35
votes
Accepted
What do the signature security abbreviations like EUF-CMA mean?
Notation.
Sets are represented using the calligraphic font and algorithms using the straight font. Throughout, $\Sigma:=(\mathsf{K},\mathsf{S},\mathsf{V})$ denotes a signature scheme on a key-space $\...
- 5,418
22
votes
Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?
Bruce Schneier foresaw your skepticism and directly answered this question in "Applied Cryptography":
Known-plaintext attacks and chosen-plaintext attacks are more common than you might think. It ...
- 320
17
votes
Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?
It's not necessary that you encounter a situation like this in the real world to motivate the definition.
There are some weaker adversaries that you would like to rule out in your security model, and ...
- 4,022
17
votes
Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?
Practical chosen-plaintext attacks have been discovered against modern cryptosystems like TLS/SSL. One noteworthy type of vulnerability can occur when a cryptosystem includes a compression step before ...
- 271
15
votes
Accepted
Does IND-CPA imply PRF?
If there exists an IND-CPA symmetric encryption scheme (where the key is shorter than the total length of the messages, i.e., the scheme is not the OTP), then there are one-way functions. A sequence ...
- 20.8k
14
votes
Why is CBC with predictable IV considered insecure against chosen-plaintext attack?
The answer by mwhs is very wrong about CBC-MAC and its use of IV!! It is perfectly fine and secure to use the same IV for CBC-MAC! In fact, Jonathan Katz and Yehuda Lindell recommend using zero vector ...
- 258
12
votes
Accepted
Chosen Plaintext attack on AES in ECB mode
Suppose we have a block cipher that takes a 16 byte plaintext and produces a 16 byte ciphertext (that is to say $\mathcal{Enc}: \{0,1\}^{128} \rightarrow \{0, 1\}^{128}$). We use this block cipher to ...
- 4,062
12
votes
What do NM-CPA and NM-CCA mean?
A cipher $E_k(m)$ is malleable if there is a nontrivial binary relation $\sim$ on messages such that given $c = E_k(m)$, it is easy to find $c' = E_k(m')$ with $m \sim m'$. For example, AES-CTR is ...
- 49.1k
11
votes
Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?
There are some interesting examples in section 3.4.2 of Katz-Lindell book. Here is just one of them:
During World War II, the British placed mines at certain locations
and (intentionally) managed to ...
- 1,029
9
votes
Accepted
Are there deterministic private-key encryption schemes that are CPA-secure?
Summarizing fkraiem's comment, a CPA-secure encryption scheme can not be deterministic.
The reason is simple: the attacker is challenged to distinguish between the encryption of $m_0$ and $m_1$, but ...
- 4,022
9
votes
Accepted
Why do the messages in IND-CPA have to be of same length
Here is an outline of such a distinguisher would work; if you submit a one byte plaintext, then the resulting ciphertext length will follow some probability distribution (with many ciphers, it will be ...
- 150k
9
votes
Is it possible to build a CPA-secure encryption scheme which remains secure even when the encryption of secret key is given?
You're in luck! Essentially every secure public-key encryption scheme on bit strings that is actually in use already has this property—and, even better, not just IND-CPA but often IND-CCA2/NM-CCA2*—...
- 49.1k
8
votes
Accepted
ElGamal CPA secure
So let's go through the IND-CPA game, shall we?
Pick two messages $m_0$ and $m_1$ arbitrarily.
Send them to the challenger who chooses $b\in\{0,1\}$ uniformly at random and returns you $c=E(m_b)$.
...
- 46.3k
8
votes
Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?
The lead up to the Battle of Midway also involved a chosen plaintext attack. The Americans had mostly broken the Japanese code JN-25b, and knew the Japanese were attacking "AF". They guessed that "...
- 1,674
8
votes
Accepted
Is it possible to build a CPA-secure encryption scheme which remains secure even when the encryption of secret key is given?
It turns out that what you are looking for is not trivial... A scheme that satisfies such property is called (CPA) circular secure scheme.
