34 votes
Accepted

What do the signature security abbreviations like EUF-CMA mean?

Notation. Sets are represented using the calligraphic font and algorithms using the straight font. Throughout, $\Sigma:=(\mathsf{K},\mathsf{S},\mathsf{V})$ denotes a signature scheme on a key-space $\...
ckamath's user avatar
  • 5,178
22 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Bruce Schneier foresaw your skepticism and directly answered this question in "Applied Cryptography": Known-plaintext attacks and chosen-plaintext attacks are more common than you might think. It ...
Wildcard's user avatar
  • 320
17 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

It's not necessary that you encounter a situation like this in the real world to motivate the definition. There are some weaker adversaries that you would like to rule out in your security model, and ...
Daniel's user avatar
  • 3,932
17 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Practical chosen-plaintext attacks have been discovered against modern cryptosystems like TLS/SSL. One noteworthy type of vulnerability can occur when a cryptosystem includes a compression step before ...
nomadictype's user avatar
14 votes
Accepted

Does IND-CPA imply PRF?

If there exists an IND-CPA symmetric encryption scheme (where the key is shorter than the total length of the messages, i.e., the scheme is not the OTP), then there are one-way functions. A sequence ...
Geoffroy Couteau's user avatar
13 votes

Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

The answer by mwhs is very wrong about CBC-MAC and its use of IV!! It is perfectly fine and secure to use the same IV for CBC-MAC! In fact, Jonathan Katz and Yehuda Lindell recommend using zero vector ...
bhass1's user avatar
  • 248
12 votes
Accepted

Chosen Plaintext attack on AES in ECB mode

Suppose we have a block cipher that takes a 16 byte plaintext and produces a 16 byte ciphertext (that is to say $\mathcal{Enc}: \{0,1\}^{128} \rightarrow \{0, 1\}^{128}$). We use this block cipher to ...
puzzlepalace's user avatar
  • 4,012
11 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

There are some interesting examples in section 3.4.2 of Katz-Lindell book. Here is just one of them: During World War II, the British placed mines at certain locations and (intentionally) managed to ...
Hamidreza's user avatar
  • 1,019
10 votes

how to prove our algorithm is secure against chosen plaintext attack?

The usual approach to prove IND-CPA security is to construct a logical argumentation called "reduction". In this argumentation you first start with the assumption that certain computational problem is ...
cygnusv's user avatar
  • 4,952
10 votes

What do NM-CPA and NM-CCA mean?

A cipher $E_k(m)$ is malleable if there is a nontrivial binary relation $\sim$ on messages such that given $c = E_k(m)$, it is easy to find $c' = E_k(m')$ with $m \sim m'$. For example, AES-CTR is ...
Squeamish Ossifrage's user avatar
9 votes
Accepted

Are there deterministic private-key encryption schemes that are CPA-secure?

Summarizing fkraiem's comment, a CPA-secure encryption scheme can not be deterministic. The reason is simple: the attacker is challenged to distinguish between the encryption of $m_0$ and $m_1$, but ...
Daniel's user avatar
  • 3,932
9 votes
Accepted

Why do the messages in IND-CPA have to be of same length

Here is an outline of such a distinguisher would work; if you submit a one byte plaintext, then the resulting ciphertext length will follow some probability distribution (with many ciphers, it will be ...
poncho's user avatar
  • 146k
9 votes

Is it possible to build a CPA-secure encryption scheme which remains secure even when the encryption of secret key is given?

You're in luck! Essentially every secure public-key encryption scheme on bit strings that is actually in use already has this property—and, even better, not just IND-CPA but often IND-CCA2/NM-CCA2*—...
Squeamish Ossifrage's user avatar
8 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

The lead up to the Battle of Midway also involved a chosen plaintext attack. The Americans had mostly broken the Japanese code JN-25b, and knew the Japanese were attacking "AF". They guessed that "...
Eugene Styer's user avatar
  • 1,676
8 votes
Accepted

Does AES-ECB with random padding added to each block satisfy IND-CPA?

First, I would not call this AES-ECB, since adding randomness means that it is not ECB. Second, when limiting the message space to what fits into one block, asymptotically -- meaning for a ...
Yehuda Lindell's user avatar
8 votes

A modern rotor machine, could it be any safe?

