Questions tagged [chosen-plaintext-attack]

The attacker can specify his own plain text and encrypt or sign it.

Filter by
Sorted by
Tagged with
3
votes
0answers
74 views

Is EFS vulnerable to chosen plaintext attack?

I have some backup files encrypted with EFS, but I lost the EFS certificate--thus I am unable to decrypt the files. I understand that EFS uses the user certificate public key to encrypt the symmetric ...
3
votes
1answer
30 views

Is it possible to sample HE ciphertexts using pseudo-random generator?

I'm trying to sample HE ciphertexts which serve as ciphertexts encrypting some random values. I have realized a example program using Microsoft SEAL, which implements a variant of BFV scheme. ...
0
votes
0answers
35 views

How to prove that ECB mode is not CPA secure?

I am new to cryptography and I do not know how to prove the ECB mode is not chosen plaintext attack (CPA) secure.
18
votes
1answer
3k views

What do the signature security abbreviations like EUF-CMA mean?

From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes. The most common ones are the *UF-* ...
5
votes
2answers
666 views

Does AES-ECB with random padding added to each block satisfy IND-CPA?

I present a modified version of AES-ECB. Suppose I want to encrypt the string hello, world. this is a test. For each block, I use the first eight bytes as my actual ...
7
votes
2answers
2k views

Difference left-or-right CPA security, IND-CPA security

I am trying to understand the notion of left-or-right-CPA (LOR-CPA) security for private-key encryption schemes introduced in my lecture. If I understood it correctly so far, the only difference to ...
1
vote
1answer
65 views

How to prove an encryption scheme is not CCA secure

Given the following context below, how does one show or prove the encryption scheme is NOT IND-CCA secure The IND-CPA secure private-key encryption scheme for n-bit messages can be constructed from a ...
36
votes
1answer
15k views

Easy explanation of “IND-” security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
9
votes
5answers
3k views

Is One Time Pad considered Chosen-Plaintext Attack Secure?

If we're considering Chosen-Plaintext Attack setting, then the adversary has access to the Encryption Oracle right, and we know that OTP is only considered secure if we use the key only once. How ...
3
votes
2answers
391 views

Proving that there is no scheme which would be perfectly CPA-secure

A private-key encryption scheme Π = (Gen, Enc, Dec) has perfectly indistinguishable encryptions under a chosen-plaintext attack, if for all probabilistic polynomial-time adversaries A it holds that Pr[...
2
votes
0answers
96 views

Is AES resilient to chosen plaintext with access to related keys (key expansion primitives)?

I'm interested in knowing whether a cryptosystem is broken given access to a few primitives. $\DeclareMathOperator{\KEYEXP}{KEY\_EXP}$ $\DeclareMathOperator{\E}{E}$ Suppose that you have access to an ...
3
votes
2answers
107 views

Attack on security model for RSA-FDH

I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is ...
9
votes
1answer
1k views

AES-CTR mode and the Biclique Attack

The biclique attacks that break AES (Biclique Cryptanalysis of the full AES) appear to require decryption oracles to work, presumably because the key schedule of AES is weaker in the decryption ...
1
vote
1answer
114 views

Basic CPA walkthrough

My professor put this on the slides but gave us very little context. It is meant to be an overview of how it works at a high level. I have a programming background and I get the general idea of ...
6
votes
1answer
174 views

Differences between NewHope-CPA-KEM and NewHope-CCA-KEM

According to the web page for NewHope, an R-LWE post-quantum key encapsulation mechanism (KEM) candidate for standardization, it comes in types that are IND-CPA or IND-CCA secure. I know what CPA and ...
2
votes
1answer
86 views

DES - Weakness in Sbox

In the book "Introduction to Cryptography with Coding Theory ", in the chapter about the Differential Cryptanalysis for Four Rounds for DES algorithm, the authors say: There is a weakness in the ...
1
vote
1answer
277 views

Unforgeable CPA-secure private-key encryption scheme that is not CCA-secure

This is exercise with 4.26 in Katz and Lindell's introduction to cryptography 2nd ed. The question is: Show a CPA-secure private-key encryption scheme that is unforgeable but is not CCA-secure. ...
2
votes
1answer
56 views

How do I prove that an encryption based on a multiplicative cyclic group is IND-CPA?

Consider the following encryption and decryption functions where $\mathbb{Z}_{N}^{*}$ is a cyclic multiplicative group, $g$ is a generator for the group and $F$ is a keyed PRF. $E(m, i, k) = m \times ...
4
votes
3answers
8k views

Chosen plaintext vs Chosen ciphertext

What is the difference between chosen plaintext and chosen ciphertext attack? In both of these adversary has access to paintext-ciphertext pairs.Then where lies the difference?
3
votes
1answer
354 views

Why is counter mode encryption with a 16-byte cipher block not broken?

We determine a system IND-CPA secure when an adversary has a negligible advantage after any feasible amount of queries. AES256-GCM uses a 128bit block cipher. We know that the distinguishability ...
0
votes
1answer
67 views

how to prove that given cryptosystem is not IND-CCA secure?

Let $m$ and $k$ be positive integers ($m$ bit plain text) ; let $Q$ be a family of trapdoor one-way permutations such that $f : \{0,1\}^k \rightarrow \{0,1\}^k$ for all $f$ in $Q$; and let $G : \{0,1\}...
0
votes
0answers
80 views

Formal security-definition reference

Is there a reference where all common formal security-definitions are summarized (such as OW-CPA, IND-CPA, IND-CCA1, IND-CCA2, EUF-CMA and so on)? I need a PUBLISHED reference (paper, book) which ...
3
votes
1answer
766 views

Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?

I presented our mathematician with an idea: If you have a black box that encrypts or decrypts AES with the same 128 bit key (you don't have any direct access to the key), and you control the input ...
7
votes
3answers
1k views

Is it possible to build a CPA-secure encryption scheme which remains secure even when the encryption of secret key is given?

How can I design a CPA-secure encryption scheme which is secure even after the encryption of secret key is given in the training phase? I.e., in the training phase, $\mathit{Enc}_{\mathit{pk}}(\...
1
vote
0answers
380 views

Cryptanalysis affine cipher and substitution cipher

1) Consider the chosen-plaintext attack on the simple substitution cipher. How many chosen plaintext characters suffice to uniquely determine the key? My answer was: 26! 2) Consider the chosen-...
1
vote
0answers
90 views

Patarin’s H-Coefficient Technique

I have come across many paper that applies Patarin’s H-Coefficient Technique in various cryptographic securities (KPA, CPA, CCA,...). I am asking kindly if someone could explain it simple with ...
8
votes
2answers
1k views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
1
vote
0answers
48 views

Proving a scheme's EAV-insecurity

EDIT: The instructor clarified that part (a) was wrong. He declined to indicate why. I can share more details of the prompt if need be. I apologize again if this question is too low-level; it comes ...
1
vote
0answers
48 views

How to figure out this encryption? [closed]

I can provide input to an application that encrypts plaintext via an unknown algorithm, which I would like to reverse. I can obtain plaintext:ciphertext pairs, and the length of the cipher depends on ...
1
vote
0answers
33 views

Proof that secret sharing based scheme is CPA secure as long as one of the scheme is CPA secure

I want to construct a CPA-secure schemes using two given schemes $\prod_1$ and $\prod_2$ if only one of them is CPA secure. Taking suggestions from this answer, I am able construct a scheme as ...
1
vote
1answer
194 views

AES oracle with bad S-box

Say you run in to a messed up AES (128) implementation which has the s-box configured as [0x0, 0x1, ..., 0xFE, 0xFF] and where you can query a few plaintexts to get the corresponding ciphertexts. How ...
1
vote
1answer
85 views

On the probability of a collision in RFO-rCTR

My slides show that assuming a polynomial number $q(n)$ of blocks have been encrypted by a random function oracle in the context of a CPA-game, the probability of having a collision in the input to ...
1
vote
1answer
91 views

Show that CPA-security implies security against plaintext recovery

Consider the following experiment: $k = Gen(1^n)$ $m \stackrel{u}{\in} \{0,1\}^{l(n)}$ $c = Enc_k(m)$ $m' = B(1^n,c)$ Define the winning event as $m' = m$. I would like to show that if the ...
-1
votes
1answer
118 views

What is the difference between Forgery and Chosen-Message Attacks?

