Questions tagged [chosen-plaintext-attack]

The attacker can specify his own plain text and encrypt or sign it.

Filter by
Sorted by
Tagged with
2
votes
1answer
67 views

Can CPA secure scheme be converted to CCA secure?

I would like to know if there are some methods or techniques that can convert a public key encryption scheme from CPA secure to CCA secure?
0
votes
0answers
33 views

How Differential Cryptanalysis of DES work?

I have been studying the DC of DES. As a beginner, I completed the general structure of DES and began DC. I understand the idea of attack, how to find different characteristics for differential ...
4
votes
1answer
174 views

CPA Security vs Multiple Message Secrecy

In chapter 3 of Katz Textbook, there is a theorem which states as follows: "Any private key encryption scheme that is CPA-secure is also CPA-secure for multiple encryptions." I can make ...
0
votes
0answers
53 views

Private key encryption that is not CPA secure

I've been learning about different types of encryption schemes in class and I was wondering if it's possible to create a private-key encryption scheme that is multi-message secure but is NOT CPA-...
0
votes
0answers
15 views

LR Oracle for CPA Security for Multiple Encryption

How does LR Oracle model help achieve the CPA security for Multiple Encryption. I am not able to understand how LR oracle model gives an advantage over the normal encryption oracle.(Reference to ...
1
vote
0answers
85 views

Vulnerability in DES3 when key can be chosen

In the question there are two functions encrypt basically does IV ⨁ DES3(P⨁IV) and encrypt_flag just encrypts the flag after being padded into a multiple of 8. IV is a random 8 byte number which is ...
0
votes
0answers
64 views

Simple XOR cipher with pseudo random plain text of arbitrary length

We all know that simple repeated XOR cipher over plaintext is trivially vulnerable to known plaintext attack, even when just a part of plain text is known and even to ciphertext only attack if you ...
0
votes
0answers
27 views

Does IND-CPA to INC-CCA effects on the error probability?

If we have a key encapsulation mechanism (KEM) that is IND-CPA secure, with some error probability $P_e$ (probability that the shared keys are not equal). The goal is to use the Fujisaki-Okamoto ...
2
votes
1answer
33 views

Relationship among secrecy-constant, key space and message space

Here scheme $\Pi$ is $\epsilon $ - perfectly secret. Given that encryption scheme $\Pi$ = $(\mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec})$ over $(\mathcal K,\mathcal M,\mathcal C)$ is called $\epsilon $ -...
1
vote
3answers
321 views

Is collision resistant hash enough for one-block counter mode?

Let $H:\{0,1\}^*\rightarrow \{0,1\}^\ell$ be a collision resistant hash function (CRH), and let $\Pi = (\mathsf{enc,dec})$ be an encryption scheme with the following properties: $\Pi.\mathsf{enc}: \...
4
votes
1answer
118 views

Is there any correlation in between two AES with a key differ only by one bit? (ECB mode)

Given two AES (128bit, ECB mode) with almost equal keys $k_1,k_2$: 127 of the 128 key bits are equal. Is there any correlation in between the ciphers they build? $$AES_1(m_i) = c_i$$ $$AES_2(m_i) = ...
2
votes
2answers
86 views

Question on the CPA-security proof of the CTR-Mode

While reading Katz & Lindell's textbook (2nd edition) I found a proof for the CPA-Security of CTR-Mode. It can be found at the end of chapter 3.6.2 (page 93 and 94). I don't quite understand, why ...
0
votes
0answers
40 views

Encryption scheme for a single bit CPA secure

I would love to get help figuring out how to prove the following theorem: If there is an Encryption scheme for a single bit CPA secure then an Encryption scheme can be created along with a variable of ...
0
votes
0answers
69 views

Guarding against vulnerabilities for a digital signature service (RSA )

Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload. What are the possible attacks that I would need to guard against in this context (primarily assuming ...
3
votes
4answers
203 views

If pseudorandom functions (PRFs) are deterministic in nature, how can encryption schemes using PRF be CPA secure?

I am new to crytography. Can anybody tell me what I might be missing here?
0
votes
1answer
60 views

Attacks on the RawCBC-MAC if the final step of encrypting with a second key isn't done

This is from Boneh's lecture ECBC-MAC Here is also a link to the lecture itself - https://www.coursera.org/learn/crypto/lecture/QYT6i/cbc-mac-and-nmac CBC-MAC with $(K_1, K_2)$ on a message $M$ ...
5
votes
1answer
114 views

Is there a relation between passive/active attacks and IND-CPA/IND-CCA?

