Skip to main content

Questions tagged [chosen-plaintext-attack]

The attacker can specify his own plain text and encrypt or sign it.

Filter by
Sorted by
Tagged with
1 vote
2 answers
76 views

Real-or-Random Security (IND$-CPA) for Homomorphic Encryption?

I am reading papers about homomorphic encryption recently. To my knowledge, all of them opts for the Left-or-Right security i.e. distinguish between $M_0$ and $M_1$ given $\mathcal{E}_K(M_b)$ for $b \...
gan's user avatar
  • 13
1 vote
0 answers
36 views

crack AES CBC with chosen Ciphertext, IV and known plaintext [closed]

I am currently tackling a challenge involving AES CBC encryption where i have the ability to choose both the IV and the ciphertext, and then provide it to a service. The service decrypts with an ...
ucker's user avatar
  • 11
1 vote
0 answers
23 views

Question about Security proof of Gentry's Anonymous IBE

In Gentry's paper 'Practical Identity-Based Encryption without Random Oracles', I have a little difficulties in understanding the security proof part. The paper claims that in Challenge phase, 'ID ...
jhf's user avatar
  • 11
0 votes
2 answers
83 views

About IND-CPA security of Homomorphic Encryption

I am trying to understand IND-CPA security in (Partially) Homomorphic Encryption schemes. However, the result of the proofs is usually something stating that a ciphertext does not expose anything ...
Daniel Morales's user avatar
2 votes
1 answer
110 views

Is semantic security equvalent to IND-CPA?

Is semantic security equivalent to IND-CPA? If a PKE scheme like ElGamal is semantically secure, can we say it is IND-CPA? What's the relationship between semantic security and IND-CPA?
Jeffrey's user avatar
  • 137
1 vote
1 answer
106 views

Intuitive Explanation for why IND-CPA Security does not imply EKRp-CPA (Existential Key Recovery)

In this paper, one of the facts stated was that $\text{IND-CPA} \not\implies \text{EKR}_p$, in which $\text{EKR}_p$ is defined as the property that for a polynomial number accessible of oracles p with ...
chemN00b's user avatar
  • 113
0 votes
0 answers
69 views

How to find modulus and decrypt a message with a CPA on textbook RSA. The encryption oracle only allows two queries

The encryption oracle only allows you to encrypt a custom message $m$ or the secret message $m_s$. In both cases it asks you to choose a public exponent $e>16$. Of course, $n$, is not available. If ...
crypt potato's user avatar
3 votes
1 answer
360 views

Is the secret key kept constant in IND-CPA game?

I read the Wikipedia Page on ciphertext indistinguishability. Here it gives the following outline of the IND-CPA game: The challenger generates a key pair PK, SK based on some security parameter k (e....
Riemann's user avatar
  • 221
2 votes
2 answers
126 views

Hard to guess ciphertext

Is there an encryption scheme where it's hard to guess a valid ciphertext without knowing the key and the scheme is CPA secure?
John_cena's user avatar
1 vote
1 answer
224 views

Are modes like CBC, OFB, CFB subject to chosen plaintext attacks?

I haven't found much info on the internet about the weakness of modes to chosen plaintext attacks, but from what I understand of them, there seem to be some trivial attacks, so I'm a bit confused. For ...
WINTERSDORFF Raphael's user avatar
2 votes
1 answer
117 views

Bit flipping attack in hash function for message authentication

In this picture we have a use of a hash function for message authentication. M is plaintext message. H is hash function. E is encryption block with K symmetric key. || is concatenation of plaintext M ...
Allexj's user avatar
  • 143
1 vote
0 answers
171 views

How to give a hybrid proof that IND CPA secure implies multiple query IND CPA secure and vice versa? [closed]

For a public-key encryption scheme (Gen,Enc,Dec), the textbook definition of IND-CPA security is the following: The challenger runs (pk,sk)←Gen and sends pk to the adversary. The adversary performs ...
user108520's user avatar
1 vote
1 answer
194 views

How is Crystal Kyber CPA-secure algorithms converted into a CCA-secure algorithm

In Crystal Kyber specification, page no10, there are 3 algorithms namely KYBER.CCAKEM for making the CPA-secure Kyber into CCA-secure one. Q1: How is the shared key K being generated in KYBER.CCAKEM....
Sujan SM's user avatar
1 vote
0 answers
84 views

When could CPA work against non-deterministic encryption schemes?