There are some schemes that satisfy that, but I don't know ...
8
votes
Accepted
Does AES-ECB with random padding added to each block satisfy IND-CPA?
First, I would not call this AES-ECB, since adding randomness means that it is not ECB. Second, when limiting the message space to what fits into one block, asymptotically -- meaning for a ...
- 28.1k
8
votes
A modern rotor machine, could it be any safe?
No, modern standards for symmetric cryptography are heavily over-engineered and the power of chosen plaintext attacks/chosen ciphertext attacks can quickly uncover the structure of such a variant ...
- 25.4k
7
votes
Is One Time Pad considered Chosen-Plaintext Attack Secure?
Yes, the one-time pad model provides the technical notion of IND-CPA security. An adversary's advantage at the IND-CPA game is zero if the pad is uniform random. This is a standard—and, once you get ...
- 49.1k
7
votes
Accepted
CPA-security of CTR mode
One gap in your proposed argument is that $ctr$ is known to the adversary (it is included in the ciphertext), whereas saying "$G_k(ctr)$ is pseudorandom" implicitly assumes that both $k$ and $ctr$ are ...
- 5,863
7
votes
Accepted
The essential differences between IND-CCA1 and IND-CCA2?
IND-CCA1 is INDistinguishability under Chosen Ciphertext Attack.
IND-CCA2 is INDistinguishability under adaptive Chosen Ciphertext Attack.
In both, an adversary attempts to decipher a ciphertext $C$ ...
- 144k
7
votes
Accepted
Security definition for IND-CPA of public key encryption
In public-key cryptography, the adversary is indeed able to create encryptions of their chosen messages $m_1$ and $m_2$ on their own.
This is why any IND-CPA-secure public-key cryptosystem cannot be ...
- 1,157
7
votes
AES with a different implementation of byte substitution step
If this is the mapping for the Sbox then
$$
S(a\oplus b)=S(a)\oplus S(B),$$
i.e., we have a linear Sbox. If you add two vectors and shift it is the same result as shifting them first then adding.
...
- 23.1k
6
votes
Chosen Plaintext attack on AES in ECB mode
One way to carry out the chosen-prefix ECB mode attack you describe is as follows:
Step 1: Obtain the ciphertexts corresponding to the following 16 plaintexts, where each ...
- 46.4k
6
votes
Who defined semantic security?
The source is the paper by Goldwasser and Micali on probabilistic encryption. The definition is of primary importance even though it is rarely used to prove security of encryption. The reason for this ...
- 28.1k
6
votes
Why plain RSA encryption does not achieve CPA-security?
Plain "textbook" RSA is not CPA-secure because it is deterministic: encrypting the same plaintext always yields the same ciphertext.
In the IND-CPA security game, the attacker gets to choose two ...
- 46.4k
6
votes
Accepted
What happens if five messages are generated in IND-CPA security?
First things first: The adversary doesn't have to randomly pick messages, they can pick any messages they like, including heavily related ones.
Now as for why the adversary has to identify the ...
- 46.3k
6
votes
Accepted
Does CPA-secure means security against differential cryptanalysis?
Differential cryptanalysis is a tool which is used to analyze symmetric primitives such as block ciphers and cryptographic hash functions. So it is applicable to CPA secure symmetric encryption ...
- 1,323
6
votes
Accepted
Motivation of Adversarial Indistinguishability Experiment
My question is that in this game, it seems as if the adversary is choosing the two messages. Isn't this not simply an eavesdropping adversary, but rather one that can choose the messages being ...
- 14.1k
6
votes
Accepted
Differences between NewHope-CPA-KEM and NewHope-CCA-KEM
Well, it turns out that a straight-forward implementation of LWE key exchanges is vulnerable to chosen ciphertext attacks, in the case that one side reuses the same private value $a$ multiple times.
...
- 150k
Only top scored, non community-wiki answers of a minimum length are eligible