Skip to main content
22 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Bruce Schneier foresaw your skepticism and directly answered this question in "Applied Cryptography": Known-plaintext attacks and chosen-plaintext attacks are more common than you might think. It ...
Wildcard's user avatar
  • 320
17 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

It's not necessary that you encounter a situation like this in the real world to motivate the definition. There are some weaker adversaries that you would like to rule out in your security model, and ...
Daniel's user avatar
  • 4,002
17 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Practical chosen-plaintext attacks have been discovered against modern cryptosystems like TLS/SSL. One noteworthy type of vulnerability can occur when a cryptosystem includes a compression step before ...
nomadictype's user avatar
12 votes
Accepted

Is SHA-1 secure when used to implement a PRNG

I read SHA1 is still a secured hashing function with no collision found as of now. You read an old text, this is not the case anymore since SHA-1 was SHAttered. In Java, we still use SHA1PRNG ...
Maarten Bodewes's user avatar
  • 93.3k
11 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

There are some interesting examples in section 3.4.2 of Katz-Lindell book. Here is just one of them: During World War II, the British placed mines at certain locations and (intentionally) managed to ...
Hamidreza's user avatar
  • 1,029
8 votes

IPSec vs SSL : Similarities and Differences

but do SSL and IPSec use different key schemes and algorithms from another to establish contexts? Well, given that, by IPsec, you mean only AH and ESP (that is, RFC4301-4303), well, the obvious ...
poncho's user avatar
  • 148k
8 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

The lead up to the Battle of Midway also involved a chosen plaintext attack. The Americans had mostly broken the Japanese code JN-25b, and knew the Japanese were attacking "AF". They guessed that "...
Eugene Styer's user avatar
  • 1,676
7 votes
Accepted

Security definition for IND-CPA of public key encryption

In public-key cryptography, the adversary is indeed able to create encryptions of their chosen messages $m_1$ and $m_2$ on their own. This is why any IND-CPA-secure public-key cryptosystem cannot be ...
Morrolan's user avatar
  • 1,157
6 votes

Who defined semantic security?

The source is the paper by Goldwasser and Micali on probabilistic encryption. The definition is of primary importance even though it is rarely used to prove security of encryption. The reason for this ...
Yehuda Lindell's user avatar
6 votes
Accepted

Indistinguishability versus semantic security?

The definition of semantic security has its origins in the definition of perfect security, where the adversary's information about the message is the same after seeing the ciphertext. Semantic ...
K.G.'s user avatar
  • 4,770
4 votes
Accepted

semantic security of RSA variant

No it's not. As a reminer: Semantic security is equivalent to IND-CPA. Semantic security is less commonly used, because most of the time proofs are less intuitive and more difficult. In the IND-CPA ...
tylo's user avatar
  • 12.7k
4 votes

How does Signal Messenger's Safety Number Work?

Here is a detailed blog post about the safety numbers: https://signal.org/blog/safety-number-updates/ They are unique per conversation and basically consist of hashes of your and your contact's ...
HorstKevin's user avatar
4 votes

Security of stream cipher with a priori knowledge of message

Can we analyze using hypothesis testing (given two messages m1 and m2 with the same distribution and analyze whether ciphertext leaks any information about messages) or using entropy bounds? If the ...
poncho's user avatar
  • 148k
4 votes
Accepted

Difference between a secure PRG and semantically secure encryption

I consider the SU Cryptography course on Coursera really good, up to certain level is very comprehensive. You should discuss these topics on the Coursera forum, IMHO you will be guided more precisely. ...
gusto2's user avatar
  • 1,194
4 votes
Accepted

Are there any security drawbacks for simply encrypting and MACing my JWS token (JWT)?

[I]f I want the JWS token content to be non-visible, I keep hearing people mention JWE. But is there a security reason why I shouldn't be encrypting them myself? On the contrary, there is a security ...
Squeamish Ossifrage's user avatar
4 votes

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

What you are doing sounds like piling on complexity of dubious value without a clear understanding of what security the components actually provide, in the hope that enough complexity will render the ...
Squeamish Ossifrage's user avatar
4 votes
Accepted

Does adding OWF of the private key to encryption scheme hurts security?

