Skip to main content

Questions tagged [malleability]

A cipher or mode of operation is said to be malleable if it is feasible to modify ciphertext to produce meaningful changes in the corresponding plaintext without knowing the encryption key.

Filter by
Sorted by
Tagged with
1 vote
1 answer
87 views

Cryptography particular block length valid message

I am new at cryptography and start to learn some terms. I just saw an question in the book and didn't got a clue about this question. Could someone can explain me the answer of this question? Because ...
MariaDb's user avatar
  • 31
0 votes
1 answer
53 views

Is there a name for an encryption scheme that do not return $\bot$ when a different key is used during decryption?

Given an encryption scheme $\Pi = (G,E,D)$, either public or private, is there a name or a property to emphasize that for $c\gets \Pi.E(k,m)$, where $k$ is a key and $m$ is a message, we want $m^\...
vxek's user avatar
  • 477
1 vote
1 answer
571 views

Malleability of El Gamal encryption

Suppose Alice encrypts a number 𝑥 which indicates her bid on a contract, using textbook ElGamal encryption (malleable). This encryption of 𝑥 produces a ciphertext pair 𝑐1 and 𝑐2. How can Eve ...
Lawrence Meigs's user avatar
0 votes
1 answer
254 views

malleability of the Elgamal cryptosystem

In bidding for a contract, a company might outbid its competitor by simply multiplying its rival company’s encrypted bid by 0.9, without even knowing the bid. Now Suppose we are given the ciphertext c ...
Mary's user avatar
  • 11
2 votes
1 answer
316 views

"Fixing" PCBC mode?

In PCBC mode, one encrypts and decrypts via $$ C_i = E(P_i \oplus P_{i-1} \oplus C_{i-1}) \Longleftrightarrow P_i = D(C_i) \oplus P_{i-1} \oplus C_{i-1} $$ (where $P_0 \oplus C_0 = IV$), which has ...
ManRow's user avatar
  • 343
2 votes
1 answer
378 views

How to create the ciphertext that generates a desired plaintext in CBC (previous cipher- and plaintext are known)

I'm struggling with understanding this part of the literature: It can be assumed that the entire ciphertext AND plaintext is known. Considering the encryption method is $C_i = enc_k ( P_i \oplus C_{...
hello3123's user avatar
2 votes
2 answers
413 views

Is E_k(M)||H(m) form of MAC secure?

Would this encryption and signing scenario be considered tamper-proof? ...
Evan Su's user avatar
  • 449
4 votes
2 answers
369 views

Making a cipher non-malleable using a plaintext transform?

NOTE: By malleable/non-malleable, I mean the ability/or not to change a byte/block of the ciphertext and have it change only that byte/block of the plaintext. I understand that we use authentication (...
Modal Nest's user avatar
  • 1,453
1 vote
1 answer
60 views

Malleability for varying length message

Given ciphertext for a message encrypted using $AES-CTR$ along with actual, desired message and IV, I need to perform malleability attack on the ciphertext to change the original message from $M$ to $...
Alex's user avatar
  • 341
4 votes
1 answer
277 views

ECDSA: with knowledge of private key, can we make signatures with partially chosen content?

In ECDSA, with knowledge of private key, can we make signatures with partially chosen content? Detailing that: In ECDSA (with secp256r1 curve and SHA-256 hash), assume we know the private key, the ...
fgrieu's user avatar
  • 142k
1 vote
1 answer
294 views

SHA256 hash malleability

Can an SHA-256 plaintext be malleable? For example: Given $y = hash(x)$ , can an attacker find $z$ so that $z = hash(f(x))$. Here $f()$ might be the addition of a suffix to the message, an XOR ...
Anonymous's user avatar
2 votes
1 answer
440 views

Proofs that NM-CPA implies IND-Cpa and $\text{IND-CCA} \leftrightarrow \text{NM-CCA}$

I am looking for a proof for the following two claims from "Serious Cryptography" by Aumasson. NM-CPA implies IND-CPA. [...] IND-CCA and NM-CCA are equivalent notions that imply the presence of the ...
securitymensch's user avatar
11 votes
2 answers
1k views

What do NM-CPA and NM-CCA mean?

