Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
16 votes
Accepted

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

There is an article* that answers the question in the negative for GCM and CCM. The article introduces the first formalization of the Releasing Unverified Plaintext (RUP) setting. The related security ...
kelalaka's user avatar
  • 48.7k
15 votes

Does Grover's algorithm really threaten symmetric security proofs?

Yes, but also no. Grover's algorithm is actually quadratically faster than classical algorithms. However there are a few catches. Quantum computers are slow and expensive. This means that in the near ...
Oscar Smith's user avatar
13 votes
Accepted

Does Grover's algorithm really threaten symmetric security proofs?

Despite the classical security proof, Grover's algorithm threatens symmetric key cryptography. The main reason is that classical security proof assumes that the adversary makes classical queries to ...
Hhan's user avatar
  • 438
12 votes
Accepted

Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?

I know of two lines of work on this question. It is indeed possible to allow malleability but still make some guarantees in the presence of a chosen-ciphertext attack: Manoj Prabhakaran & Mike ...
Mikero's user avatar
  • 13.4k
12 votes

What do NM-CPA and NM-CCA mean?

A cipher $E_k(m)$ is malleable if there is a nontrivial binary relation $\sim$ on messages such that given $c = E_k(m)$, it is easy to find $c' = E_k(m')$ with $m \sim m'$. For example, AES-CTR is ...
Squeamish Ossifrage's user avatar
12 votes

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

how can we prevent the cipher from being returned in case the tag is wrong ? As far as I understand, to compute the tag the decryption process must be done entirely. Actually, GCM decryption can be ...
poncho's user avatar
  • 148k
11 votes

Are common (secure) stream ciphers CCA1-secure?

For stream ciphers, IND-CCA1 and IND-CPA security differ precisely in that an attacker can choose the IV in the CCA1 game (because that's part of the ciphertext that can be submitted to the decryption ...
fgrieu's user avatar
  • 142k
11 votes

Does Grover's algorithm really threaten symmetric security proofs?

Does Grover's algorithm really threaten symmetric cryptography? Lov K. Grover's algorithm reduces the key search into $\mathcal{O}(\sqrt{2^n})$ instead of the $\mathcal{O}(2^n)$. What is generally ...
kelalaka's user avatar
  • 48.7k
9 votes
Accepted

Are common (secure) stream ciphers CCA1-secure?

Let's consider CTR mode encryption with a random IV for a block cipher (essentially the same as stream cipher, but simpler to analyze since the formalization of stream cipher security is not fully ...
Yehuda Lindell's user avatar
8 votes
Accepted

Indistinguishability of symmetric encryption under CCA

CCA security always seems extreme to people who are just learning about it. The premise seems ridiculous, why would we give the attacker so much power? Why would we just let the attacker decrypt ...
Mikero's user avatar
  • 13.4k
8 votes
Accepted

Does CCA security imply perfect secrecy?

Perfect secrecy & [the traditional/standard definition of] CCA security are incompatible. Shannon's theorem says that if you want perfect secrecy, then the key needs to be longer than the total ...
Mikero's user avatar
  • 13.4k
8 votes

Does Grover's algorithm really threaten symmetric security proofs?

I'm going to answer the question in your headline and then go forward. No. Grover's algorithm is a canard and you ought to stop worrying about it. The major reason for this is that Grover reduces the ...
Jon Callas's user avatar
  • 2,304
7 votes

Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?

Bouncy Castle Java releases 1.60 and FIPS 1.0.1 (and former) have precisely the issue exploited in Manger's attack: an exception occurs when a ciphertext $c$ is submitted such that $c^d\bmod N$, ...
fgrieu's user avatar
  • 142k
7 votes
Accepted

CPA + one-time strong signature --> CCA?

The construction can't be made CCA-secure The algorithm that you wrote doesn't say how the decryption algorithm obtains the signature verification key. If the verification key is part of the public ...
Mikero's user avatar
  • 13.4k
7 votes
Accepted

The essential differences between IND-CCA1 and IND-CCA2?

