Questions tagged [chosen-plaintext-attack]

The attacker can specify his own plain text and encrypt or sign it.

Filter by
Sorted by
Tagged with
8
votes
2answers
1k views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
1
vote
0answers
90 views

Proving a scheme's EAV-insecurity

EDIT: The instructor clarified that part (a) was wrong. He declined to indicate why. I can share more details of the prompt if need be. I apologize again if this question is too low-level; it comes ...
1
vote
0answers
50 views

How to figure out this encryption? [closed]

I can provide input to an application that encrypts plaintext via an unknown algorithm, which I would like to reverse. I can obtain plaintext:ciphertext pairs, and the length of the cipher depends on ...
1
vote
0answers
58 views

Proof that secret sharing based scheme is CPA secure as long as one of the scheme is CPA secure

I want to construct a CPA-secure schemes using two given schemes $\prod_1$ and $\prod_2$ if only one of them is CPA secure. Taking suggestions from this answer, I am able construct a scheme as ...
1
vote
1answer
315 views

AES oracle with bad S-box

Say you run in to a messed up AES (128) implementation which has the s-box configured as [0x0, 0x1, ..., 0xFE, 0xFF] and where you can query a few plaintexts to get the corresponding ciphertexts. How ...
1
vote
1answer
87 views

On the probability of a collision in RFO-rCTR

My slides show that assuming a polynomial number $q(n)$ of blocks have been encrypted by a random function oracle in the context of a CPA-game, the probability of having a collision in the input to ...
1
vote
1answer
138 views

Show that CPA-security implies security against plaintext recovery

Consider the following experiment: $k = Gen(1^n)$ $m \stackrel{u}{\in} \{0,1\}^{l(n)}$ $c = Enc_k(m)$ $m' = B(1^n,c)$ Define the winning event as $m' = m$. I would like to show that if the ...
-1
votes
1answer
237 views

What is the difference between Forgery and Chosen-Message Attacks?

I did some researches about forgery attack and chosen-message attack. For me, forgery attacks are more focused on the verifiability whereas chosen-message attacks are similar to brute-force attacks. ...
0
votes
0answers
35 views

Is it necessary to study the KPA security for asymmetric encryption algorithms in addition to CPA security? [duplicate]

In a KPA attack model, an adversary $\mathcal{A}$ has access to pairs of messages $(m_i,c_i)$ which are encrypted using some asymmetric algorithm. However, assuming either El-Gamal or RSA algorithms, ...
1
vote
1answer
206 views

Give a CPA-attack on Elgamal when used with $\mathbb{Z}_p^*$

We know that if the decisional Diffie-Hellmann problem is hard then the Elgamal encryption is CPA-secure. One show that if the chosen group is $\mathbb{Z}_p^*$ then the decisional Diffie-Hellman ...
1
vote
1answer
271 views

Given partial key exposure and encryption oracle, can we recover full AES key?

Suppose I have an encryption oracle for AES with some key $k$ (16 bytes) and that I know $n$ bytes of it. Is it possible to recover the rest ($16 - n$) in complexity less than $256^{16-n}$?
1
vote
0answers
139 views

Indistinguishable encryptions and CPA-secure example

Let $ F $ be a PRF and $ G$ be a PRG with expansion factor $n \to n +1 $ For the following encryption scheme, decide whether it has indistinguishable encryptions and whether it is CPA-secure. ...
1
vote
1answer
137 views

Is the scheme $(r, Mac_k(r) \oplus m)$ CPA-secure?

I honestly admit this question is taken from a h.w assignment: Prove or refute: the following encryption scheme is CPA-secure: Let $(\text{Gen}, \text{Mac}, \text{Vrfy})$ be a secure MAC with tags ...
0
votes
0answers
132 views

Building a CPA-secure sCTR from a PRF

Let $F$ be a PRF with $n = l_{in}(n) = l_{out}(n)$. For any PPT-encoding $[\;\;]:\mathbb{Z}_{2^n} \to \{0,1\}^n$ and any polynomial $l(n)$, $G_l(x) = F_k([1])\|\ldots\|F_k([l(n)])$ is a PRG ...
1
vote
1answer
367 views

CPA-secure of $\Pi$ implies CPA-security of $\Pi||\Pi||\ldots||\Pi$

Katz and Lindell book claim that from the theorem: Any private-key encryption scheme that is CPA-secure is also CPA-secure for multiple encryptions. Follows the fact that: If $(Gen,...
1
vote
3answers
2k views

