currently doing is: Let ∏ = (Enc, Dec, Gen) be a CPA-secure ...
user avatar
1 vote
1 answer
158 views

Prove CPA security [closed]

Assume $(Gen, Enc, Dec)$ is a public-key encryption scheme with message space M that is CPA-secure. Prove that the encryption scheme $(Gen^2, Enc^2, Dec^2)$ is CPA-secure. $Gen^2=(pk_0, sk_0) \...
user avatar
2 votes
0 answers
80 views

What would be an O(n) time adversary for this kind of scheme

Suppose we have a block cipher $$E:\{0,1\}^k \text{ x } \{0,1\}^{2k} \rightarrow \{0,1\}^{2n} \quad \text{ with } \quad k,n\geq128$$ K is the key generation algorithm that returns a random k-bit key. ...
user avatar
0 votes
1 answer
99 views

Possible for a different key to decrypt properly?

I am thinking about CPA-security for symmetric encryption. So $A$ gets access to an encryption oracle, and it can keep asking queries (training phase). In this training phase, he asks $m_i$ and ...
user avatar
0 votes
1 answer
42 views

Does CPA model the challenge plaintext are the same

For a CPA-secure encryption scheme, suppose that there is an adversary who can find that the two ciphertexts are encrypted from the same plaintext. Is this encryption scheme still CPA secure? Or, CPA ...
user avatar
2 votes
1 answer
128 views

Can CPA secure scheme be converted to CCA secure?

I would like to know if there are some methods or techniques that can convert a public key encryption scheme from CPA secure to CCA secure?
user avatar
  • 75
0 votes
0 answers
52 views

How Differential Cryptanalysis of DES work?

I have been studying the DC of DES. As a beginner, I completed the general structure of DES and began DC. I understand the idea of attack, how to find different characteristics for differential ...
user avatar
  • 1
4 votes
1 answer
252 views

CPA Security vs Multiple Message Secrecy

In chapter 3 of Katz Textbook, there is a theorem which states as follows: "Any private key encryption scheme that is CPA-secure is also CPA-secure for multiple encryptions." I can make ...
user avatar
0 votes
0 answers
74 views

Private key encryption that is not CPA secure

I've been learning about different types of encryption schemes in class and I was wondering if it's possible to create a private-key encryption scheme that is multi-message secure but is NOT CPA-...
user avatar
0 votes
0 answers
39 views

LR Oracle for CPA Security for Multiple Encryption

How does LR Oracle model help achieve the CPA security for Multiple Encryption. I am not able to understand how LR oracle model gives an advantage over the normal encryption oracle.(Reference to ...
user avatar
1 vote
0 answers
116 views

Vulnerability in DES3 when key can be chosen

In the question there are two functions encrypt basically does IV ⨁ DES3(P⨁IV) and encrypt_flag just encrypts the flag after being padded into a multiple of 8. IV is a random 8 byte number which is ...
user avatar
0 votes
0 answers
123 views

Simple XOR cipher with pseudo random plain text of arbitrary length

We all know that simple repeated XOR cipher over plaintext is trivially vulnerable to known plaintext attack, even when just a part of plain text is known and even to ciphertext only attack if you ...
user avatar
2 votes
1 answer
37 views

Relationship among secrecy-constant, key space and message space

Here scheme $\Pi$ is $\epsilon $ - perfectly secret. Given that encryption scheme $\Pi$ = $(\mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec})$ over $(\mathcal K,\mathcal M,\mathcal C)$ is called $\epsilon $ -...
user avatar
1 vote
3 answers
368 views

Is collision resistant hash enough for one-block counter mode?

