Questions tagged [chosen-plaintext-attack]
The attacker can specify his own plain text and encrypt or sign it.
291
questions
1
vote
0
answers
17
views
Bit flipping attack in hash function for message authentication
In this picture we have a use of a hash function for message authentication.
M is plaintext message. H is hash function. E is encryption block with K symmetric key. || is concatenation of plaintext M ...
- 111
1
vote
0
answers
41
views
How to give a hybrid proof that IND CPA secure implies multiple query IND CPA secure and vice versa? [closed]
For a public-key encryption scheme (Gen,Enc,Dec), the textbook definition of IND-CPA security is the following:
The challenger runs (pk,sk)←Gen and sends pk to the adversary.
The adversary performs ...
- 11
1
vote
1
answer
63
views
How is Crystal Kyber CPA-secure algorithms converted into a CCA-secure algorithm
In Crystal Kyber specification, page no10, there are 3 algorithms namely KYBER.CCAKEM for making the CPA-secure Kyber into CCA-secure one.
Q1: How is the shared key K being generated in KYBER.CCAKEM....
- 33
1
vote
0
answers
70
views
When could CPA work against non-deterministic encryption schemes?
Is there a non-deterministic encryption scheme that is vulnerable to a CPA? I got asked this in an interview and I answered with no but the interviewer said that my answer is wrong. Would somebody ...
- 11
0
votes
0
answers
52
views
Microsoft exchange server data breach relevance to IND-CPA, IND-CCA1, IND-CCA2
I was studying about the Microsoft exchange server data breach attack of 2021 as part of assignment case study. One of the tasks of the assignment it to find its relevance with IND-CPA, IND-CCA1, IND-...
2
votes
2
answers
201
views
Protecting against CPA for AES128/ECB by using padding
I was going to encrypt with AES, But I noticed ECB mode is not safe for CPA.
So I thought about preventing CPA by padding input text to a multiple of 16 bytes.
First, perform custom padding system: ...
- 23
3
votes
0
answers
68
views
Solving DDH from an ElGamal adversary
Suppose an adversary wins IND-CPA against ElGamal,
They're given public key $h=g^x$,
Give a pair of messages $m = [m0,m1]$,
Get back ciphertext $(a,b) = (g^r, g^{xr} \cdot g^{m[b]})$,
from which ...
- 83
5
votes
2
answers
191
views
In a PGP like Application , would compress and encrypt leak information
would compress and encrypt on data comromise security for PGP like application, would it be secure for use in Encrypted Messaging?
I have heard its safe for data at rest encryption , i have heard ...
4
votes
1
answer
154
views
A modern rotor machine, could it be any safe?
I wonder if a rotor machine similar to enigma can be considered secure by today's standards under four conditions:
A rotor machine which consists of 50 rotors picked out of a set of 100.
A rotor ...
1
vote
2
answers
76
views
Showing that CPA encryption schemes cannot preserve the length of a message
I am self studying "A Graduate Course in Applied Cryptography" by Boneh-Shoup. I am stuck on the following problem.
Let $\mathcal{E}$ be be an encryption scheme where messages and ...
1
vote
1
answer
92
views
What schemas are possible for the following encryption algorithms?
I'm trying to practice and to understand possible scenarios and the basics of symmetric encryption schemes. For the scenarios I listed below, I am not 100% sure of scenarios 1 and 3.
A symmetric ...
1
vote
0
answers
88
views
Probability of getting a collision using chosen plaintext attacks
For university I am doing a piece of coursework right now. This question is focusing on CPA and collisions using CPA.
Question:
I have attempted to answer part 3, but am not very confident in the ...
- 77
2
votes
1
answer
543
views
Chosen Plain text attack [closed]
I have a course work for university, the question is:
Consider a symmetric encryption scheme with its encryption operation written as
$$C = E(K, R||P)$$
where $E$ is a block cipher encryption ...
- 77
3
votes
0
answers
71
views
Semantic Security of Modified Textbook/Raw RSA
Here's a modification of the textbook RSA scheme, in an attempt to achieve semantic security.
Key generation: chooses public key $pk = (N,e)$ and secret key $sk = d$ as in any RSA-based encryption ...
- 31
0
votes
1
answer
93
views
Can we force a chosen ciphertext to be decrypted to a chosen plaintext while controlling only $e(=3)$ in RSA? [duplicate]
I have bumped into this challenge from a well known CTF site. I don't want to make a reference to it because I don't want this to be a hint for anyone. And also to avoid giving out the source code of ...
- 826
2
votes
1
answer
333
views
CPA secure to CCA secure encryption
Can we use a MAC to transform a CPA secure encryption scheme into CCA secure one?
- 21
0
votes
0
answers
51
views
CBC Operation with Known IV [duplicate]
I am trying to understand how XOR operation can lead us to know the plaintext if we can predict the iv using the chosen plaintext attack game.