Is there a non-deterministic encryption scheme that is vulnerable to a CPA? I got asked this in an interview and I answered with no but the interviewer said that my answer is wrong. Would somebody ...
mad0x60's user avatar
  • 111
0 votes
0 answers
57 views

Microsoft exchange server data breach relevance to IND-CPA, IND-CCA1, IND-CCA2

I was studying about the Microsoft exchange server data breach attack of 2021 as part of assignment case study. One of the tasks of the assignment it to find its relevance with IND-CPA, IND-CCA1, IND-...
Rohan Padshah's user avatar
2 votes
2 answers
434 views

Protecting against CPA for AES128/ECB by using padding

I was going to encrypt with AES, But I noticed ECB mode is not safe for CPA. So I thought about preventing CPA by padding input text to a multiple of 16 bytes. First, perform custom padding system: ...
kakacar's user avatar
  • 23
3 votes
0 answers
145 views

Solving DDH from an ElGamal adversary

Suppose an adversary wins IND-CPA against ElGamal, They're given public key $h=g^x$, Give a pair of messages $m = [m0,m1]$, Get back ciphertext $(a,b) = (g^r, g^{xr} \cdot g^{m[b]})$, from which ...
bs-'s user avatar
  • 83
5 votes
2 answers
296 views

In a PGP like Application , would compress and encrypt leak information

would compress and encrypt on data comromise security for PGP like application, would it be secure for use in Encrypted Messaging? I have heard its safe for data at rest encryption , i have heard ...
ANISH M 18CS006's user avatar
6 votes
1 answer
278 views

A modern rotor machine, could it be any safe?

I wonder if a rotor machine similar to enigma can be considered secure by today's standards under four conditions: A rotor machine which consists of 50 rotors picked out of a set of 100. A rotor ...
Princeofmillerovo's user avatar
1 vote
2 answers
203 views

Showing that CPA encryption schemes cannot preserve the length of a message

I am self studying "A Graduate Course in Applied Cryptography" by Boneh-Shoup. I am stuck on the following problem. Let $\mathcal{E}$ be be an encryption scheme where messages and ...
cryptolearner's user avatar
1 vote
1 answer
108 views

What schemas are possible for the following encryption algorithms?

I'm trying to practice and to understand possible scenarios and the basics of symmetric encryption schemes. For the scenarios I listed below, I am not 100% sure of scenarios 1 and 3. A symmetric ...
Marian Valentin's user avatar
1 vote
0 answers
150 views

Probability of getting a collision using chosen plaintext attacks

For university I am doing a piece of coursework right now. This question is focusing on CPA and collisions using CPA. Question: I have attempted to answer part 3, but am not very confident in the ...
hasin's user avatar
  • 77
2 votes
1 answer
892 views

Chosen Plain text attack [closed]

I have a course work for university, the question is: Consider a symmetric encryption scheme with its encryption operation written as $$C = E(K, R||P)$$ where $E$ is a block cipher encryption ...
hasin's user avatar
  • 77
3 votes
0 answers
82 views

Semantic Security of Modified Textbook/Raw RSA

Here's a modification of the textbook RSA scheme, in an attempt to achieve semantic security. Key generation: chooses public key $pk = (N,e)$ and secret key $sk = d$ as in any RSA-based encryption ...
user759's user avatar
  • 31
0 votes
1 answer
272 views

Can we force a chosen ciphertext to be decrypted to a chosen plaintext while controlling only $e(=3)$ in RSA? [duplicate]

I have bumped into this challenge from a well known CTF site. I don't want to make a reference to it because I don't want this to be a hint for anyone. And also to avoid giving out the source code of ...
tur11ng's user avatar
  • 962
2 votes
1 answer
487 views