Let $H:\{0,1\}^*\rightarrow \{0,1\}^\ell$ be a collision resistant hash function (CRH), and let $\Pi = (\mathsf{enc,dec})$ be an encryption scheme with the following properties: $\Pi.\mathsf{enc}: \...
user avatar
  • 413
4 votes
1 answer
140 views

Is there any correlation in between two AES with a key differ only by one bit? (ECB mode)

Given two AES (128bit, ECB mode) with almost equal keys $k_1,k_2$: 127 of the 128 key bits are equal. Is there any correlation in between the ciphers they build? $$AES_1(m_i) = c_i$$ $$AES_2(m_i) = ...
user avatar
  • 879
2 votes
2 answers
227 views

Question on the CPA-security proof of the CTR-Mode

While reading Katz & Lindell's textbook (2nd edition) I found a proof for the CPA-Security of CTR-Mode. It can be found at the end of chapter 3.6.2 (page 93 and 94). I don't quite understand, why ...
user avatar
  • 1,482
0 votes
0 answers
54 views

Encryption scheme for a single bit CPA secure

I would love to get help figuring out how to prove the following theorem: If there is an Encryption scheme for a single bit CPA secure then an Encryption scheme can be created along with a variable of ...
user avatar
0 votes
0 answers
103 views

Guarding against vulnerabilities for a digital signature service (RSA )

Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload. What are the possible attacks that I would need to guard against in this context (primarily assuming ...
user avatar
3 votes
4 answers
466 views

If pseudorandom functions (PRFs) are deterministic in nature, how can encryption schemes using PRF be CPA secure?

I am new to crytography. Can anybody tell me what I might be missing here?
user avatar
  • 31
0 votes
1 answer
193 views

Attacks on the RawCBC-MAC if the final step of encrypting with a second key isn't done

This is from Boneh's lecture ECBC-MAC Here is also a link to the lecture itself - https://www.coursera.org/learn/crypto/lecture/QYT6i/cbc-mac-and-nmac CBC-MAC with $(K_1, K_2)$ on a message $M$ ...
user avatar
  • 1,678
5 votes
1 answer
178 views

Is there a relation between passive/active attacks and IND-CPA/IND-CCA?

I've seen some papers drawing a connection between IND-CPA and passive attacks and IND-CCA and active attacks. Can someone explain how IND-CPA relates to passive attacks and IND-CCA relates to active ...
user avatar
  • 411
2 votes
1 answer
228 views

Can a CCA-secure cryptosystem be used as a CMA-secure MAC?

Can every CCA-secure cryptosystem be used as a CMA-secure MAC? I know that every CCA-secure system is CPA-secure, but I'm not sure about CMA. From what I understand: for a system to be CCA-secure, it ...
user avatar
  • 321
1 vote
1 answer
116 views

AES 5 and 6 round SQUARE Attack

SQUARE attack on AES128 requires a single delta set for 4-round variant, or I assume single delta set is enough since keyspace is reduced to few keys which can be easily brute-forced. However, as we ...
user avatar
0 votes
1 answer
132 views

Chosen Cipher Text Security for Double Encryption

If $E_k$ is a CCA secure encryption scheme then why is $E′_{(k_1,k_2)}(M)=E_{k_2}(E_{k_1}(M))$, $D′_{(k_1,k_2)}(C)=D_{k_1}(D_{k_2}(C))$ not CCA secure when $k_2$ is known. Is there a way I can make a ...
user avatar
  • 321
2 votes
1 answer
504 views

Which attacker model is weaker? IND-CPA or OW-CCA?

I know that IND-CPA is a security goal, which is defined as the inability of an attacker to distinguish two ciphertext of some arbitrary chosen plaintexts. Unfortunately i havent found a good ...
user avatar
1 vote
1 answer
399 views

In CPA, how does one-message security implies multi-message security?

I am learning modern cryptography and recently we reached the CPA mechanism. In CPA game setting, A sends two messages to C and then C randomly chooses one message and encrypts it and sent the ...
user avatar
3 votes
2 answers
240 views

What is the advantage of adversary if the random number repeats?