I've seen some papers drawing a connection between IND-CPA and passive attacks and IND-CCA and active attacks. Can someone explain how IND-CPA relates to passive attacks and IND-CCA relates to active ...
3
votes
1answer
136 views

Can a CCA-secure cryptosystem be used as a CMA-secure MAC?

Can every CCA-secure cryptosystem be used as a CMA-secure MAC? I know that every CCA-secure system is CPA-secure, but I'm not sure about CMA. From what I understand: for a system to be CCA-secure, it ...
1
vote
1answer
67 views

AES 5 and 6 round SQUARE Attack

SQUARE attack on AES128 requires a single delta set for 4-round variant, or I assume single delta set is enough since keyspace is reduced to few keys which can be easily brute-forced. However, as we ...
0
votes
1answer
90 views

Chosen Cipher Text Security for Double Encryption

If $E_k$ is a CCA secure encryption scheme then why is $E′_{(k_1,k_2)}(M)=E_{k_2}(E_{k_1}(M))$, $D′_{(k_1,k_2)}(C)=D_{k_1}(D_{k_2}(C))$ not CCA secure when $k_2$ is known. Is there a way I can make a ...
2
votes
1answer
173 views

Which attacker model is weaker? IND-CPA or OW-CCA?

I know that IND-CPA is a security goal, which is defined as the inability of an attacker to distinguish two ciphertext of some arbitrary chosen plaintexts. Unfortunately i havent found a good ...
1
vote
1answer
193 views

In CPA, how does one-message security implies multi-message security?

I am learning modern cryptography and recently we reached the CPA mechanism. In CPA game setting, A sends two messages to C and then C randomly chooses one message and encrypts it and sent the ...
3
votes
2answers
190 views

What is the advantage of adversary if the random number repeats?

In proof of CPA-security of encryption scheme $(r, F_k(r)\oplus m )$ where: $F_k$ is a keyed function $r\in_R\{0,1\}^n$ is a random number, on page 85 of Introduction to modern cryptography we have ...
0
votes
1answer
88 views

Figure out chosen-plaintext-attack in Zerologon attack

Actually, I'm reading the description about Zerologon attack from the original whitepaper document. In there, Tom Tervoort mention these sentences: "So I tried to come up with some chosen-...
1
vote
2answers
133 views

Proving security of $\Pi' = E_k(E_k(m))$ knowing $\Pi = E_k(m)$ is secure

I recently started studying cryptography but I am not sure I quite understand the concept of proof by reduction. Question I am trying to solve is as follow: Suppose $\Pi$ is a symmetric encryption ...
3
votes
1answer
273 views

Question about IND-CPA with block cipher mode with random IV (CTR$ mutation)

I know for a fact that CTR random is IND-CPA secure due to if an adversary want to break it, it will have to run a long loop where the $$\mathit{Adv}^{ind-cpa}_{CTR~random} = C(2^{n},q) - 0$$ However, ...
1
vote
1answer
68 views

How to calculate CPA attack complexity in bits manipulation

The following Forward Errors Correcting FEC is used in our daily devices. But I added a potential security measure. In one of FEC systems the input is $K$ bits and the output code is $M$ bits where $M=...
2
votes
2answers
254 views

Is this permutation secure?

Let vector ${\bf d} \in \{ \pm 1 \}^n$ be the message we want to send. In my system, ${\bf d}$ is multiplied by an $n \times n$ Fourier matrix ${\bf F}$, as follows $$ {\bf x} = {\bf F} {\bf d} $$ ...
1
vote
1answer
88 views

Is Computational Indistinguishability quantifiable?

Is Computational Indistinguishability quantifiable? I know that the success probability should be negligible, which however seems to be somewhat ambiguous. Is it possible (and usual) to say that given ...
1
vote
2answers
279 views

Adversary for attack on one variant of ElGamal

I came by the following question: Consider the following variant of ElGamal encryption. Let $p= 2q+ 1$, let $G$ be the group of squares modulo $p$ so $G$ is a subgroup of $Z_p^*$ of order $q$, and ...
0
votes
1answer
90 views

How to find m so that RSA cipher end with '\x00'+SpesificString , if we freely input the plaintext?

I have an RSA encryption with public key $(3,n)$ with 2048 bits modulus $n$. I want to find the value of the plaintext $m$ so that the ciphertext (in bytes representation) value ends with ...
0
votes
2answers
74 views

would this be classed as a cipher text attack?

