Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [chosen-plaintext-attack]

The attacker can specify his own plain text and encrypt or sign it.

Filter by
Sorted by
Tagged with
1
vote
1answer
384 views

Is AES-CTR-NoPadding resistant to variable-length chosen-plaintext attack?

Consider the following scenario: an adversary $A$ with access to an encryption oracle $\mathcal{O}$ is able to choose $n \in \mathbb{N}$ and pick $p_1,\dots,p_n$ such that $\forall i \in \{1,\dots,n\}:...
0
votes
1answer
266 views

Attacking AES without transposition using ShiftRow and Mixcolumn layers

How can we attack by using chosen plaintext attack (and which plaintext should we choose) if AES didnt have the ShiftRow and Mixcolumn layers. I know each byte would be independent in the 16 byte ...
2
votes
1answer
163 views

What happens if five messages are generated in IND-CPA security?

I am wondering why in IND-CPA security game, the adversary generates two random messages. What happens if for example 5 messages are generated? What would be the advantage for the adversary?
2
votes
2answers
442 views

Is there such a thing as perfect CPA security?

Consider the following experiment. If we require that $$\operatorname{P}\left( \mathcal A \text{ succeeds} \right) = \frac{1}{2}$$ for any adversary $\mathcal A$ in order to call the scheme $\Pi$ ...
2
votes
0answers
105 views

How can I show the new crypto scheme is still IND-CCA1 in proof of “IND-CCA1 does not imply NM-CPA”?

I am trying to show IND-CCA1 does not imply NM-CPA. From what I have read the "classical" proof goes by taking an IND-CCA1 scheme $E$ and modifying it so that the encryption of the inverted plaintext ...
0
votes
1answer
303 views

How to use CPA on AES128-CBC with constant Key and IV to leak info?

I'm doing a challenge in which I need to login to a server as an admin to capture a flag. I can enter an $id$ and a $password$ only consists of 'a-z', '0-9','-', '_' characters. The flow is as follows:...
2
votes
1answer
364 views

Why do the messages in IND-CPA have to be of same length

I understand the general idea of IND-CPA, however I fail to understand why the messages the adversary chooses have to be of same length. I guess that with variable length messages there would always ...
0
votes
1answer
303 views

Selective Forgery of a Digital Signature - Goldwasser et al

I am working though the paper of Goldwasser, Micali and Rivest ''A Digital Signature Scheme Secure Against Adaptive Chosen- Message Attacks'' In the hierarchy of the severity of breaking the ...
2
votes
1answer
263 views

Attack on AES-CBC with small pool of IV

Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$. I know that if we can predict next IV with 100% probability there is attack that completely breaks ...
5
votes
5answers
271 views

How to rigorously prove that $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$ is CPA secure assuming $\Pi$ is?

Assume $\Pi$ is a CPA secure scheme. Let $\Pi'$ be a derived scheme, such that the encryption of a message $M$ is as follows: $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$, where $LSB(k)$ is the ...
2
votes
0answers
110 views

Why does the DBDH simulator have half the advantage of an adversary?

Literature that includes the DBDH assumption such as this paper or this paper has a formal security proof that states: Suppose an adversary with non-negligible advantage $\varepsilon = Adv$. A ...
6
votes
3answers
1k views

Understanding the definition of polynomially CPA (IND-CPA) security

I just started on encryption schemes and have some trouble in understanding the following definition of IND-CPA security: $E$ is polynomially CPA (IND-CPA) secure, if for all adversaries $A$ and all ...
-3
votes
1answer
3k views

Why plain RSA encryption does not achieve CPA-security?

Why plain RSA encryption does not achieve CPA-security?
1
vote
1answer
186 views

Does security against a CCA1 attacker imply security against a CPA attacker?

I've seen it mentioned multiple times, but have not seen a formal proof of how security of an encryption scheme against a non adaptive chosen-ciphertext attacker (under non-malleability or ciphertext ...
8
votes
2answers
1k views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
1
vote
0answers
460 views

Semantically secure, but not CPA secure?

I'm just starting to read a cryptography book and I'm having trouble understanding this. I know that semantically secure means that the adversary cannot learn any significant information seeing the ...
2
votes
3answers
374 views

Invalid challenge-ciphertext in IND-CPA and IND-CCA games

Consider the IND-CPA game between a challenger $C$ and an adversary $A$ for a given public-key encryption scheme $PKE$: $C$ generates a key pair $(pk,sk)$ based on some security parameter $n$, and ...
0
votes
1answer
136 views

Who defined semantic security?