IND-CCA1 is INDistinguishability under Chosen Ciphertext Attack. IND-CCA2 is INDistinguishability under adaptive Chosen Ciphertext Attack. In both, an adversary attempts to decipher a ciphertext $C$ ...
fgrieu's user avatar
  • 142k
6 votes

Bleichenbacher attack, binary search, formula for $s_i$

Okay, I examined this for a while, and I'm pretty sure this is more of an oversight. They probably wanted to take $r\ge2bs_{i-1}-2B=2(bs_{i-1}-B)$. The same correction should go into the code. (Taking ...
Ritam Bhaumik's user avatar
6 votes
Accepted

How any attack on a cipher carried out? Are these practical or only theoretical?

I'll answer your questions in order: 1. If any paper mentions attack as $2^{140}$, how the researchers determine this number of operations? By examining the mathematical properties of the algorithm ...
Maarten Bodewes's user avatar
6 votes
Accepted

Indistinguishability versus semantic security?

The definition of semantic security has its origins in the definition of perfect security, where the adversary's information about the message is the same after seeing the ciphertext. Semantic ...
K.G.'s user avatar
  • 4,742
6 votes
Accepted

Differences between NewHope-CPA-KEM and NewHope-CCA-KEM

Well, it turns out that a straight-forward implementation of LWE key exchanges is vulnerable to chosen ciphertext attacks, in the case that one side reuses the same private value $a$ multiple times. ...
poncho's user avatar
  • 148k
6 votes
Accepted

What do NM-CPA and NM-CCA mean?

There's a classic paper by Bellare, Desai, Pointcheval and Rogaway about the standard security notions: "Relations Among Notions of Security for Public Key Encryption Schemes" (PDF). This paper ...
SEJPM's user avatar
  • 46.1k
6 votes
Accepted

How many required known plaintexts for an attack are considered insecure?

Firstly, is this a correct threshold for considering a cipher secure? Not exactly. Security is a spectrum, so what is secure for some applications may not be secure for others. Is a $2^{-64}$ ...
forest's user avatar
  • 15.3k
6 votes

Attack on security model for RSA-FDH

This is a) no attack on the security model, but an attack in the security model of EUF-CMA, and b) a generic attack on any signature scheme that signs the hash of a message instead of the message ...
mephisto's user avatar
  • 2,908
6 votes

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

Is it acceptable to return the wrong plaintext if the tag is incorrect? No. For one, it's against the spec quoted in question. How bad is it to return the wrong plaintext anyway? It's bad at least ...
fgrieu's user avatar
  • 142k
6 votes

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

There are several reasons for an authenticated decryption (with AES-GCM or any other AE or AEAD mechanism) not to return any plaintext if the ciphertext is not authentic (i.e if the tag does not match)...
Gilles 'SO- stop being evil''s user avatar
5 votes

What is the meaning of IND-CCA secure under standard model?

Your questions can be split in two: What is the meaning of IND-CCA secure? What have an adversary access in a challenger-adversary game? This basically means that the scheme achieves the ...
cygnusv's user avatar
  • 5,002
5 votes
Accepted

Can you help me understand indistinguishably as described in the CPA security definition?

Yes, your intuition is completely right (assuming a polynomial-time adversary and a super-polynomial message space, which is the usual setting). If the scheme were deterministic, then the adversary ...
cygnusv's user avatar
  • 5,002
5 votes
Accepted

Is a chosen ciphertext attack on PGP still possible?

RFC 4880, OpenPGP (superseded RFC 2440 which was up to date in 2002) contains a chapter on security considerations, which also discusses the decryption oracle attack Jallad et al described: In late ...
Jens Erat's user avatar
  • 1,333
5 votes
Accepted

Why is the lite version of Cramer-Shoup not IND-CCA2 secure?

CS-lite has the same homomorphic properties as ElGamal. In particular, compontentwise product of $\textsf{Enc}(pk,m_1)$ and $\textsf{Enc}(pk,m_2)$ is a valid encryption of $m_1 m_2$ (and hence will ...
Mikero's user avatar
  • 13.4k
5 votes

RSA-CCA security of $m || H(m)$ as input to modular exponentiation

CCA security assumes CPA security, and $m || H(m)$ is not CPA secure. This is simple to show: say that $C = E(m || H(m))$ is known, then an adversary can simply guess $m'$ and encrypt that. Then $C' = ...
Maarten Bodewes's user avatar
5 votes
Accepted

AES-GCM secure against IND-CCA2

You would prove it the same way that you prove encrypt-then-MAC in general. In fact, since there are already generic proofs of the encrypt-then-MAC paradigm, and since AES-CTR is already proven as ...
Yehuda Lindell's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible