Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

New answers tagged


An easier way to say what Ilmari Karonen said is: Choose the plaintext to be the identity matrix. Thus, when it is multiplied by the key, the resultant ciphertext will be the key it self.


Since BFV scheme is IND-CPA secure, its valid fresh ciphertexts should be indistinguishable from malformed ones (i.e., drawn from uniform distribution). IND-CPA says that someone who doesn't know the secret key cannot distinguish those two distributions. However, the experiment result shows that a uniformly-distributed ciphertext does not form a valid ...


First, I would not call this AES-ECB, since adding randomness means that it is not ECB. Second, when limiting the message space to what fits into one block, asymptotically -- meaning for a pseudorandom permutation with block size $n$ -- this construction is actually even CCA-secure (and so non-malleable, since indistinguishability and non-malleability are ...


Is it still distinguishable under chosen plaintext? Yes; consider the encryption of $2^{32}$ occurrences of the same 8 byte block; it is likely that two of the blocks will have the same random padding (and hence the same 16 byte ciphertext block).

Top 50 recent answers are included