In my opinion the most important development in cryptography in the last 30 years is the precise definition of semantic security of a cipher. This definition captures the intuitive ideas of Martin ...
3
votes
1answer
154 views

BEAST Attack: from guessing to decoding

I understood the XOR trick that allows an attacker to guess a block of a previously sent message from the client to the server: the attacker forces the client to send the message $\tilde{m} = c_n \...
2
votes
1answer
112 views

Chosen Plaintext Attack and Chosen Multiple-Plaintext Attack

The original CPA game: The adversary gives two arbitrary messages $m_0$ and $m_1$ to a challenger; The challenger encrypts an arbitrary message $m_u$, $u∈\{0,1\}$ , and sends the ciphertext to the ...
1
vote
1answer
504 views

Encrypting any text without key after padding oracle attack in CBC mode

Suppose the decryption program is already built. Now I want to encrypt an arbitrary plain text given the IV and the decryption program (no key). From the formulas, we have $$Dec(C_i)\oplus C_{i-1}=P_i$...
11
votes
1answer
617 views

Does IND-CPA imply PRF?

It is well-known that a pseudorandom function (PRF) can be used to build a CPA-secure symmetric cryptosystem. My question: is PRF necessary for this, i.e., can one show something like "If there exists ...
0
votes
2answers
406 views

Encrypting a partially known plain text

I'm about to implement my very first crypto system probably using AES128. (still trying to figure which mode to use) Is there a weakness in encrypting a plain text of which 50% is known by the ...
10
votes
1answer
266 views

IND-CPA secure RSA padding with a partial homomorphic property

A while ago, I asked for an IND-CCA1 secure padding for RSA that still allows for the multiplicative homomorphic property of RSA and got no answers (yet). Now I've seen fgrieu's answer about standard ...
8
votes
3answers
2k views

Are there deterministic private-key encryption schemes that are CPA-secure?

I'm assuming there can't be such schemes because CPA-security is equivalent to CPA-security for multiple encryptions, and an adversary can distinguish between $(\mathsf{Enc}_k(m_0),\mathsf{Enc}_k(m_0))...
19
votes
1answer
3k views

What do the signature security abbreviations like EUF-CMA mean?

From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes. The most common ones are the *UF-* ...
2
votes
1answer
306 views

Why is adaptive security stronger than CCA1 security, and weaker than CCA2 security?

We know in CCA1 security, after seeing the challenge ciphertext, no more decryption oracles are allowed to the adversary. But in adaptive security, what should the adversary do? ​ Please help me ...
3
votes
0answers
400 views

Proving CPA security using a PRG in place of a PRF

I am stuck on a question involving a security proof. Any Hints on how to approach this is helpful and greatly appreciated. Question is: State whether the following scheme has indistinguishable ...
5
votes
1answer
772 views

IND-CPA security of CTR mode

Let's suppose CTR mode is instantiated such that the input to the block-cipher is $\langle \mathrm{IV}+\mathrm{ctr}\rangle$ instead of $\mathrm{IV}\mathbin\|\langle \mathrm{ctr}\rangle$, where $\...
2
votes
2answers
657 views

Prove that the following private-key encryption scheme is not CPA-secure

Consider the following private-key encryption scheme : The shared key is k $\in$ {0,1}n. To encrypt the message m $\in$ {0,1}n, choose random r $\in$ {0,1}n and output $(r, F_r(k)\oplus \overline{m})$,...
3
votes
2answers
1k views

How to defend AES against chosen-plaintext attack?

I have a server which encrypts files with the same AES key. Users can upload a file and download its encrypted version. A user can upload as many files as he wants. Users can decrypt the documents via ...
5
votes
2answers
293 views

Security of Randomized Encryption Scheme

I have the following question which I'm struggling with Suppose we are interested in encrypting bit strings. Consider a randomized encryption scheme that always produces ciphertexts of the same ...
10
votes
2answers
9k views

Chosen Plaintext attack on AES in ECB mode

I am familiar with the following method for an chosen-plaintext injection attack on ECB ciphers, where I am allowed to append a block of bytes to the packet being encrypted: I inject a string with ...
1
vote
0answers
98 views

Chosen plain-text attack proof for Bethencourt CP-ABE scheme

Consider the CPA security game which consists of the following steps: Initialization Setup Phase 1 Challenge Phase 2 Guess Can someone provide the proof for this game under Bethencourt ...
4
votes
1answer
888 views

