16
votes
Accepted
AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?
There is an article* that answers the question in the negative for GCM and CCM. The article introduces the first formalization of the Releasing Unverified Plaintext (RUP) setting. The related security ...
- 49.3k
15
votes
Does Grover's algorithm really threaten symmetric security proofs?
Yes, but also no. Grover's algorithm is actually quadratically faster than classical algorithms. However there are a few catches.
Quantum computers are slow and expensive. This means that in the near ...
- 290
13
votes
Accepted
Does Grover's algorithm really threaten symmetric security proofs?
Despite the classical security proof, Grover's algorithm threatens symmetric key cryptography. The main reason is that classical security proof assumes that the adversary makes classical queries to ...
- 438
12
votes
Accepted
Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?
I know of two lines of work on this question. It is indeed possible to allow malleability but still make some guarantees in the presence of a chosen-ciphertext attack:
Manoj Prabhakaran & Mike ...
- 14.1k
12
votes
What do NM-CPA and NM-CCA mean?
A cipher $E_k(m)$ is malleable if there is a nontrivial binary relation $\sim$ on messages such that given $c = E_k(m)$, it is easy to find $c' = E_k(m')$ with $m \sim m'$. For example, AES-CTR is ...
- 49.1k
12
votes
AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?
how can we prevent the cipher from being returned in case the tag is wrong ? As far as I understand, to compute the tag the decryption process must be done entirely.
Actually, GCM decryption can be ...
- 150k
11
votes
Are common (secure) stream ciphers CCA1-secure?
For stream ciphers, IND-CCA1 and IND-CPA security differ precisely in that an attacker can choose the IV in the CCA1 game (because that's part of the ciphertext that can be submitted to the decryption ...
- 144k
11
votes
Does Grover's algorithm really threaten symmetric security proofs?
Does Grover's algorithm really threaten symmetric cryptography?
Lov K. Grover's algorithm reduces the key search into $\mathcal{O}(\sqrt{2^n})$ instead of the $\mathcal{O}(2^n)$. What is generally ...
- 49.3k
9
votes
Accepted
Are common (secure) stream ciphers CCA1-secure?
Let's consider CTR mode encryption with a random IV for a block cipher (essentially the same as stream cipher, but simpler to analyze since the formalization of stream cipher security is not fully ...
- 28.1k
8
votes
Accepted
Indistinguishability of symmetric encryption under CCA
CCA security always seems extreme to people who are just learning about it. The premise seems ridiculous, why would we give the attacker so much power? Why would we just let the attacker decrypt ...
- 14.1k
8
votes
Accepted
Does CCA security imply perfect secrecy?
Perfect secrecy & [the traditional/standard definition of] CCA security are incompatible.
Shannon's theorem says that if you want perfect secrecy, then the key needs to be longer than the total ...
- 14.1k
8
votes
Does Grover's algorithm really threaten symmetric security proofs?
I'm going to answer the question in your headline and then go forward.
No. Grover's algorithm is a canard and you ought to stop worrying about it.
The major reason for this is that Grover reduces the ...
- 2,322
7
votes
Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?
Bouncy Castle Java releases 1.60 and FIPS 1.0.1 (and former) have precisely the issue exploited in Manger's attack: an exception occurs when a ciphertext $c$ is submitted such that $c^d\bmod N$, ...
- 144k
7
votes
Accepted
CPA + one-time strong signature --> CCA?
The construction can't be made CCA-secure
The algorithm that you wrote doesn't say how the decryption algorithm obtains the signature verification key.
If the verification key is part of the public ...
- 14.1k
7
votes
Accepted
The essential differences between IND-CCA1 and IND-CCA2?
IND-CCA1 is INDistinguishability under Chosen Ciphertext Attack.
IND-CCA2 is INDistinguishability under adaptive Chosen Ciphertext Attack.
In both, an adversary attempts to decipher a ciphertext $C$ ...