It's possible to have a secure encryption scheme that ignores the first half of its key, and a secure OWF that leaks the entire second half of its input. Composing them as in your question results in ...
Mikero's user avatar
  • 13.7k
4 votes

Why is encrypting a key under itself dangerous?

Let $E$ be your cipher. Consider the following cipher: $$E_{k}'(m) = \begin{cases} k & m =k\\ E_k(m) & \text{else} \end{cases}$$ I believe you should be able to reduce the security of $E'$ to ...
Mark Schultz-Wu's user avatar
  • 13.5k
4 votes
Accepted

Are there different definitions of secure two-party computation?

Defining indistinguishability is very tricky. I actually think that the definition in the book by Evans et al. is too weak, but maybe Mike Rosulek will weigh in. If you define security by saying that ...
Yehuda Lindell's user avatar
4 votes
Accepted

How are probabilities combined in the game hopping proof technique?

The three equations you reference are (we'll just take them as truth - their proof can be found in the PDF): $$ \begin{align} |Pr[S_0] - Pr[S_1]| & = \epsilon_{\text{ddh}} & \text{ (1)} \\ |Pr[...
Morrolan's user avatar
  • 1,157
4 votes
Accepted

Is the secret key kept constant in IND-CPA game?

Converting the comment into an answer; In the first step, the Challenger selects uniform random keys using $Key\_Gen$ with the security parameter $\lambda$ applied. During the whole Ind-CPA game, the ...
kelalaka's user avatar
  • 49k
3 votes

Proving that a function is negligible

Your solution is not correct. You have to show that $\mathbf{\text{negl}_2}$ satisfies the definition of negligible functions and what you "showed" actually is that given any sufficiently large ...
Hilder Vitor Lima Pereira's user avatar
3 votes

The output of experiments Real and Ideal in simulation-based security proof

The question is rather abstract, so the answer will be rather abstract too. In general in simulation-based proofs you compare two worlds (ideal and real). Consider some protocol $\pi$ between two or ...
Cryptonaut's user avatar
  • 1,076
3 votes

Security of stream cipher with a priori knowledge of message

Let the ciphertext be $e = s \oplus m$, with $m$ a message bit, and $s$ the stream cipher output. One key property of the XOR operator is that when the distribution of $s$ is equiprobable (50% 1's, ...
Ruben De Smet's user avatar
3 votes

Can a shift cipher attain perfect secrecy?

Shift cipher or ceasar cipher attains perfect secrecy only in the special case with the assumption that $26$ keys are used in equal probability in the shift cipher, and to encrypt each symbol we use a ...
Ankit Anurag's user avatar
3 votes
Accepted

Any case that can require to encrypt a certificate revocation list before distribution

No. A CRL is as public as the certificate it revokes; it has to be signed to guarantee authenticity, but not encrypted. There are no optional confidentiality requirements for CRL distribution in RFC ...
Henrick Hellström's user avatar
3 votes
Accepted

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

The AES-GCM forgery probability bounded by $qL/2^\tau$ where $q$ is the number of messages, $L$ is the maximum message length in 128-bit blocks, and $\tau$ is the length of the tag. Here you've ...
Squeamish Ossifrage's user avatar
3 votes
Accepted

Can semantic security protect against key recovery attack?

First of all a note about terminology: semantic security is a property of a cipher; it is not a method or algorithm, so "semantic security" cannot protect anything. Of course, if a cipher is ...
Maarten Bodewes's user avatar
  • 93.3k
3 votes
Accepted

What is the definition of semantic secure advantage?

$|\Pr[S] - \frac12|$ is a number between 0 and 1/2. $|2\Pr[S] - 1|$ is a number between 0 and 1. Some people just like the elegance of having 1 be the highest possible advantage, so they normalize the ...
Mikero's user avatar
  • 13.7k
3 votes
Accepted

Using embeddings to anonymize information

This is an interesting question! However, it requires being a bit more formal about what "anonymization" means to answer properly. No approach will result in a leakage-free solution, since ...
Sacha Servan-Schreiber's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible