Questions tagged [chosen-plaintext-attack]

The attacker can specify his own plain text and encrypt or sign it.

Filter by
Sorted by
Tagged with
2
votes
0answers
81 views

IND-CPA game with a state-dependent Encryption Function that is insecure once

in the context of another setting I was asked the following question. Suppose the IND-CPA game is played with a symmetric encryption function $E$ that keeps a state of how many encryptions have ...
5
votes
1answer
357 views

How to encode messages in $\Bbb Z_p^*$ to be encrypted with ElGamal scheme?

In ElGamal encryption scheme, in order to achieve IND-CPA security, one must use a group where the DDH problem is assumed to be hard. As this answer suggests, one way to achieve that is the following: ...
3
votes
1answer
356 views

security against CPA attack?

Let $\mathcal{E} = (E,D)$ be a CPA secure cipher. Let's define $\mathcal{E'} = (E', D')$, where $E'(k,m) = E(k, E(k,m))$. How can I prove that $\mathcal{E'}$ will be CPA secure if $\mathcal{E}$ is? ...
3
votes
2answers
608 views

Proving that there is no scheme which would be perfectly CPA-secure

A private-key encryption scheme Π = (Gen, Enc, Dec) has perfectly indistinguishable encryptions under a chosen-plaintext attack, if for all probabilistic polynomial-time adversaries A it holds that Pr[...
0
votes
1answer
464 views

Relationship between CCA/CPA-security and PRFs

I'm a bit confused about the relationship between CCA/CPA-security and PRFs and particularly when do we think of encryption and decryption as a PRF. Assume we have an encryption scheme $\Pi = (Enc, ...
1
vote
1answer
103 views

Is there a property comparable to IND-CPA for hash functions taking a random value?

I would like to have a function $F(x, rnd)$, where $rnd$ is a fresh random value, such that it is hard, given $x_0$ and $x_1$, to distinguish $F(x_0, rnd)$ from $F(x_1, rnd)$, EDIT: but the values ...
3
votes
1answer
406 views

Why is counter mode encryption with a 16-byte cipher block not broken?

We determine a system IND-CPA secure when an adversary has a negligible advantage after any feasible amount of queries. AES256-GCM uses a 128bit block cipher. We know that the distinguishability ...
1
vote
1answer
168 views

Security of OFB mode if PRP is used instead of PRF

In the cryptography lecture at my university, we had the theorem that (randomized) OFB mode is IND-CPA secure if the used pseudorandom function (PRF) is IND-PRF secure. Afterwards, we investigated ...
1
vote
1answer
127 views

Does CPA-secure means security against differential cryptanalysis?

I've read on differential cryptanalysis where it traces the differences on the changes of ciphertexts of the same plaintext, except for some bits. However, I wonder is the differential cryptanalysis ...
4
votes
1answer
1k views

Encrypt-and-mac IND-CCA security

I have been stuck all day trying to understand how to show that an Encrypt-and-Mac ($SE_{EaM}$) scheme is not IND-CCA secure. I have seen this similar post, however it is slightly different and the ...
1
vote
1answer
354 views

What is security of stream cipher against chosen plaintext attack?

I have been looking for image encryption after compression using Ax+e, where A is a random matrix, x is plaintext and b is a bitstream generated using a stream cipher. Suppose choosing plaintext as ...
1
vote
1answer
69 views

Semantic security IND-CPA of Affine Hill Cipher

The ciphertext,c corresponding to plaintext,m is given by c= mK + w, K is the invertible matrix and w is the uniformly distributed random vector. If w is changed during every encryption, will this ...
1
vote
1answer
228 views

weakness of a DES enhancement

The following key enhancement to DES was proposed in order to increase the complexity of finding the keys by exhaustive search. $$\text{DES}^V_{k,k_1}(M)=\text{DES}_k(M)\oplus k_1$$ where the keys’ ...
0
votes
1answer
69 views

The differences between the attackers in the definitions of IND-ATK and NM-ATK

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
1
vote
1answer
436 views

Is AES-CTR-NoPadding resistant to variable-length chosen-plaintext attack?

Consider the following scenario: an adversary $A$ with access to an encryption oracle $\mathcal{O}$ is able to choose $n \in \mathbb{N}$ and pick $p_1,\dots,p_n$ such that $\forall i \in \{1,\dots,n\}:...
0
votes
1answer
300 views

Attacking AES without transposition using ShiftRow and Mixcolumn layers

How can we attack by using chosen plaintext attack (and which plaintext should we choose) if AES didnt have the ShiftRow and Mixcolumn layers. I know each byte would be independent in the 16 byte ...
2
votes
1answer
168 views

What happens if five messages are generated in IND-CPA security?

I am wondering why in IND-CPA security game, the adversary generates two random messages. What happens if for example 5 messages are generated? What would be the advantage for the adversary?
2
votes
2answers
517 views

Is there such a thing as perfect CPA security?

Consider the following experiment. If we require that $$\operatorname{P}\left( \mathcal A \text{ succeeds} \right) = \frac{1}{2}$$ for any adversary $\mathcal A$ in order to call the scheme $\Pi$ ...
2
votes
0answers
129 views

How can I show the new crypto scheme is still IND-CCA1 in proof of “IND-CCA1 does not imply NM-CPA”?

I am trying to show IND-CCA1 does not imply NM-CPA. From what I have read the "classical" proof goes by taking an IND-CCA1 scheme $E$ and modifying it so that the encryption of the inverted plaintext ...
0
votes
1answer
315 views

How to use CPA on AES128-CBC with constant Key and IV to leak info?

I'm doing a challenge in which I need to login to a server as an admin to capture a flag. I can enter an $id$ and a $password$ only consists of 'a-z', '0-9','-', '_' characters. The flow is as follows:...
2
votes
1answer
445 views

Why do the messages in IND-CPA have to be of same length

I understand the general idea of IND-CPA, however I fail to understand why the messages the adversary chooses have to be of same length. I guess that with variable length messages there would always ...
0
votes
1answer
366 views

Selective Forgery of a Digital Signature - Goldwasser et al

I am working though the paper of Goldwasser, Micali and Rivest ''A Digital Signature Scheme Secure Against Adaptive Chosen- Message Attacks'' In the hierarchy of the severity of breaking the ...
2
votes
1answer
275 views

Attack on AES-CBC with small pool of IV

Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$. I know that if we can predict next IV with 100% probability there is attack that completely breaks ...
5
votes
5answers
291 views

How to rigorously prove that $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$ is CPA secure assuming $\Pi$ is?

Assume $\Pi$ is a CPA secure scheme. Let $\Pi'$ be a derived scheme, such that the encryption of a message $M$ is as follows: $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$, where $LSB(k)$ is the ...
2
votes
0answers
115 views

Why does the DBDH simulator have half the advantage of an adversary?

Literature that includes the DBDH assumption such as this paper or this paper has a formal security proof that states: Suppose an adversary with non-negligible advantage $\varepsilon = Adv$. A ...
6
votes
3answers
1k views

Understanding the definition of polynomially CPA (IND-CPA) security

I just started on encryption schemes and have some trouble in understanding the following definition of IND-CPA security: $E$ is polynomially CPA (IND-CPA) secure, if for all adversaries $A$ and all ...
-3
votes
1answer
4k views

Why plain RSA encryption does not achieve CPA-security?

Why plain RSA encryption does not achieve CPA-security?
1
vote
1answer
216 views

Does security against a CCA1 attacker imply security against a CPA attacker?

I've seen it mentioned multiple times, but have not seen a formal proof of how security of an encryption scheme against a non adaptive chosen-ciphertext attacker (under non-malleability or ciphertext ...
8
votes
2answers
1k views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
1
vote
0answers
536 views

Semantically secure, but not CPA secure?

I'm just starting to read a cryptography book and I'm having trouble understanding this. I know that semantically secure means that the adversary cannot learn any significant information seeing the ...
2
votes
3answers
416 views

Invalid challenge-ciphertext in IND-CPA and IND-CCA games

Consider the IND-CPA game between a challenger $C$ and an adversary $A$ for a given public-key encryption scheme $PKE$: $C$ generates a key pair $(pk,sk)$ based on some security parameter $n$, and ...
0
votes
1answer
149 views

Who defined semantic security?

In my opinion the most important development in cryptography in the last 30 years is the precise definition of semantic security of a cipher. This definition captures the intuitive ideas of Martin ...
3
votes
1answer
167 views

BEAST Attack: from guessing to decoding

I understood the XOR trick that allows an attacker to guess a block of a previously sent message from the client to the server: the attacker forces the client to send the message $\tilde{m} = c_n \...
2
votes
1answer
131 views

Chosen Plaintext Attack and Chosen Multiple-Plaintext Attack

The original CPA game: The adversary gives two arbitrary messages $m_0$ and $m_1$ to a challenger; The challenger encrypts an arbitrary message $m_u$, $u∈\{0,1\}$ , and sends the ciphertext to the ...
1
vote
1answer
551 views

Encrypting any text without key after padding oracle attack in CBC mode

Suppose the decryption program is already built. Now I want to encrypt an arbitrary plain text given the IV and the decryption program (no key). From the formulas, we have $$Dec(C_i)\oplus C_{i-1}=P_i$...
11
votes
1answer
771 views

Does IND-CPA imply PRF?