- 144k
6
votes
Bleichenbacher attack, binary search, formula for $s_i$
Okay, I examined this for a while, and I'm pretty sure this is more of an oversight. They probably wanted to take $r\ge2bs_{i-1}-2B=2(bs_{i-1}-B)$. The same correction should go into the code. (Taking ...
- 142
6
votes
Accepted
How any attack on a cipher carried out? Are these practical or only theoretical?
I'll answer your questions in order:
1. If any paper mentions attack as $2^{140}$, how the researchers determine this number of operations?
By examining the mathematical properties of the algorithm ...
- 93.9k
6
votes
Accepted
Indistinguishability versus semantic security?
The definition of semantic security has its origins in the definition of perfect security, where the adversary's information about the message is the same after seeing the ciphertext. Semantic ...
- 4,817
6
votes
Accepted
Differences between NewHope-CPA-KEM and NewHope-CCA-KEM
Well, it turns out that a straight-forward implementation of LWE key exchanges is vulnerable to chosen ciphertext attacks, in the case that one side reuses the same private value $a$ multiple times.
...
- 150k
6
votes
Accepted
What do NM-CPA and NM-CCA mean?
There's a classic paper by Bellare, Desai, Pointcheval and Rogaway about the standard security notions: "Relations Among Notions of Security for Public Key Encryption Schemes" (PDF). This paper ...
- 46.3k
6
votes
Accepted
How many required known plaintexts for an attack are considered insecure?
Firstly, is this a correct threshold for considering a cipher secure?
Not exactly. Security is a spectrum, so what is secure for some applications may not be secure for others. Is a $2^{-64}$ ...
- 15.4k
6
votes
Attack on security model for RSA-FDH
This is
a) no attack on the security model, but an attack in the security model of EUF-CMA, and
b) a generic attack on any signature scheme that signs the hash of a message instead of the message ...
- 2,958
6
votes
AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?
Is it acceptable to return the wrong plaintext if the tag is incorrect?
No. For one, it's against the spec quoted in question.
How bad is it to return the wrong plaintext anyway?
It's bad at least ...
- 144k
6
votes
AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?
There are several reasons for an authenticated decryption (with AES-GCM or any other AE or AEAD mechanism) not to return any plaintext if the ciphertext is not authentic (i.e if the tag does not match)...
5
votes
RSA-CCA security of $m || H(m)$ as input to modular exponentiation
CCA security assumes CPA security, and $m || H(m)$ is not CPA secure. This is simple to show: say that $C = E(m || H(m))$ is known, then an adversary can simply guess $m'$ and encrypt that. Then $C' = ...
- 93.9k
5
votes
Accepted
Why is the lite version of Cramer-Shoup not IND-CCA2 secure?
CS-lite has the same homomorphic properties as ElGamal. In particular, compontentwise product of $\textsf{Enc}(pk,m_1)$ and $\textsf{Enc}(pk,m_2)$ is a valid encryption of $m_1 m_2$ (and hence will ...
- 14.1k
5
votes
Accepted
Can you help me understand indistinguishably as described in the CPA security definition?
Yes, your intuition is completely right (assuming a polynomial-time adversary and a super-polynomial message space, which is the usual setting). If the scheme were deterministic, then the adversary ...
- 5,032
5
votes
Accepted
AES-GCM secure against IND-CCA2
You would prove it the same way that you prove encrypt-then-MAC in general. In fact, since there are already generic proofs of the encrypt-then-MAC paradigm, and since AES-CTR is already proven as ...
- 28.1k
5
votes
Accepted
CPA-secure of $\Pi$ implies CPA-security of $\Pi||\Pi||\ldots||\Pi$
The proof of (1) is not given in the chapter on symmetric encryption since it requires knowing the hybrid proof technique that is taught in Chapter 7. However, the argument is proven in Chapter 11 for ...
- 28.1k
5
votes
Accepted
Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?
What you describe is Chosen-Plaintext Attack (CPA) and AES and secure block ciphers are designed to be secure against this.
Having $2^{16}$ chosen-plaintext under one key doesn't help you to extract ...
- 49.3k
Only top scored, non community-wiki answers of a minimum length are eligible