68 votes
Accepted

Easy explanation of "IND-" security notions?

The ideal encryption scheme $E$ would be one that, for every ciphertext $C=E(K, M)$, if the key remains secret for the adversary, the probability of identifying $M$ is negligible. Since that is not ...
14 votes
Accepted

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

There is an article* that answers the question in the negative for GCM and CCM. The article introduces the first formalization of the Releasing Unverified Plaintext (RUP) setting. The related security ...
  • 44.2k
12 votes
Accepted

ElGamal against chosen ciphertext attacks

As already mentioned in a previous answer and the comments, you are right regarding that ElGamal is not secure against chosen-ciphertext attacks. An immediate reason is that the scheme is ...
  • 4,832
12 votes
Accepted

What are the practical implications of ciphertext distinguishability?

This isn't really a "hard" answer, but an attempt to give some intuition or motivation. One can interpret indistinguishability as an overapproximation of the most common notions of security: Any ...
  • 11.2k
12 votes
Accepted

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?

I know of two lines of work on this question. It is indeed possible to allow malleability but still make some guarantees in the presence of a chosen-ciphertext attack: Manoj Prabhakaran & Mike ...
  • 10.8k
11 votes

Are common (secure) stream ciphers CCA1-secure?

For stream ciphers, IND-CCA1 and IND-CPA security differ precisely in that an attacker can choose the IV in the CCA1 game (because that's part of the ciphertext that can be submitted to the decryption ...
  • 126k
10 votes

What are the practical implications of ciphertext distinguishability?

Katz & Lindell mention in their book "Introduction to Modern Cryptography: Principles and Protocols" an example of an IND-CPA attack from World War II. Navy cryptanalysts suspected that Japanese ...
  • 4,832
10 votes

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

how can we prevent the cipher from being returned in case the tag is wrong ? As far as I understand, to compute the tag the decryption process must be done entirely. Actually, GCM decryption can be ...
  • 134k
9 votes
Accepted

Is ElGamal IND-CCA1?

The CCA1 security of ElGamal is a big open question. There are no attacks known, but standard reductions don't seem to work. In 1991, Damgard proposed an ElGamal variant and proved it to be CCA1-...
9 votes
Accepted

Are common (secure) stream ciphers CCA1-secure?

Let's consider CTR mode encryption with a random IV for a block cipher (essentially the same as stream cipher, but simpler to analyze since the formalization of stream cipher security is not fully ...
8 votes

Chosen plaintext attack on textbook RSA decryption

You seem to have some misconception here. Obviously, you are investigating chosen ciphertext attacks (CCAs) on textbook RSA instead of chosen plaintext attacks (CPAs). To help you with your ...
  • 12.2k
8 votes

Chosen plaintext vs Chosen ciphertext

The difference is how the plaintext-ciphertext pairs that the attacker has access to are generated. In a chosen plaintext attack, the attacker chooses some plaintext and is handed the corresponding ...
  • 11.2k
8 votes

What do NM-CPA and NM-CCA mean?

A cipher $E_k(m)$ is malleable if there is a nontrivial binary relation $\sim$ on messages such that given $c = E_k(m)$, it is easy to find $c' = E_k(m')$ with $m \sim m'$. For example, AES-CTR is ...
7 votes

Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?

Bouncy Castle Java releases 1.60 and FIPS 1.0.1 (and former) have precisely the issue exploited in Manger's attack: an exception occurs when a ciphertext $c$ is submitted such that $c^d\bmod N$, ...
  • 126k
7 votes
Accepted

Indistinguishability of symmetric encryption under CCA

CCA security always seems extreme to people who are just learning about it. The premise seems ridiculous, why would we give the attacker so much power? Why would we just let the attacker decrypt ...
  • 10.8k
6 votes
Accepted

Is there a partially homomorphic quantum secure public key cryptosystem with IND-CCA1 security?

Essentially any IND-CPA-secure lattice-based cryptosystem offers additive homomorphism, up to a predetermined number of operations. I don't know of any IND-CCA1-secure post-quantum candidate that ...
6 votes
Accepted

How any attack on a cipher carried out? Are these practical or only theoretical?

I'll answer your questions in order: 1. If any paper mentions attack as $2^{140}$, how the researchers determine this number of operations? By examining the mathematical properties of the algorithm ...
  • 86.5k
6 votes

Bleichenbacher attack, binary search, formula for $s_i$

Okay, I examined this for a while, and I'm pretty sure this is more of an oversight. They probably wanted to take $r\ge2bs_{i-1}-2B=2(bs_{i-1}-B)$. The same correction should go into the code. (Taking ...
6 votes
Accepted

Differences between NewHope-CPA-KEM and NewHope-CCA-KEM

Well, it turns out that a straight-forward implementation of LWE key exchanges is vulnerable to chosen ciphertext attacks, in the case that one side reuses the same private value $a$ multiple times. ...
  • 134k
6 votes
Accepted

How many required known plaintexts for an attack are considered insecure?

Firstly, is this a correct threshold for considering a cipher secure? Not exactly. Security is a spectrum, so what is secure for some applications may not be secure for others. Is a $2^{-64}$ ...
  • 13.8k
6 votes

Attack on security model for RSA-FDH

This is a) no attack on the security model, but an attack in the security model of EUF-CMA, and b) a generic attack on any signature scheme that signs the hash of a message instead of the message ...
  • 2,870
5 votes
Accepted

Fixed-points in block ciphers; why don't they indicate a vulnerability?

Intuitively, the reason fixed points are not a problem is the same reason that zeros in a one time pad are not. Because the transform is supposed to be random, a ciphertext that looks like plaintext ...
  • 31.4k
5 votes

What is the meaning of IND-CCA secure under standard model?

Your questions can be split in two: What is the meaning of IND-CCA secure? What have an adversary access in a challenger-adversary game? This basically means that the scheme achieves the ...
  • 4,832
5 votes
Accepted

Is a chosen ciphertext attack on PGP still possible?

RFC 4880, OpenPGP (superseded RFC 2440 which was up to date in 2002) contains a chapter on security considerations, which also discusses the decryption oracle attack Jallad et al described: In late ...
  • 1,283
5 votes

RSA-CCA security of $m || H(m)$ as input to modular exponentiation

CCA security assumes CPA security, and $m || H(m)$ is not CPA secure. This is simple to show: say that $C = E(m || H(m))$ is known, then an adversary can simply guess $m'$ and encrypt that. Then $C' = ...
  • 86.5k
5 votes
Accepted

CPA-secure of $\Pi$ implies CPA-security of $\Pi||\Pi||\ldots||\Pi$

The proof of (1) is not given in the chapter on symmetric encryption since it requires knowing the hybrid proof technique that is taught in Chapter 7. However, the argument is proven in Chapter 11 for ...
5 votes
Accepted

Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?

What you describe is Chosen-Plaintext Attack (CPA) and AES and secure block ciphers are designed to be secure against this. Having $2^{16}$ chosen-plaintext under one key doesn't help you to extract ...
  • 44.2k
5 votes
Accepted

Why does Encrypt-Then-Sign not yield a CCA-secure public-key encryption scheme?

I am not sure how the IND-CCA experiment in this case works. Well, it doesn't really. There are no verification keys designated as such in the CCA experiment and there is no designated sender in the ...
  • 6,433

Only top scored, non community-wiki answers of a minimum length are eligible