I did some researches about forgery attack and chosen-message attack. For me, forgery attacks are more focused on the verifiability whereas chosen-message attacks are similar to brute-force attacks. ...
0
votes
0answers
16 views

Is it necessary to study the KPA security for asymmetric encryption algorithms in addition to CPA security? [duplicate]

In a KPA attack model, an adversary $\mathcal{A}$ has access to pairs of messages $(m_i,c_i)$ which are encrypted using some asymmetric algorithm. However, assuming either El-Gamal or RSA algorithms, ...
1
vote
1answer
98 views

Give a CPA-attack on Elgamal when used with $\mathbb{Z}_p^*$

We know that if the decisional Diffie-Hellmann problem is hard then the Elgamal encryption is CPA-secure. One show that if the chosen group is $\mathbb{Z}_p^*$ then the decisional Diffie-Hellman ...
1
vote
1answer
189 views

Given partial key exposure and encryption oracle, can we recover full AES key?

Suppose I have an encryption oracle for AES with some key $k$ (16 bytes) and that I know $n$ bytes of it. Is it possible to recover the rest ($16 - n$) in complexity less than $256^{16-n}$?
1
vote
0answers
85 views

Indistinguishable encryptions and CPA-secure example

Let $ F $ be a PRF and $ G$ be a PRG with expansion factor $n \to n +1 $ For the following encryption scheme, decide whether it has indistinguishable encryptions and whether it is CPA-secure. ...
1
vote
1answer
101 views

Is the scheme $(r, Mac_k(r) \oplus m)$ CPA-secure?

I honestly admit this question is taken from a h.w assignment: Prove or refute: the following encryption scheme is CPA-secure: Let $(\text{Gen}, \text{Mac}, \text{Vrfy})$ be a secure MAC with tags ...
0
votes
0answers
98 views

Building a CPA-secure sCTR from a PRF

Let $F$ be a PRF with $n = l_{in}(n) = l_{out}(n)$. For any PPT-encoding $[\;\;]:\mathbb{Z}_{2^n} \to \{0,1\}^n$ and any polynomial $l(n)$, $G_l(x) = F_k([1])\|\ldots\|F_k([l(n)])$ is a PRG ...
1
vote
1answer
198 views

CPA-secure of $\Pi$ implies CPA-security of $\Pi||\Pi||\ldots||\Pi$

Katz and Lindell book claim that from the theorem: Any private-key encryption scheme that is CPA-secure is also CPA-secure for multiple encryptions. Follows the fact that: If $(Gen,...
1
vote
3answers
1k views

Chosen Plaintext Attack on DES/AES

PERSON A sends messages to PERSON B using AES, CBC, PKCS5Padding with an IV that is incremented by one after each message. If PERSON Z knows that the first block of the plain-text of any message is ...
5
votes
2answers
183 views

Motivation of Adversarial Indistinguishability Experiment

I had a question about the motivation behind this definition provided in Katz and Lindell's cryptography book. I copied the paragraph in question along with the definition of the experiment. ...
4
votes
0answers
227 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key Encapsulation Mechanism / Data Encapsulation Mechanism) which is used for example by the (famous) ECIES, where the key is the hash ...
0
votes
1answer
156 views

Recovery of private key in AES-CBC from two ciphertexts with different IV, but identical plantext

I have a system that encrypts messages for a given user using key K using AES-CBC in response in an external stimulus. Each message has a randomly generated IV. The user never decodes these messages,...
14
votes
7answers
4k views

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

In CPA, it is said that the adversaries get ciphertext for the choice of plaintext of adversaries through an encryption oracle. Is this a realistic assumption in real-world, in which the adversaries ...
5
votes
2answers
285 views

Security of Randomized Encryption Scheme

I have the following question which I'm struggling with Suppose we are interested in encrypting bit strings. Consider a randomized encryption scheme that always produces ciphertexts of the same ...
2
votes
0answers
66 views

IND-CPA game with a state-dependent Encryption Function that is insecure once

in the context of another setting I was asked the following question. Suppose the IND-CPA game is played with a symmetric encryption function $E$ that keeps a state of how many encryptions have ...
19
votes
1answer
21k views

How does a chosen plaintext attack on RSA work?

How can one run a chosen plaintext attack on RSA? If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
3
votes
1answer
222 views

security against CPA attack?

Let $\mathcal{E} = (E,D)$ be a CPA secure cipher. Let's define $\mathcal{E'} = (E', D')$, where $E'(k,m) = E(k, E(k,m))$. How can I prove that $\mathcal{E'}$ will be CPA secure if $\mathcal{E}$ is? ...