Chosen Plaintext Attack on DES/AES

PERSON A sends messages to PERSON B using AES, CBC, PKCS5Padding with an IV that is incremented by one after each message. If PERSON Z knows that the first block of the plain-text of any message is ...
5
votes
2answers
270 views

Motivation of Adversarial Indistinguishability Experiment

I had a question about the motivation behind this definition provided in Katz and Lindell's cryptography book. I copied the paragraph in question along with the definition of the experiment. ...
4
votes
0answers
236 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key Encapsulation Mechanism / Data Encapsulation Mechanism) which is used for example by the (famous) ECIES, where the key is the hash ...
0
votes
1answer
229 views

Recovery of private key in AES-CBC from two ciphertexts with different IV, but identical plantext

I have a system that encrypts messages for a given user using key K using AES-CBC in response in an external stimulus. Each message has a randomly generated IV. The user never decodes these messages,...
14
votes
7answers
4k views

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

In CPA, it is said that the adversaries get ciphertext for the choice of plaintext of adversaries through an encryption oracle. Is this a realistic assumption in real-world, in which the adversaries ...
2
votes
0answers
81 views

IND-CPA game with a state-dependent Encryption Function that is insecure once

in the context of another setting I was asked the following question. Suppose the IND-CPA game is played with a symmetric encryption function $E$ that keeps a state of how many encryptions have ...
3
votes
1answer
356 views

security against CPA attack?

Let $\mathcal{E} = (E,D)$ be a CPA secure cipher. Let's define $\mathcal{E'} = (E', D')$, where $E'(k,m) = E(k, E(k,m))$. How can I prove that $\mathcal{E'}$ will be CPA secure if $\mathcal{E}$ is? ...
5
votes
1answer
357 views

How to encode messages in $\Bbb Z_p^*$ to be encrypted with ElGamal scheme?

In ElGamal encryption scheme, in order to achieve IND-CPA security, one must use a group where the DDH problem is assumed to be hard. As this answer suggests, one way to achieve that is the following: ...
0
votes
1answer
464 views

Relationship between CCA/CPA-security and PRFs

I'm a bit confused about the relationship between CCA/CPA-security and PRFs and particularly when do we think of encryption and decryption as a PRF. Assume we have an encryption scheme $\Pi = (Enc, ...
1
vote
1answer
103 views

Is there a property comparable to IND-CPA for hash functions taking a random value?

I would like to have a function $F(x, rnd)$, where $rnd$ is a fresh random value, such that it is hard, given $x_0$ and $x_1$, to distinguish $F(x_0, rnd)$ from $F(x_1, rnd)$, EDIT: but the values ...
1
vote
1answer
168 views

Security of OFB mode if PRP is used instead of PRF

In the cryptography lecture at my university, we had the theorem that (randomized) OFB mode is IND-CPA secure if the used pseudorandom function (PRF) is IND-PRF secure. Afterwards, we investigated ...
2
votes
1answer
275 views

Attack on AES-CBC with small pool of IV

Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$. I know that if we can predict next IV with 100% probability there is attack that completely breaks ...
1
vote
1answer
127 views

Does CPA-secure means security against differential cryptanalysis?

I've read on differential cryptanalysis where it traces the differences on the changes of ciphertexts of the same plaintext, except for some bits. However, I wonder is the differential cryptanalysis ...
4
votes
1answer
1k views

Encrypt-and-mac IND-CCA security

I have been stuck all day trying to understand how to show that an Encrypt-and-Mac ($SE_{EaM}$) scheme is not IND-CCA secure. I have seen this similar post, however it is slightly different and the ...
1
vote
1answer
354 views

What is security of stream cipher against chosen plaintext attack?

I have been looking for image encryption after compression using Ax+e, where A is a random matrix, x is plaintext and b is a bitstream generated using a stream cipher. Suppose choosing plaintext as ...
2
votes
2answers
517 views

Is there such a thing as perfect CPA security?

Consider the following experiment. If we require that $$\operatorname{P}\left( \mathcal A \text{ succeeds} \right) = \frac{1}{2}$$ for any adversary $\mathcal A$ in order to call the scheme $\Pi$ ...
0
votes
1answer
69 views

The differences between the attackers in the definitions of IND-ATK and NM-ATK

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
1
vote
1answer
69 views

Semantic security IND-CPA of Affine Hill Cipher

The ciphertext,c corresponding to plaintext,m is given by c= mK + w, K is the invertible matrix and w is the uniformly distributed random vector. If w is changed during every encryption, will this ...
1
vote
1answer
228 views

weakness of a DES enhancement

The following key enhancement to DES was proposed in order to increase the complexity of finding the keys by exhaustive search. $$\text{DES}^V_{k,k_1}(M)=\text{DES}_k(M)\oplus k_1$$ where the keys’ ...
1
vote
1answer
437 views

Is AES-CTR-NoPadding resistant to variable-length chosen-plaintext attack?