Why is pseudorandom OTP (P-OTP) IND-CPA insecure

My lecture notes state that P-OTP is IND-COA but not IND-CPA insecure. I understand IND-COA secure, assuming PRG is secure, as that is the whole point of a OTP, but why is it IND-CPA insecure? Surely, ...
2
votes
1answer
151 views

Relevance of Input and Ouput size of PRF on CTR mode

I'm working on exercise 3.25 on Katz' book (2nd ed): Let $F$ be a pseudorandom function such that for $k \in \{0, 1\}^n$ the function $F_k$ maps $\ell_{\text{in}}(n)$-bit inputs to $\ell_{\text{out}...
7
votes
1answer
1k views

CPA-security of CTR mode

I'm self-studying Katz' book (2nd ed), and I have a small question about Theorem 3.32, which says: If $F$ is a pseudorandom permutation, then $CTR$ mode is $CPA-$secure. They present a proof there,...
2
votes
1answer
201 views

Plain text as numbers

(I apologize for obviously wrong tag. I could not find appropriate one.) All mathematical description of encryption functions assume, despites the use of the word plaintext, that the message to be ...
3
votes
1answer
2k views

ElGamal CPA secure

I understand that if DDH (Decisional Diffie–Hellman) is hard then ElGamal is CPA secure. But I'm having confusion on what part the DDH applies to. So, given $pk=(G, g, y), y=g^x$ and $sk=(pk,x), x \...
0
votes
1answer
2k views

How to break AES CBC PADDING with chosen ciphertext attack

I'm doing a penetration testing for a web application that uses AES CBC PADDING encryption for the parameter ?email=ciphertext then it's printing the plaintext email on html body. I would like to ...
1
vote
3answers
1k views

Chosen Plaintext Attack on DES/AES

PERSON A sends messages to PERSON B using AES, CBC, PKCS5Padding with an IV that is incremented by one after each message. If PERSON Z knows that the first block of the plain-text of any message is ...
1
vote
1answer
232 views

To which game-based security definition is Perfect Secrecy equivalent?

We all know the classic definitions of perfect secrecy, being $$\Pr[M=m|C=c]=\Pr[M=m]$$ and $$H(M|C)=H(M)$$ But now what I've asked myself: If we were to remove the polynomial restriction on the ...
3
votes
1answer
159 views

Can you help me understand indistinguishably as described in the CPA security definition?

When I read the definition of the CPA indistinguishably encryption scheme, I see that the adversary can use an oracle as many times (to get as many encryptions of any messages it choose). An the end ...
-2
votes
1answer
308 views

Is there any tool for text steganography? [closed]

i wanna ask anyone that know is there any tool or software to hide text in text it self, that we usually call it as text steganography?
0
votes
1answer
339 views

Is a Feistel structure based cipher IND-CPA?

Using the format of the "game" to establish if a cipher is IND-CPA secure: The adversary submits two distinct $M_0$, $M_1$ plain-texts to the challenger. The challenger selects one of them at random ...
0
votes
1answer
458 views

IND-CCA Security of a encryption scheme which is combination of two schemes

I have two public key encryption scheme $\Pi_0$ and $\Pi_1$ and one of them is IND-CCA secure, another one is IND-CPA secure. Let $\Pi$ be a public key encryption scheme, which is a combination of $\...
4
votes
0answers
475 views

uf-cma and uf-cmva probabilistic MAC

Is there any simple probabilistic MAC $\Pi=(\operatorname{Gen},\operatorname{Tag},\operatorname{Vrfy})$ with UF-CMA security but without UF-CMVA security? How can an attacker efficiently use the $\...
5
votes
1answer
823 views

How to prove a function is pseudorandom function?

I am currently enrolled in a cryptography course, which uses the book by Katz and Lindell. I am using a function having $F_{k}$ = $A_{k}(B_{k}(r,m),r)$, the random number is generated using the ...
7
votes
1answer
2k views

how to prove our algorithm is secure against chosen plaintext attack?

I am working on a topic in cryptography where I have tried to develop an encryption scheme. How could I prove mathematically that my algorithm is secure against chosen plaintext attacks?. Will it be ...
2
votes
2answers
894 views

Using bcrypt for MAC - is it correct and secure?

Suppose there is a hashing function: $$ph = bcrypt(sha256(m + k), salt)$$ Here $ph$ is a password hash obtaining by applying $bcrypt$ on $sha256$ result of concatenating a message $m$ with a secret ...