- 151
0
votes
0
answers
110
views
Difference between the eavesdropping and the CPA experiment in the case of multiple messages
while reading Introduction to modern cryptography by Katz and Lindell, I came across these two experiments:
For me, they look like it's the same thing. Can you please explain me the difference? ...
2
votes
1
answer
114
views
what is IV predictable?
What is IV predictable in the CBC mode?
We only need one IV once for CBC mode, does the IV-predictable means we know the initialization vector before we start a CBC mode? Or it means we know each ...
- 23
2
votes
0
answers
84
views
Regev PKE not CPA secure for specific $A$?
I encountered notes stating that, for certain fixed $A$, such as $A \in M_{n\log(q)\times n}$ as follows:
\begin{bmatrix}
1 & 0 & 0 &\dots\\
2 & 0 & 0 &\dots\\
4 & 0 & ...
- 373
0
votes
0
answers
86
views
How shall I imagine the prefix Chosen Plaintext Attack (CPA) on ECB mode in practical terms?
I know quite well how prefix attack works for ECB mode as described in https://www.linkedin.com/pulse/short-note-prefix-chosen-plaintext-attack-cpa-ecb-mode-hannes-salin
Great, but in most situations ...
- 1,477
3
votes
1
answer
703
views
AES with a different implementation of byte substitution step
I have tried to answer this question for quite some time now. But a complete intuitive understanding still eludes me:
suggested a new implementation for AES:
The byte substitution step will be ...
- 31
1
vote
0
answers
36
views
Can the proof only be the stateful?
Let SE be stateful encryption.
Then, it is well known that the oracle for the security proof becomes stateful too. (We only consider the IND-CPA security game.)
On the other hand, assume that E is ...
- 11
0
votes
0
answers
83
views
Is Regev’s public-key encryption with $sk$ chosen from $\{0, 1\}^n$ circular secure under CPA security?
I thought maybe this is true with something like the following reduction (if we assume for contradiction that it is not circular secure):
For $A$ to 'break' CPA security, let $C$ be the 'collaborator' ...
- 373
0
votes
2
answers
69
views
Are there any papers talking about generating the pairs used in differential cryptanalysis or impossible differential Cryptanlysis?
I'm trying to implement impossible differential cryptanalysis on IDEA cipher based on the Miss in the middle attack on IDEA and Khufu paper.
I'm trying to implement the attack on 3.5-Round IDEA and I ...
- 191
1
vote
0
answers
65
views
Is AES with random bitstring IND-CPA?
Let $E:\{0,1\}^{128}\times\{0,1\}^{128}\to\{0,1\}^{128}$ be the AES encryption and $R\gets\{0,1\}^{128}$ uniform random bitstring.
Would $E'(K,P):=R\mathbin\|E(K,P)\mathbin\|E(K,R\oplus P)$ be IND-CPA?...
- 11
0
votes
1
answer
396
views
Security definition for IND-CPA of public key encryption
In the security game between the challenger and the adversary for the security definition of public key encryption, the challenger creates and gives the public key pk to the adversary. The adversary ...
- 113
1
vote
0
answers
115
views
Show that block cipher with CTR is a good PRNG
Assume that block cipher scheme $(KeyGen, Enc, Dec)$ is CPA-secure. Show that $CTR_{Enc_k(0^n)}$ is a good PRNG.
Counter mode works as follows:
$Y_i = Enc_k(IV + f(i))$
$C_i = Y_i \bigoplus P_i = Y_i \...
- 123
0
votes
1
answer
93
views
Do attackers need to know what ciphers are being used when conducting ciphertext-only, known plaintext, chosen plaintext, and chosen ciphertext attack
I am trying to understand the basic ingredients needed to conduct various types of cryptanalytical attacks.
For instance, I understand that for Ciphertext-Only Attacks (COA) an attacker only has ...
- 3
0
votes
1
answer
37
views
Adversaries knowledge of the encryption algorithms internal workings in CPA
If I want to prove that an encryption algorithm is CPA secure (or that it isn't), then how much am I allowed to assume the attacker to know about the internal workings of the algorithm? Do I need to ...
- 1
1
vote
1
answer
219
views
OFB mode discussion
In OFB mode, I understand that a bit flip in $c_i$ for $i > 0$ only causes a bit flip in message block $m_i$. However, how is it possible for a bit flip in $c_0$ (i.e, in IV) will result in all the ...
- 15
3
votes
1
answer
1k
views
The essential differences between IND-CCA1 and IND-CCA2?
For some encryption scheme $(\mathcal{E}, \mathcal{D})$:
In the definition of IND-CCA, the adversary $\mathcal{A}$ can access the decryption oracle $\mathcal{D}$. The deep reason of this setting is to ...
- 125
0
votes
1
answer
108
views
Is it possible to perform CPA attack against CBC changing IV by last ciphertext block?
I was trying to do a simple CPA attack against this scheme, to understand better the concept.
Instead of using a new 𝐼𝑉 each time, we decide to use the last block
of the previous ciphertext as an ...