When I've been researching authenticated encryption, the following terms keep showing up: NM-CPA NM-CCA ....without any definition as to what they mean. I've tried searching the web for their ...
starbeamrainbowlabs's user avatar
7 votes
0 answers
115 views

Is there a standard definition of non-malleability for the encryption schemes?

I find some different definitions of non-malleability for the encryption schemes. They may be equivalent, but I am not sure which one is better or if there is a standard definition. I give two ...
Blanco's user avatar
  • 1,622
8 votes
1 answer
611 views

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks? I have been reading about homomorphic encryption and ...
hdu's user avatar
  • 93
1 vote
1 answer
1k views

Proof of concept for RSA malleability

I'm trying to see how easy RSA malleability is. I generate 2 ciphertexts with a public key: ...
hbogert's user avatar
  • 119
4 votes
1 answer
326 views

How can one turn a malleable encryption to not malleable

An encryption algorithm is "malleable" if it is possible to transform a ciphertext into another ciphertext which decrypts to a related plaintext. That is, given an encryption of a plaintext m, it is ...
M.J.Watson's user avatar
3 votes
4 answers
3k views

Non-malleability of One Time Pad Encryption

Can anyone explain to me what the following means in relation to one time pad security? It's from the book 'Serious Cryptography: A Practical Introduction' and my logic knowledge seems to have lost ...
Bipman's user avatar
  • 115
0 votes
1 answer
122 views

The differences between the attackers in the definitions of IND-ATK and NM-ATK

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
Blanco's user avatar
  • 1,622
1 vote
0 answers
138 views

What are the malleability properties of block device encryption with multiple modes of operation?

When encrypting a block device with a given symmetric cipher with a 128-bit block size in CBC mode, every second plaintext block in a sector can be changed to contain arbitrary data, with the blocks ...
anon's user avatar
  • 11
1 vote
0 answers
119 views

Can I overcome ElGamal malleability with AES preprocessing?

So textbook ElGamal is known to be vulnerable to CPA, and although there are several proposals (DHAES/EIES) for modifications none of those are formally accepted or standardized. My question is ...
jugen's user avatar
  • 11
0 votes
1 answer
339 views

Non malleable Encryption scheme

I know that one time pad is malleable. Can you give me an example of an encryption scheme which is non-malleable?
Pranav Sodhani's user avatar
15 votes
1 answer
1k views

What is complexity leveraging

Complexity leveraging is a technique that is generally used to prove adaptive security of a selectively secure scheme. Eg: We can prove adaptive security of Yao's garbling scheme using complexity ...
satya's user avatar
  • 1,414
0 votes
1 answer
2k views

ElGamal malleability for a given function f(m)

Given the function $f(m)=m^3$, where $m$ is a plaintext message, what is a function for which ElGamal would be malleable to produce $f(m)$. I know for $t * c_2$ that this would yield $t * m $ but I ...
CharLey's user avatar
3 votes
3 answers
2k views

Malleable encryption

What I would like to achieve is the following: Alice sends to Bob the encryption of a datagram that has the following format: ...
vega4's user avatar
  • 31
-2 votes
3 answers
433 views

Would this method deliver a perfectly non-malleable encryption for at least two blocks? [closed]

Disclaimer: the algorithms I present here (and in other messages) are used as a hands-on way to learn about developing crypto algorithms, (and might also be of interest for other curious people), not ...
Anon2000's user avatar
  • 341
3 votes
1 answer
505 views

Format preserving encryption FFX

In FFX mode the format of the ciphertext is same as plaintext. How does it ensure data integrity and authentication? Is there any bit flip attack in FFX mode? Is it malleable?
user3425935's user avatar
14 votes
2 answers
3k views

Encrypt-then-MAC: Do I need to authenticate the IV?