Say i'm given a cipher text to decrypt, however i also have access to a server that performed the encryption; where i could enter any plaintext and observe the result of encryption. would it be ...
9
votes
4answers
473 views

One round of AES-128

Maybe it’s a silly question, I’m interested in the best known/chosen plaintext attack on only one round of AES-128. More specifically, what is the smallest number of known/chosen plaintext/ciphertext ...
2
votes
1answer
268 views

How to prove that a encryption scheme is not IND-CPA secure

I am trying to construct a proof that a scheme is not CPA-secure. In IND-CPA experiment, can the adversary generate a key(that may not be real secret key) and compute Enc(key, message)? Does the ...
0
votes
0answers
71 views

How can I show, that RSA with OWP is IND-CPA secure by using H function?

How can I show, that RSA with OWP is IND-CPA secure by using H function , a random oracle model. The Encryption goes like: $\text{Encryption_H_PK}(M)\gets(C_1,C_2)\gets(f(x),H(x)\oplus M)$ ...
0
votes
1answer
89 views

Is the hash-based commitment IND-CPA?

As we know the well-known hash-based commitment is as follows: Prover: given a message $m$, it: (1) picks a fresh random value $r$ (2) computes $H(r||m)=c$. Verifier: given $c$ and the commitment ...
2
votes
1answer
114 views

Proofs that NM-CPA implies IND-Cpa and $\text{IND-CCA} \leftrightarrow \text{NM-CCA}$

I am looking for a proof for the following two claims from "Serious Cryptography" by Aumasson. NM-CPA implies IND-CPA. [...] IND-CCA and NM-CCA are equivalent notions that imply the presence of the ...
1
vote
2answers
292 views

Chosen plain-text Attack on DES-X with roughly $2^{64}$ DES operations

Here is the quote from P. Rogaway,The security of DESX "the effective key length of DESX with respect to key search is at least 55 + 63 - lg(m) bits" where m is the number of chosen plaintext/...
0
votes
0answers
164 views

Perfectly secure and indistinguishability property

I'm studying cryptography for my university course, but some doubts arose from reading a book. In this book the author says: "Now we present another equivalent definition of perfect secrecy. This is ...
4
votes
1answer
220 views

How can I prove that ElGamal encryption in $\mathbb{Z}_p^*$ with OAEP padding is ind-CPA secure?

How I can prove that ElGamal encryption in $\mathbb{Z}_p^*$ with Optimal Asymmetric Encryption Padding (OAEP) is IND-CPA secure?
0
votes
0answers
36 views

How to prove IND-CPA on a cipher [duplicate]

I came across an exercise "custom" block cipher which looks like a counter mode implementation, but it is not exactly it. I want to check if this scheme is IND-CPA secure. Here is a picture of the ...
1
vote
1answer
152 views

IND-CPA security of mode of operation using triple AES with plaintext || IV+counter

I have found this figure of a mode of operation using a triple AES with m||IV+ctr input: I suppose it's a custom mode of operation since I haven't seen it anywhere else. My question is if it is IND-...
0
votes
0answers
128 views

Define a Decryption algorithm on a given group-based Cramer Shoup lite scheme

I am currently working on public key encryption schemes and I want some help to figure out how decryption algorithms work. Suppose we have a public key $pk = (G,p,g,e)$ with $e \in Z^*_p$ . (where $G$ ...
1
vote
0answers
27 views

IND-CPA for permutation based encryption

My encryption function is some permutation using a permutation key. An input to the encryption function is encoding of my plain text where one plaintext is mapped to many encodings. Can we prove ...
4
votes
0answers
227 views

Security properties of ElGamal encryption variants

I'll use Taher ElGamal's A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms (July 1985 in IEEE Transactions on Information Theory, formerly in proceedings of Crypto 1984) as ...
6
votes
2answers
291 views

Is non-adaptive CPA strictly weaker than standard CPA security?

Today during a cryptography lecture an interesting question came up: Whether non-adaptive CPA security is equivalent to adaptive (FtG / LOR) CPA security. Now for a short description of what this ...
0
votes
1answer
70 views

Security of key bits under indistinguishability for randomized encryption

My question is about symmetric randomized encryption. Let c=E(k,m,r) be a randomized block encryption function where r denotes a random input chosen for each message block m. k and c denote the ...
3
votes
1answer
69 views

Is it possible to sample HE ciphertexts using pseudo-random generator?

I'm trying to sample HE ciphertexts which serve as ciphertexts encrypting some random values. I have realized a example program using Microsoft SEAL, which implements a variant of BFV scheme. ...
0
votes
0answers
285 views

How to prove that ECB mode is not CPA secure?

I am new to cryptography and I do not know how to prove the ECB mode is not chosen plaintext attack (CPA) secure.
5
votes
2answers
940 views

Does AES-ECB with random padding added to each block satisfy IND-CPA?

I present a modified version of AES-ECB. Suppose I want to encrypt the string hello, world. this is a test. For each block, I use the first eight bytes as my actual ...

1
2 3 4 5 6