1
vote
2
answers
275
views
How can we measure the security levels of post-quantum cryptographic algorithms? Is there a standard way of this measurement?
How do we measure the security levels of Post Quantum Cryptographic algorithms such as: NTRU Prime, Saber, Kyber,...that are submited to NIST PQC Standardization Process(Competition) in general?
I ...
- 879
2
votes
1
answer
170
views
Does Enc and Dec need to be a pseudo-random function for a scheme to be CPA secure?
I am currently going through past finals' questions as exercises for my exam and there are no solutions provided.
The question I am currently doing is:
Let ∏ = (Enc, Dec, Gen) be a CPA-secure ...
- 21
1
vote
1
answer
425
views
Prove CPA security [closed]
Assume $(Gen, Enc, Dec)$ is a public-key encryption scheme with message space M that is CPA-secure. Prove that the encryption scheme $(Gen^2, Enc^2, Dec^2)$ is CPA-secure.
$Gen^2=(pk_0, sk_0) \...
- 39
2
votes
0
answers
90
views
What would be an O(n) time adversary for this kind of scheme
Suppose we have a block cipher
$$E:\{0,1\}^k \text{ x } \{0,1\}^{2k} \rightarrow \{0,1\}^{2n} \quad \text{ with } \quad k,n\geq128$$
K is the key generation algorithm that returns a random k-bit key. ...
- 31
0
votes
1
answer
104
views
Possible for a different key to decrypt properly?
I am thinking about CPA-security for symmetric encryption.
So $A$ gets access to an encryption oracle, and it can keep asking queries (training phase). In this training phase, he asks $m_i$ and ...
- 385
0
votes
1
answer
102
views
Does CPA model the challenge plaintext are the same
For a CPA-secure encryption scheme, suppose that there is an adversary who can find that the two ciphertexts are encrypted from the same plaintext.
Is this encryption scheme still CPA secure?
Or, CPA ...
- 103
3
votes
1
answer
268
views
Can CPA secure scheme be converted to CCA secure?
I would like to know if there are some methods or techniques that can convert a public key encryption scheme from CPA secure to CCA secure?
- 85
0
votes
0
answers
75
views
How Differential Cryptanalysis of DES work?
I have been studying the DC of DES. As a beginner, I completed the general structure of DES and began DC. I understand the idea of attack, how to find different characteristics for differential ...
- 1
4
votes
1
answer
448
views
CPA Security vs Multiple Message Secrecy
In chapter 3 of Katz Textbook, there is a theorem which states as follows:
"Any private key encryption scheme that is CPA-secure is also CPA-secure for multiple encryptions."
I can make ...
0
votes
0
answers
149
views
Private key encryption that is not CPA secure
I've been learning about different types of encryption schemes in class and I was wondering if it's possible to create a private-key encryption scheme that is multi-message secure but is NOT CPA-...
1
vote
0
answers
184
views
Vulnerability in DES3 when key can be chosen
In the question there are two functions encrypt basically does IV ⨁ DES3(P⨁IV) and encrypt_flag just encrypts the flag after being padded into a multiple of 8. IV is a random 8 byte number which is ...
- 201
0
votes
0
answers
176
views
Simple XOR cipher with pseudo random plain text of arbitrary length
We all know that simple repeated XOR cipher over plaintext is trivially vulnerable to known plaintext attack, even when just a part of plain text is known and even to ciphertext only attack if you ...
- 561
2
votes
1
answer
53
views
Relationship among secrecy-constant, key space and message space
Here scheme $\Pi$ is $\epsilon $ -
perfectly secret.
Given that encryption scheme $\Pi$ = $(\mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec})$ over $(\mathcal K,\mathcal M,\mathcal C)$ is called $\epsilon $ -...
1
vote
3
answers
404
views
Is collision resistant hash enough for one-block counter mode?
Let $H:\{0,1\}^*\rightarrow \{0,1\}^\ell$ be a collision resistant hash function (CRH), and let $\Pi = (\mathsf{enc,dec})$ be an encryption scheme with the following properties:
$\Pi.\mathsf{enc}: \...
- 413
5
votes
1
answer
164
views
Is there any correlation in between two AES with a key differ only by one bit? (ECB mode)
Given two AES (128bit, ECB mode) with almost equal keys $k_1,k_2$: 127 of the 128 key bits are equal. Is there any correlation in between the ciphers they build?
$$AES_1(m_i) = c_i$$
$$AES_2(m_i) = ...
- 557
2
votes
2
answers
459
views
Question on the CPA-security proof of the CTR-Mode
While reading Katz & Lindell's textbook (2nd edition) I found a proof for the CPA-Security of CTR-Mode. It can be found at the end of chapter 3.6.2 (page 93 and 94). I don't quite understand, why ...
- 2,020
0
votes
0
answers
102
views
Encryption scheme for a single bit CPA secure
I would love to get help figuring out how to prove the following theorem:
If there is an Encryption scheme for a single bit CPA secure then an Encryption scheme can be created along with a variable of ...
- 13