Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [malleability]

A cipher or mode of operation is said to be malleable if it is feasible to modify ciphertext to produce meaningful changes in the corresponding plaintext without knowing the encryption key.

4
votes
1answer
432 views

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks? I have been reading about homomorphic encryption and ...
2
votes
1answer
53 views

Proof of concept for RSA malleability

I'm trying to see how easy RSA malleability is. I generate 2 ciphertexts with a public key: ...
4
votes
1answer
87 views

How can one turn a malleable encryption to not malleable

An encryption algorithm is "malleable" if it is possible to transform a ciphertext into another ciphertext which decrypts to a related plaintext. That is, given an encryption of a plaintext m, it is ...
0
votes
0answers
104 views

GPG AES-256 Malleability

If Alice encrypts a file with GnuPG software using the AES-256 mode, and sends the encrypted file over an insecure channel (like E-mail or HTTP) to Bob. Both Alice and Bob know the password, but only ...
1
vote
3answers
861 views

Non-malleability of One Time Pad Encryption

Can anyone explain to me what the following means in relation to one time pad security? It's from the book 'Serious Cryptography: A Practical Introduction' and my logic knowledge seems to have lost ...
0
votes
1answer
49 views

The differences between the attackers in the definitions of IND-ATK and NM-ATK

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
0
votes
0answers
88 views

Is the encryption malleable when you get additively and multiplicatively homomorphic property at the same time?

Let's assume if I had an encryption function of \begin{equation} e(m) = h^{r}(1+mN) \ mod \ N^{2}\end{equation},where r is a random number in $\ Z(N^2) $ and \begin{equation}h=g^x mod N^2\end{equation}...
1
vote
0answers
72 views

What are the malleability properties of block device encryption with multiple modes of operation?

When encrypting a block device with a given symmetric cipher with a 128-bit block size in CBC mode, every second plaintext block in a sector can be changed to contain arbitrary data, with the blocks ...
1
vote
0answers
51 views

Can I overcome ElGamal malleability with AES preprocessing?

So textbook ElGamal is known to be vulnerable to CPA, and although there are several proposals (DHAES/EIES) for modifications none of those are formally accepted or standardized. My question is ...
0
votes
1answer
210 views

Non malleable Encryption scheme

I know that one time pad is malleable. Can you give me an example of an encryption scheme which is non-malleable?
12
votes
1answer
631 views

What is complexity leveraging

Complexity leveraging is a technique that is generally used to prove adaptive security of a selectively secure scheme. Eg: We can prove adaptive security of Yao's garbling scheme using complexity ...
0
votes
1answer
400 views

ElGamal malleability for a given function f(m)

Given the function $f(m)=m^3$, where $m$ is a plaintext message, what is a function for which ElGamal would be malleable to produce $f(m)$. I know for $t * c_2$ that this would yield $t * m $ but I ...
3
votes
3answers
635 views

Malleable encryption

What I would like to achieve is the following: Alice sends to Bob the encryption of a datagram that has the following format: ...
-2
votes
3answers
298 views

Would this method deliver a perfectly non-malleable encryption for at least two blocks? [closed]

Disclaimer: the algorithms I present here (and in other messages) are used as a hands-on way to learn about developing crypto algorithms, (and might also be of interest for other curious people), not ...
2
votes
1answer
246 views

Format preserving encryption FFX

In FFX mode the format of the ciphertext is same as plaintext. How does it ensure data integrity and authentication? Is there any bit flip attack in FFX mode? Is it malleable?
12
votes
2answers
2k views

Encrypt-then-MAC: Do I need to authenticate the IV?

In the setting of Encrypt-then-MAC, do I need to include the IV in what I'm HMACing, or is authenticating just the AES-encrypted data sufficient?
2
votes
1answer
362 views

Malleability of homomorphic encryption

El Gamal is a malleable homomorphic encryption system, so is Rabin. Are all homomorphic encryption systems malleable? Or are there any that are not malleable? Thanks!
0
votes
1answer
120 views

Is the Vigenère Cryptosystem malleable? [closed]

Is the Vigenère Cryptosystem malleable, and how can we prove that it is (or it is not) malleable?
7
votes
1answer
152 views

The REACT transform and Replayable CCA

Before stating my questions, let us recall the REACT transform [OP01], which enables to construct a CCA-secure hybrid PKE scheme, $\varepsilon'_{pk}$, from an OW-CPA PKE scheme $\varepsilon_{pk}^{asym}...
1
vote
0answers
188 views

Is there a malleable pubkey digital signature scheme?

I'm trying to find a special kind of Digital Signature Scheme. The scheme should allow me to transform a signature $s=\text{sign}(sk,m)$ (for a private key $sk$ and a message $m$) into a signature $s'...
4
votes
1answer
726 views

Non-standard signature security definition conforming ed25519 malleability

According to the paper “High-speed high-security signatures”… Malleability. We also see no relevance of "malleability" to the standard definition of signature security. Aside from the example, ...
2
votes
1answer
977 views

Why is CBC based on AES malleable in blocks other than the first block?

Perhaps I don't understand the answers to Malleability attacks against encryption without authentication, so trying to be more concrete... please be patient. If I want to change the first block and I ...
1
vote
1answer
129 views

Is OCB with short MAC malleable?

At the beginning of OCB's white paper [pdf], OCB is compared to other modes, and non-malleability is one of the properties advertised. At the end of the paper, it is mentioned the MAC length can be ...
2
votes
2answers
1k views

How does this happen in RSA malleability?

I don't understand how the $E(m)$ turns into $E(mt)$. I mean, I don't know how does that transformation happen and how does the equation occur. $$E(m) \cdot t^e \bmod n = (mt)^e \bmod n = E(mt)$$ ...
4
votes
1answer
1k views

Is CBC mode encryption vulnerable to a reordering attack?

I know that, if CBC-MAC is used in such a way that the tag is the concatenation of all the blocks' outputs (and not just the last one), it's insecure under CPA for the simplest case of 2 blocks CBC-...
1
vote
1answer
322 views

Why is Blum-Goldwasser not IND-CCA-2 secure?

Consider the Blum-Goldwasser encryption scheme as described on Wikipedia. I was told that it was not IND-CCA-2 secure. I heard there was malleabilty, probably it has to do with XOR-ing. But I do not ...
7
votes
3answers
4k views

Malleability attacks against encryption without authentication

Suppose there is a message that is encrypted with AES-128-CBC. The message is as follows, new lines are used to delimit the 16 byte boundary for each block: ...
2
votes
2answers
496 views

Stream cipher malleability

Considering a stream cipher that produces a ciphertext $c$ from a message $m$ and a key $k$ is it possible to apply operations (multiplication and/or addition) directly to $c$ without knowing the key ?...
0
votes
3answers
273 views

Is there a way to break this encryption?

I was wondering about making up a simple system to encrypt a file: ...
7
votes
1answer
330 views

Is there any known malleability of scrypt outputs?

The scenario is single-use passphrase-based non-interactive message authentication. The obvious try to do this is to chose a random salt of the appropriate length and send: ...
4
votes
1answer
607 views

What type of hash functions provides non-malleability of hash digests?

I want to use a hash function for commitments. I don't want an attacker to construct a commitment related to a previously published (but still unopened) commitment. A simple deterministic commitment ...
4
votes
3answers
2k views

Malleability of ElGamal and Hashed ElGamal

Question: Suppose A encrypts a number $x$ which indicates her bid on a contract, using ElGamal encryption. Say that the encryption of $x$ produces a ciphertext $c$. Explain how E can modify $c$ to ...