It is well-known that a pseudorandom function (PRF) can be used to build a CPA-secure symmetric cryptosystem. My question: is PRF necessary for this, i.e., can one show something like "If there exists ...
0
votes
2answers
475 views

Encrypting a partially known plain text

I'm about to implement my very first crypto system probably using AES128. (still trying to figure which mode to use) Is there a weakness in encrypting a plain text of which 50% is known by the ...
10
votes
1answer
307 views

IND-CPA secure RSA padding with a partial homomorphic property

A while ago, I asked for an IND-CCA1 secure padding for RSA that still allows for the multiplicative homomorphic property of RSA and got no answers (yet). Now I've seen fgrieu's answer about standard ...
9
votes
3answers
2k views

Are there deterministic private-key encryption schemes that are CPA-secure?

I'm assuming there can't be such schemes because CPA-security is equivalent to CPA-security for multiple encryptions, and an adversary can distinguish between $(\mathsf{Enc}_k(m_0),\mathsf{Enc}_k(m_0))...
19
votes
1answer
4k views

What do the signature security abbreviations like EUF-CMA mean?

From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes. The most common ones are the *UF-* ...
2
votes
1answer
368 views

Why is adaptive security stronger than CCA1 security, and weaker than CCA2 security?

We know in CCA1 security, after seeing the challenge ciphertext, no more decryption oracles are allowed to the adversary. But in adaptive security, what should the adversary do? ​ Please help me ...
3
votes
0answers
451 views

Proving CPA security using a PRG in place of a PRF

I am stuck on a question involving a security proof. Any Hints on how to approach this is helpful and greatly appreciated. Question is: State whether the following scheme has indistinguishable ...
5
votes
1answer
1k views

IND-CPA security of CTR mode

Let's suppose CTR mode is instantiated such that the input to the block-cipher is $\langle \mathrm{IV}+\mathrm{ctr}\rangle$ instead of $\mathrm{IV}\mathbin\|\langle \mathrm{ctr}\rangle$, where $\...
2
votes
2answers
901 views

Prove that the following private-key encryption scheme is not CPA-secure

Consider the following private-key encryption scheme : The shared key is k $\in$ {0,1}n. To encrypt the message m $\in$ {0,1}n, choose random r $\in$ {0,1}n and output $(r, F_r(k)\oplus \overline{m})$,...
3
votes
2answers
1k views

How to defend AES against chosen-plaintext attack?

I have a server which encrypts files with the same AES key. Users can upload a file and download its encrypted version. A user can upload as many files as he wants. Users can decrypt the documents via ...
5
votes
2answers
399 views

Security of Randomized Encryption Scheme

I have the following question which I'm struggling with Suppose we are interested in encrypting bit strings. Consider a randomized encryption scheme that always produces ciphertexts of the same ...
10
votes
2answers
11k views

Chosen Plaintext attack on AES in ECB mode

I am familiar with the following method for an chosen-plaintext injection attack on ECB ciphers, where I am allowed to append a block of bytes to the packet being encrypted: I inject a string with ...
1
vote
0answers
102 views

Chosen plain-text attack proof for Bethencourt CP-ABE scheme

Consider the CPA security game which consists of the following steps: Initialization Setup Phase 1 Challenge Phase 2 Guess Can someone provide the proof for this game under Bethencourt ...
4
votes
1answer
1k views

Why is pseudorandom OTP (P-OTP) IND-CPA insecure

My lecture notes state that P-OTP is IND-COA but not IND-CPA insecure. I understand IND-COA secure, assuming PRG is secure, as that is the whole point of a OTP, but why is it IND-CPA insecure? Surely, ...
2
votes
1answer
169 views

Relevance of Input and Ouput size of PRF on CTR mode

I'm working on exercise 3.25 on Katz' book (2nd ed): Let $F$ be a pseudorandom function such that for $k \in \{0, 1\}^n$ the function $F_k$ maps $\ell_{\text{in}}(n)$-bit inputs to $\ell_{\text{out}...