CPA secure to CCA secure encryption

Can we use a MAC to transform a CPA secure encryption scheme into CCA secure one?
user104304's user avatar
0 votes
0 answers
58 views

CBC Operation with Known IV [duplicate]

I am trying to understand how XOR operation can lead us to know the plaintext if we can predict the iv using the chosen plaintext attack game.
CryptoGuru's user avatar
1 vote
0 answers
311 views

Difference between the eavesdropping and the CPA experiment in the case of multiple messages

while reading Introduction to modern cryptography by Katz and Lindell, I came across these two experiments: For me, they look like it's the same thing. Can you please explain me the difference? ...
Souphiane Bensalim's user avatar
2 votes
1 answer
196 views

what is IV predictable?

What is IV predictable in the CBC mode? We only need one IV once for CBC mode, does the IV-predictable means we know the initialization vector before we start a CBC mode? Or it means we know each ...
mike.w's user avatar
  • 23
2 votes
0 answers
126 views

Regev PKE not CPA secure for specific $A$?

I encountered notes stating that, for certain fixed $A$, such as $A \in M_{n\log(q)\times n}$ as follows: \begin{bmatrix} 1 & 0 & 0 &\dots\\ 2 & 0 & 0 &\dots\\ 4 & 0 & ...
Anon's user avatar
  • 403
3 votes
1 answer
774 views

AES with a different implementation of byte substitution step

I have tried to answer this question for quite some time now. But a complete intuitive understanding still eludes me: suggested a new implementation for AES: The byte substitution step will be ...
gabi's user avatar
  • 31
1 vote
0 answers
39 views

Can the proof only be the stateful?

Let SE be stateful encryption. Then, it is well known that the oracle for the security proof becomes stateful too. (We only consider the IND-CPA security game.) On the other hand, assume that E is ...
Newbie's user avatar
  • 11
0 votes
2 answers
76 views

Are there any papers talking about generating the pairs used in differential cryptanalysis or impossible differential Cryptanlysis?

I'm trying to implement impossible differential cryptanalysis on IDEA cipher based on the Miss in the middle attack on IDEA and Khufu paper. I'm trying to implement the attack on 3.5-Round IDEA and I ...
siba36's user avatar
  • 301
1 vote
0 answers
71 views

Is AES with random bitstring IND-CPA?

Let $E:\{0,1\}^{128}\times\{0,1\}^{128}\to\{0,1\}^{128}$ be the AES encryption and $R\gets\{0,1\}^{128}$ uniform random bitstring. Would $E'(K,P):=R\mathbin\|E(K,P)\mathbin\|E(K,R\oplus P)$ be IND-CPA?...
Buzz's user avatar
  • 11
2 votes
1 answer
973 views

Security definition for IND-CPA of public key encryption

In the security game between the challenger and the adversary for the security definition of public key encryption, the challenger creates and gives the public key pk to the adversary. The adversary ...
Noel's user avatar
  • 133
1 vote
0 answers
128 views

Show that block cipher with CTR is a good PRNG

Assume that block cipher scheme $(KeyGen, Enc, Dec)$ is CPA-secure. Show that $CTR_{Enc_k(0^n)}$ is a good PRNG. Counter mode works as follows: $Y_i = Enc_k(IV + f(i))$ $C_i = Y_i \bigoplus P_i = Y_i \...
Awerde's user avatar
  • 123
0 votes
1 answer
125 views

Do attackers need to know what ciphers are being used when conducting ciphertext-only, known plaintext, chosen plaintext, and chosen ciphertext attack

I am trying to understand the basic ingredients needed to conduct various types of cryptanalytical attacks. For instance, I understand that for Ciphertext-Only Attacks (COA) an attacker only has ...
Leviel's user avatar
  • 3
0 votes
1 answer
39 views

Adversaries knowledge of the encryption algorithms internal workings in CPA

If I want to prove that an encryption algorithm is CPA secure (or that it isn't), then how much am I allowed to assume the attacker to know about the internal workings of the algorithm? Do I need to ...
Lari's user avatar
  • 1
1 vote
1 answer
389 views

OFB mode discussion

In OFB mode, I understand that a bit flip in $c_i$ for $i > 0$ only causes a bit flip in message block $m_i$. However, how is it possible for a bit flip in $c_0$ (i.e, in IV) will result in all the ...
Leli's user avatar
  • 13
5 votes
1 answer
2k views

The essential differences between IND-CCA1 and IND-CCA2?