Consider the following scenario: an adversary $A$ with access to an encryption oracle $\mathcal{O}$ is able to choose $n \in \mathbb{N}$ and pick $p_1,\dots,p_n$ such that $\forall i \in \{1,\dots,n\}:...
0
votes
1answer
300 views

Attacking AES without transposition using ShiftRow and Mixcolumn layers

How can we attack by using chosen plaintext attack (and which plaintext should we choose) if AES didnt have the ShiftRow and Mixcolumn layers. I know each byte would be independent in the 16 byte ...
2
votes
1answer
168 views

What happens if five messages are generated in IND-CPA security?

I am wondering why in IND-CPA security game, the adversary generates two random messages. What happens if for example 5 messages are generated? What would be the advantage for the adversary?
2
votes
0answers
129 views

How can I show the new crypto scheme is still IND-CCA1 in proof of “IND-CCA1 does not imply NM-CPA”?

I am trying to show IND-CCA1 does not imply NM-CPA. From what I have read the "classical" proof goes by taking an IND-CCA1 scheme $E$ and modifying it so that the encryption of the inverted plaintext ...
0
votes
1answer
315 views

How to use CPA on AES128-CBC with constant Key and IV to leak info?

I'm doing a challenge in which I need to login to a server as an admin to capture a flag. I can enter an $id$ and a $password$ only consists of 'a-z', '0-9','-', '_' characters. The flow is as follows:...
6
votes
2answers
917 views

Creating own ciphertext after a padding oracle attack?

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired? ...
2
votes
1answer
445 views

Why do the messages in IND-CPA have to be of same length

I understand the general idea of IND-CPA, however I fail to understand why the messages the adversary chooses have to be of same length. I guess that with variable length messages there would always ...
0
votes
1answer
366 views

Selective Forgery of a Digital Signature - Goldwasser et al

I am working though the paper of Goldwasser, Micali and Rivest ''A Digital Signature Scheme Secure Against Adaptive Chosen- Message Attacks'' In the hierarchy of the severity of breaking the ...
2
votes
3answers
416 views

Invalid challenge-ciphertext in IND-CPA and IND-CCA games

Consider the IND-CPA game between a challenger $C$ and an adversary $A$ for a given public-key encryption scheme $PKE$: $C$ generates a key pair $(pk,sk)$ based on some security parameter $n$, and ...
5
votes
5answers
291 views

How to rigorously prove that $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$ is CPA secure assuming $\Pi$ is?

Assume $\Pi$ is a CPA secure scheme. Let $\Pi'$ be a derived scheme, such that the encryption of a message $M$ is as follows: $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$, where $LSB(k)$ is the ...
2
votes
0answers
115 views

Why does the DBDH simulator have half the advantage of an adversary?

Literature that includes the DBDH assumption such as this paper or this paper has a formal security proof that states: Suppose an adversary with non-negligible advantage $\varepsilon = Adv$. A ...
6
votes
3answers
1k views

Understanding the definition of polynomially CPA (IND-CPA) security

I just started on encryption schemes and have some trouble in understanding the following definition of IND-CPA security: $E$ is polynomially CPA (IND-CPA) secure, if for all adversaries $A$ and all ...
-3
votes
1answer
4k views

Why plain RSA encryption does not achieve CPA-security?

Why plain RSA encryption does not achieve CPA-security?
1
vote
1answer
216 views

Does security against a CCA1 attacker imply security against a CPA attacker?

I've seen it mentioned multiple times, but have not seen a formal proof of how security of an encryption scheme against a non adaptive chosen-ciphertext attacker (under non-malleability or ciphertext ...
1
vote
0answers
536 views

Semantically secure, but not CPA secure?

I'm just starting to read a cryptography book and I'm having trouble understanding this. I know that semantically secure means that the adversary cannot learn any significant information seeing the ...
10
votes
2answers
11k views

Chosen Plaintext attack on AES in ECB mode

I am familiar with the following method for an chosen-plaintext injection attack on ECB ciphers, where I am allowed to append a block of bytes to the packet being encrypted: I inject a string with ...