No, modern standards for symmetric cryptography are heavily over-engineered and the power of chosen plaintext attacks/chosen ciphertext attacks can quickly uncover the structure of such a variant ...
Daniel S's user avatar
  • 22.8k
7 votes

Is One Time Pad considered Chosen-Plaintext Attack Secure?

Yes, the one-time pad model provides the technical notion of IND-CPA security. An adversary's advantage at the IND-CPA game is zero if the pad is uniform random. This is a standard—and, once you get ...
Squeamish Ossifrage's user avatar
7 votes
Accepted

Construct IND-CPA secure encryption scheme by combining two given schemes

The first remark is that the cryptosystems are used with independent keys. This is important, otherwise it is usually very hard to prove anything. The simple solution Now, the simple solution is, as ...
K.G.'s user avatar
  • 4,607
7 votes
Accepted

ElGamal CPA secure

So let's go through the IND-CPA game, shall we? Pick two messages $m_0$ and $m_1$ arbitrarily. Send them to the challenger who chooses $b\in\{0,1\}$ uniformly at random and returns you $c=E(m_b)$. ...
SEJPM's user avatar
  • 45.9k
7 votes
Accepted

CPA-security of CTR mode

One gap in your proposed argument is that $ctr$ is known to the adversary (it is included in the ciphertext), whereas saying "$G_k(ctr)$ is pseudorandom" implicitly assumes that both $k$ and $ctr$ are ...
Chris Peikert's user avatar
7 votes
Accepted

Is it possible to build a CPA-secure encryption scheme which remains secure even when the encryption of secret key is given?

It turns out that what you are looking for is not trivial... A scheme that satisfies such property is called (CPA) circular secure scheme. There are some schemes that satisfy that, but I don't know ...
Hilder Vitor Lima Pereira's user avatar
7 votes

AES with a different implementation of byte substitution step

If this is the mapping for the Sbox then $$ S(a\oplus b)=S(a)\oplus S(B),$$ i.e., we have a linear Sbox. If you add two vectors and shift it is the same result as shifting them first then adding. ...
kodlu's user avatar
  • 22k
6 votes

Difference left-or-right CPA security, IND-CPA security

As you are giving your adversary an access to an encryption oracle, I suppose that you implicitly consider the security of a symmetric encryption scheme. In the asymmetric setting, the definitions are ...
Geoffroy Couteau's user avatar
6 votes
Accepted

What happens if five messages are generated in IND-CPA security?

First things first: The adversary doesn't have to randomly pick messages, they can pick any messages they like, including heavily related ones. Now as for why the adversary has to identify the ...
SEJPM's user avatar
  • 45.9k
6 votes
Accepted

Does CPA-secure means security against differential cryptanalysis?

Differential cryptanalysis is a tool which is used to analyze symmetric primitives such as block ciphers and cryptographic hash functions. So it is applicable to CPA secure symmetric encryption ...
dade's user avatar
  • 1,323
6 votes
Accepted

Motivation of Adversarial Indistinguishability Experiment

My question is that in this game, it seems as if the adversary is choosing the two messages. Isn't this not simply an eavesdropping adversary, but rather one that can choose the messages being ...
Mikero's user avatar
  • 12.5k
6 votes
Accepted

Differences between NewHope-CPA-KEM and NewHope-CCA-KEM

Well, it turns out that a straight-forward implementation of LWE key exchanges is vulnerable to chosen ciphertext attacks, in the case that one side reuses the same private value $a$ multiple times. ...
poncho's user avatar
  • 146k
6 votes

Attack on security model for RSA-FDH

This is a) no attack on the security model, but an attack in the security model of EUF-CMA, and b) a generic attack on any signature scheme that signs the hash of a message instead of the message ...
mephisto's user avatar
  • 2,888
5 votes

Affine cipher and plaintext attacks, how to find the base modulo?

Well, to start off with, we have: $$k_1 m_1 + k_2 - n_1 p = c_1$$ $$k_1 m_2 + k_2 - n_2 p = c_2$$ $$k_1 m_3 + k_2 - n_3 p = c_3$$ Where we know $m_1, c_1, m_2, c_2, m_3, c_3$, and we don't know $k_1,...
poncho's user avatar
  • 146k

Only top scored, non community-wiki answers of a minimum length are eligible