# Tag Info

## Hot answers tagged malleability

5

The point (( also see this answer)) is that the hash calculation is free for everybody and we assume that your methodology is known by Kerckhoffs's principles. Anybody can calculate the hash of any information and this may leak the encrypted message. In Cryptography, we consider the attackers computationally bounded, but not restricted to adapt any method on ...

4

The answer given by @kelalaka is 100% correct; this breaks the security of encryption and so shouldn't be used. However, I want to add that this doesn't even guarantee integrity. In particular, integrity should hold even if the attacker knows the message. Assume that the attacker knows $m$ and wishes to change the first bit. This change can be easily made (...

2

CBC-R To better understand the attack on the paper, It is better to look at the original CBC-R attack to understand the above attack. Practical Padding Oracle Attacks, Juliano Rizzo and Thai Duong. USENIX 2010 This work shows how to turn the padding oracle into an encryption oracle. With padding oracle, we can get decryption of any ciphertext. Choose a ...

1

Sounds a bit like coursework. (: Some ideas to get you started: Are you aware of how a ciphertext $C = (c_1, c_2)$ is constructed? That is, can you state $c_1$ and $c_2$ in terms of the message $m$, and the key pair $x, y$? Can you then state what form a ciphertext would have to have, in order to be a valid encryption of $m \cdot m'$? Once done, can you ...

1

It seems while this scheme fixes the "ciphertext-swapping" problem, it permits modifying the first block of ciphertext $C_1$ and the $IV$ together without affecting the decryption of the message at all. This is because the first block of plaintext $P_1 = D(C_1 \oplus IV)$, so therefore $C_1$ and $IV$ can be modified "together" without ...

1

This paper, AFAICT: https://www.cs.ucdavis.edu/~rogaway/papers/relations.pdf It is about the security of public-key encryption, but the proofs about the relations between security definitions are applicable to symmetric encryption.

Only top voted, non community-wiki answers of a minimum length are eligible