We’re rewarding the question askers & reputations are being recalculated! Read more.

# Questions tagged [chosen-plaintext-attack]

The attacker can specify his own plain text and encrypt or sign it.

207 questions
Filter by
Sorted by
Tagged with
4k views

### Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

In CPA, it is said that the adversaries get ciphertext for the choice of plaintext of adversaries through an encryption oracle. Is this a realistic assumption in real-world, in which the adversaries ...
292 views

### Security of Randomized Encryption Scheme

I have the following question which I'm struggling with Suppose we are interested in encrypting bit strings. Consider a randomized encryption scheme that always produces ciphertexts of the same ...
75 views

### IND-CPA game with a state-dependent Encryption Function that is insecure once

in the context of another setting I was asked the following question. Suppose the IND-CPA game is played with a symmetric encryption function $E$ that keeps a state of how many encryptions have ...
22k views

### How does a chosen plaintext attack on RSA work?

How can one run a chosen plaintext attack on RSA? If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
231 views

### security against CPA attack?

Let $\mathcal{E} = (E,D)$ be a CPA secure cipher. Let's define $\mathcal{E'} = (E', D')$, where $E'(k,m) = E(k, E(k,m))$. How can I prove that $\mathcal{E'}$ will be CPA secure if $\mathcal{E}$ is? ...
249 views

### How to encode messages in $\Bbb Z_p^*$ to be encrypted with ElGamal scheme?

In ElGamal encryption scheme, in order to achieve IND-CPA security, one must use a group where the DDH problem is assumed to be hard. As this answer suggests, one way to achieve that is the following: ...
26k views

### Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

I just learned that using CBC encryption with an IV which is predictable is not secure. From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can ...
301 views

265 views

### Attacking AES without transposition using ShiftRow and Mixcolumn layers

How can we attack by using chosen plaintext attack (and which plaintext should we choose) if AES didnt have the ShiftRow and Mixcolumn layers. I know each byte would be independent in the 16 byte ...
163 views

### What happens if five messages are generated in IND-CPA security?

I am wondering why in IND-CPA security game, the adversary generates two random messages. What happens if for example 5 messages are generated? What would be the advantage for the adversary?
105 views

### How can I show the new crypto scheme is still IND-CCA1 in proof of “IND-CCA1 does not imply NM-CPA”?

I am trying to show IND-CCA1 does not imply NM-CPA. From what I have read the "classical" proof goes by taking an IND-CCA1 scheme $E$ and modifying it so that the encryption of the inverted plaintext ...
302 views

### How to use CPA on AES128-CBC with constant Key and IV to leak info?

I'm doing a challenge in which I need to login to a server as an admin to capture a flag. I can enter an $id$ and a $password$ only consists of 'a-z', '0-9','-', '_' characters. The flow is as follows:...
790 views

### Creating own ciphertext after a padding oracle attack?

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired? ...
364 views

### Why do the messages in IND-CPA have to be of same length

I understand the general idea of IND-CPA, however I fail to understand why the messages the adversary chooses have to be of same length. I guess that with variable length messages there would always ...
302 views

### Selective Forgery of a Digital Signature - Goldwasser et al

I am working though the paper of Goldwasser, Micali and Rivest ''A Digital Signature Scheme Secure Against Adaptive Chosen- Message Attacks'' In the hierarchy of the severity of breaking the ...
374 views

### Invalid challenge-ciphertext in IND-CPA and IND-CCA games

Consider the IND-CPA game between a challenger $C$ and an adversary $A$ for a given public-key encryption scheme $PKE$: $C$ generates a key pair $(pk,sk)$ based on some security parameter $n$, and ...
271 views

### How to rigorously prove that $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$ is CPA secure assuming $\Pi$ is?

Assume $\Pi$ is a CPA secure scheme. Let $\Pi'$ be a derived scheme, such that the encryption of a message $M$ is as follows: $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$, where $LSB(k)$ is the ...
110 views

### Why does the DBDH simulator have half the advantage of an adversary?

Literature that includes the DBDH assumption such as this paper or this paper has a formal security proof that states: Suppose an adversary with non-negligible advantage $\varepsilon = Adv$. A ...
1k views

### Understanding the definition of polynomially CPA (IND-CPA) security

I just started on encryption schemes and have some trouble in understanding the following definition of IND-CPA security: $E$ is polynomially CPA (IND-CPA) secure, if for all adversaries $A$ and all ...
3k views

### Why plain RSA encryption does not achieve CPA-security?

Why plain RSA encryption does not achieve CPA-security?
186 views

### Does security against a CCA1 attacker imply security against a CPA attacker?

I've seen it mentioned multiple times, but have not seen a formal proof of how security of an encryption scheme against a non adaptive chosen-ciphertext attacker (under non-malleability or ciphertext ...
459 views

### Semantically secure, but not CPA secure?

I'm just starting to read a cryptography book and I'm having trouble understanding this. I know that semantically secure means that the adversary cannot learn any significant information seeing the ...
9k views

### Chosen Plaintext attack on AES in ECB mode

I am familiar with the following method for an chosen-plaintext injection attack on ECB ciphers, where I am allowed to append a block of bytes to the packet being encrypted: I inject a string with ...
154 views

616 views

### Does IND-CPA imply PRF?

It is well-known that a pseudorandom function (PRF) can be used to build a CPA-secure symmetric cryptosystem. My question: is PRF necessary for this, i.e., can one show something like "If there exists ...
405 views

### Encrypting a partially known plain text

I'm about to implement my very first crypto system probably using AES128. (still trying to figure which mode to use) Is there a weakness in encrypting a plain text of which 50% is known by the ...
266 views

### IND-CPA secure RSA padding with a partial homomorphic property

A while ago, I asked for an IND-CCA1 secure padding for RSA that still allows for the multiplicative homomorphic property of RSA and got no answers (yet). Now I've seen fgrieu's answer about standard ...
657 views

### Prove that the following private-key encryption scheme is not CPA-secure

Consider the following private-key encryption scheme : The shared key is k $\in$ {0,1}n. To encrypt the message m $\in$ {0,1}n, choose random r $\in$ {0,1}n and output $(r, F_r(k)\oplus \overline{m})$,...
2k views

305 views

400 views

### Proving CPA security using a PRG in place of a PRF

I am stuck on a question involving a security proof. Any Hints on how to approach this is helpful and greatly appreciated. Question is: State whether the following scheme has indistinguishable ...