For some encryption scheme $(\mathcal{E}, \mathcal{D})$: In the definition of IND-CCA, the adversary $\mathcal{A}$ can access the decryption oracle $\mathcal{D}$. The deep reason of this setting is to ...
Max1z's user avatar
  • 145
0 votes
1 answer
203 views

Is it possible to perform CPA attack against CBC changing IV by last ciphertext block?

I was trying to do a simple CPA attack against this scheme, to understand better the concept. Instead of using a new 𝐼𝑉 each time, we decide to use the last block of the previous ciphertext as an ...
Aleix Martí's user avatar
1 vote
2 answers
494 views

How can we measure the security levels of post-quantum cryptographic algorithms? Is there a standard way of this measurement?

How do we measure the security levels of Post Quantum Cryptographic algorithms such as: NTRU Prime, Saber, Kyber,...that are submited to NIST PQC Standardization Process(Competition) in general? I ...
esra's user avatar
  • 869
2 votes
1 answer
267 views

Does Enc and Dec need to be a pseudo-random function for a scheme to be CPA secure?

I am currently going through past finals' questions as exercises for my exam and there are no solutions provided. The question I am currently doing is: Let ∏ = (Enc, Dec, Gen) be a CPA-secure ...
paul lacher's user avatar
1 vote
1 answer
656 views

Prove CPA security [closed]

Assume $(Gen, Enc, Dec)$ is a public-key encryption scheme with message space M that is CPA-secure. Prove that the encryption scheme $(Gen^2, Enc^2, Dec^2)$ is CPA-secure. $Gen^2=(pk_0, sk_0) \...
user260541's user avatar
2 votes
0 answers
96 views

What would be an O(n) time adversary for this kind of scheme

Suppose we have a block cipher $$E:\{0,1\}^k \text{ x } \{0,1\}^{2k} \rightarrow \{0,1\}^{2n} \quad \text{ with } \quad k,n\geq128$$ K is the key generation algorithm that returns a random k-bit key. ...
DiegoLopez's user avatar
0 votes
1 answer
108 views

Possible for a different key to decrypt properly?

I am thinking about CPA-security for symmetric encryption. So $A$ gets access to an encryption oracle, and it can keep asking queries (training phase). In this training phase, he asks $m_i$ and ...
eternalmothra's user avatar
0 votes
1 answer
135 views

Does CPA model the challenge plaintext are the same

For a CPA-secure encryption scheme, suppose that there is an adversary who can find that the two ciphertexts are encrypted from the same plaintext. Is this encryption scheme still CPA secure? Or, CPA ...
Zi-Yuan Liu's user avatar
4 votes
1 answer
371 views

Can CPA secure scheme be converted to CCA secure?

I would like to know if there are some methods or techniques that can convert a public key encryption scheme from CPA secure to CCA secure?
Naz's user avatar
  • 95
0 votes
0 answers
122 views

How Differential Cryptanalysis of DES work?

I have been studying the DC of DES. As a beginner, I completed the general structure of DES and began DC. I understand the idea of attack, how to find different characteristics for differential ...
Ekin's user avatar
  • 1
5 votes
1 answer
720 views

CPA Security vs Multiple Message Secrecy

In chapter 3 of Katz Textbook, there is a theorem which states as follows: "Any private key encryption scheme that is CPA-secure is also CPA-secure for multiple encryptions." I can make ...
Crypto_researcher's user avatar

1
2 3 4 5 6