In proof of CPA-security of encryption scheme $(r, F_k(r)\oplus m )$ where: $F_k$ is a keyed function $r\in_R\{0,1\}^n$ is a random number, on page 85 of Introduction to modern cryptography we have ...
user avatar
  • 151
0 votes
1 answer
132 views

Figure out chosen-plaintext-attack in Zerologon attack

Actually, I'm reading the description about Zerologon attack from the original whitepaper document. In there, Tom Tervoort mention these sentences: "So I tried to come up with some chosen-...
user avatar
  • 1
1 vote
2 answers
177 views

Proving security of $\Pi' = E_k(E_k(m))$ knowing $\Pi = E_k(m)$ is secure

I recently started studying cryptography but I am not sure I quite understand the concept of proof by reduction. Question I am trying to solve is as follow: Suppose $\Pi$ is a symmetric encryption ...
user avatar
  • 35
3 votes
1 answer
466 views

Question about IND-CPA with block cipher mode with random IV (CTR$ mutation)

I know for a fact that CTR random is IND-CPA secure due to if an adversary want to break it, it will have to run a long loop where the $$\mathit{Adv}^{ind-cpa}_{CTR~random} = C(2^{n},q) - 0$$ However, ...
user avatar
1 vote
1 answer
87 views

How to calculate CPA attack complexity in bits manipulation

The following Forward Errors Correcting FEC is used in our daily devices. But I added a potential security measure. In one of FEC systems the input is $K$ bits and the output code is $M$ bits where $M=...
user avatar
  • 35
2 votes
2 answers
276 views

Is this permutation secure?

Let vector ${\bf d} \in \{ \pm 1 \}^n$ be the message we want to send. In my system, ${\bf d}$ is multiplied by an $n \times n$ Fourier matrix ${\bf F}$, as follows $$ {\bf x} = {\bf F} {\bf d} $$ ...
user avatar
  • 35
1 vote
1 answer
99 views

Is Computational Indistinguishability quantifiable?

Is Computational Indistinguishability quantifiable? I know that the success probability should be negligible, which however seems to be somewhat ambiguous. Is it possible (and usual) to say that given ...
user avatar
1 vote
2 answers
409 views

Adversary for attack on one variant of ElGamal

I came by the following question: Consider the following variant of ElGamal encryption. Let $p= 2q+ 1$, let $G$ be the group of squares modulo $p$ so $G$ is a subgroup of $Z_p^*$ of order $q$, and ...
user avatar
  • 31
0 votes
1 answer
140 views

How to find m so that RSA cipher end with '\x00'+SpesificString , if we freely input the plaintext?

I have an RSA encryption with public key $(3,n)$ with 2048 bits modulus $n$. I want to find the value of the plaintext $m$ so that the ciphertext (in bytes representation) value ends with ...
user avatar
0 votes
2 answers
78 views

would this be classed as a cipher text attack?

Say i'm given a cipher text to decrypt, however i also have access to a server that performed the encryption; where i could enter any plaintext and observe the result of encryption. would it be ...
user avatar
10 votes
4 answers
748 views

One round of AES-128

Maybe it’s a silly question, I’m interested in the best known/chosen plaintext attack on only one round of AES-128. More specifically, what is the smallest number of known/chosen plaintext/ciphertext ...
user avatar
  • 305
2 votes
1 answer
502 views

How to prove that a encryption scheme is not IND-CPA secure

I am trying to construct a proof that a scheme is not CPA-secure. In IND-CPA experiment, can the adversary generate a key(that may not be real secret key) and compute Enc(key, message)? Does the ...
user avatar
0 votes
0 answers
93 views

How can I show, that RSA with OWP is IND-CPA secure by using H function?

How can I show, that RSA with OWP is IND-CPA secure by using H function , a random oracle model. The Encryption goes like: $\text{Encryption_H_PK}(M)\gets(C_1,C_2)\gets(f(x),H(x)\oplus M)$ ...
user avatar
  • 111
0 votes
1 answer
136 views

Is the hash-based commitment IND-CPA?

As we know the well-known hash-based commitment is as follows: Prover: given a message $m$, it: (1) picks a fresh random value $r$ (2) computes $H(r||m)=c$. Verifier: given $c$ and the commitment ...
user avatar
  • 422
2 votes
1 answer
175 views

Proofs that NM-CPA implies IND-Cpa and $\text{IND-CCA} \leftrightarrow \text{NM-CCA}$

I am looking for a proof for the following two claims from "Serious Cryptography" by Aumasson. NM-CPA implies IND-CPA. [...] IND-CCA and NM-CCA are equivalent notions that imply the presence of the ...
user avatar

1
2 3 4 5 6