In the setting of Encrypt-then-MAC, do I need to include the IV in what I'm HMACing, or is authenticating just the AES-encrypted data sufficient?
fadedbee's user avatar
  • 938
4 votes
1 answer
1k views

Malleability of homomorphic encryption

El Gamal is a malleable homomorphic encryption system, so is Rabin. Are all homomorphic encryption systems malleable? Or are there any that are not malleable? Thanks!
user100503's user avatar
0 votes
1 answer
154 views

Is the Vigenère Cryptosystem malleable? [closed]

Is the Vigenère Cryptosystem malleable, and how can we prove that it is (or it is not) malleable?
mimi's user avatar
  • 13
7 votes
1 answer
245 views

The REACT transform and Replayable CCA

Before stating my questions, let us recall the REACT transform [OP01], which enables to construct a CCA-secure hybrid PKE scheme, $\varepsilon'_{pk}$, from an OW-CPA PKE scheme $\varepsilon_{pk}^{asym}...
cygnusv's user avatar
  • 5,002
1 vote
0 answers
265 views

Is there a malleable pubkey digital signature scheme?

I'm trying to find a special kind of Digital Signature Scheme. The scheme should allow me to transform a signature $s=\text{sign}(sk,m)$ (for a private key $sk$ and a message $m$) into a signature $s'...
SDL's user avatar
  • 1,887
7 votes
1 answer
1k views

Non-standard signature security definition conforming ed25519 malleability

According to the paper “High-speed high-security signatures”… Malleability. We also see no relevance of "malleability" to the standard definition of signature security. Aside from the example, ...
user avatar
2 votes
1 answer
2k views

Why is CBC based on AES malleable in blocks other than the first block?

Perhaps I don't understand the answers to Malleability attacks against encryption without authentication, so trying to be more concrete... please be patient. If I want to change the first block and I ...
ihadanny's user avatar
  • 121
1 vote
1 answer
193 views

Is OCB with short MAC malleable?

At the beginning of OCB's white paper [pdf], OCB is compared to other modes, and non-malleability is one of the properties advertised. At the end of the paper, it is mentioned the MAC length can be ...
Kai Elvin's user avatar
2 votes
2 answers
4k views

How does this happen in RSA malleability?

I don't understand how the $E(m)$ turns into $E(mt)$. I mean, I don't know how does that transformation happen and how does the equation occur. $$E(m) \cdot t^e \bmod n = (mt)^e \bmod n = E(mt)$$ ...
Ali Gajani's user avatar
4 votes
1 answer
2k views

Is CBC mode encryption vulnerable to a reordering attack?

I know that, if CBC-MAC is used in such a way that the tag is the concatenation of all the blocks' outputs (and not just the last one), it's insecure under CPA for the simplest case of 2 blocks CBC-...
Bush's user avatar
  • 2,140
1 vote
1 answer
462 views

Why is Blum-Goldwasser not IND-CCA-2 secure?

Consider the Blum-Goldwasser encryption scheme as described on Wikipedia. I was told that it was not IND-CCA-2 secure. I heard there was malleabilty, probably it has to do with XOR-ing. But I do not ...
Johannes's user avatar
  • 133
10 votes
3 answers
7k views

Malleability attacks against encryption without authentication

Suppose there is a message that is encrypted with AES-128-CBC. The message is as follows, new lines are used to delimit the 16 byte boundary for each block: ...
Rook's user avatar
  • 1,506
2 votes
2 answers
1k views

Stream cipher malleability

Considering a stream cipher that produces a ciphertext $c$ from a message $m$ and a key $k$ is it possible to apply operations (multiplication and/or addition) directly to $c$ without knowing the key ?...
Narayan Ambre's user avatar
0 votes
3 answers
346 views

Is there a way to break this encryption?

I was wondering about making up a simple system to encrypt a file: ...
user avatar
8 votes
1 answer
350 views

Is there any known malleability of scrypt outputs?

The scenario is single-use passphrase-based non-interactive message authentication. The obvious try to do this is to chose a random salt of the appropriate length and send: ...
user avatar
5 votes
1 answer
1k views

What type of hash functions provides non-malleability of hash digests?

I want to use a hash function for commitments. I don't want an attacker to construct a commitment related to a previously published (but still unopened) commitment. A simple deterministic commitment ...
SDL's user avatar
  • 1,887
5 votes
3 answers
5k views

Malleability of ElGamal and Hashed ElGamal

Question: Suppose A encrypts a number $x$ which indicates her bid on a contract, using ElGamal encryption. Say that the encryption of $x$ produces a ciphertext $c$. Explain how E can modify $c$ to ...
Bobby S's user avatar
  • 1,963