8 ms·

> A one-time pad is vulnerable to chosen-ciphertext attacks No it isn't. A one-time pad in isolation is vulnerable to being malleable since it provides no auth

• some_furry 5y ago
  And that malleability can be exploited to send garbage messages in some contexts, which is vaguely classifiable as a "chosen-ciphertext attack" but I've edited my comment to be more precise in verbage.
  • orlp 5y ago
    > which is vaguely classifiable as a "chosen-ciphertext attack" Only if we interpret the jargon at face value as a layman. But is is jargon, with a specific meaning. A chosen-ciphertext attack isn't just any attack in which you send (modified) ciphertext to your victim, it specifically refers to breaking a cipher (by e.g. deriving the key) using the information gained from getting ciphertexts of your choice decrypted. The only information you can gain this way about a one-time-pad is a random keystream that will never be used again for anything.
    • l33t2328 5y ago
      Recall that in the CCA experiment, the decryption oracle uses the same key as the message in your challenge ciphertext.
      • powersnail 5y ago
        Is it really an OTP if you have an oracle that uses the same key? By definition of OTP, such an oracle should not exist, right?
        • l33t2328 5y ago
          It’s an oracle, we allow it to exist for the experiment.
          • powersnail 5y ago
            Then it’s not an oracle of OTP, but an oracle of a single-key XOR. If an encryption scheme cannot have an oracle by definition, then it automatically passes all tests which requires the attacker to access an oracle. Just like my wooden pencil is not vulnerable to stack overflow attacks.
            • l33t2328 5y ago
              Any encryption scheme may have an oracle by definition of oracle. You’re (possibly intentionally) changing the situation by refusing to allow OTP to be an actual encryption scheme. Here is a blog post that summarizes some facts about Vernan’s OTP as it is defined in cryptography: https://wiki.soimort.org/crypto/one-time-pad/ https://wiki.soimort.org/crypto/one-time-pad/ Regardless, this is a silly discussion with nothing to be gained by me.
              • powersnail 5y ago
                Well, my bad to have wasted your time with a silly discussion, then. I find it neither silly nor gain-less. I'm sorry that you feel differently.
                • l33t2328 5y ago
                  I meant that it’s all pretty trivial business, focusing on the technicalities of what oracle is used in what security experiment. Although if you were previously unfamiliar with the definitions at play I apologize for calling an informative discussion gain-less.
              • deleted 5y ago
                [deleted]
    • deleted 5y ago
      [deleted]
    • buildbot 5y ago
      The important part being that what makes a one time pad secure from this attack is that it is in fact, one time. If you re-use your keystream, well, it's not a one time pad.
• Ar-Curunir 5y ago
  That's not true. OTPs are vulnerable to adaptive chosen-ciphertext attacks, and don't satisfy IND-CCA2. This means the malleability allows learning the contents of the ciphertext. Recall that IND-CCA2 says "given encryption and decryption oracles, can the adversary figure out the contents of a challenge ciphertext". In the OTP case, the adversary proceeds as follows. Upon receiving the challenge ciphertext c = b xor r, where r is a random bit, it computes c' = 1 xor c = (1 xor b) xor r. It then asks for a decryption b' of c'. If b' = 1, then the adversary knows that 1 = 1 xor b => b = 0. If b' = 0, then adversary knows that 0 = 1 xor b => b = 1. So it learns the value of b without breaking the security of the OTP. This assumes that the same random bit r is used to encrypt c' and c, but there's no way for the challenger to force different bits.
  • RandomLensman 5y ago
    I think that is a bit of a stretch, as an OTP isn't maybe a "scheme" in the sense of IND-CCA2 and the attacker cannot force an encryption to happen by design.
    • some_furry 5y ago
      Let's assume a game where Alice and Bob are two military generals using One-Time Pads to encrypt a message and Mallory wants to confuse them. Alice -> Encrypt("RETREAT", Pad[128:7]) You intercept this message and you're not sure if it means "RETREAT" or "ADVANCE". But contextually, you know it's one of the two, and you want to sew confusion. Mallory -> XOR(Ciphertext, XOR("RETREAT", "ADVANCE")) -> Bob And then Bob reads this message as the opposite of what Alice sent. Bob -> Decrypt(Cipher2, Pad[128:7]) Thus, the lack of ciphertext integrity allowed Mallory to gain an advantage in her goal as an attacker to sew confusion between two generals. If Alice advances, Bob retreats, and vice versa. It doesn't really matter, to this security game, if you learn anything about the key from the malleability. You chose the ciphertext, and thus you succeeded in dividing their military force.
      • RandomLensman 5y ago
        Yes, but it also means you knew a lot about the clear text to do this. I don't think that there is dispute that malleability is an issue in OTPs. What is also not in dispute is that the message itself is secure against decryption absent other knowledge. The point that is made (and in other posts) is that on its own, OTP isn't enough in most situations - and I agree with that.
• l33t2328 5y ago
  It is vulnerable to chosen cipher text attacks. Give me a one time pad cipher text c of length n and a decryption oracle Dec(). Then the key k = Dec(0^n) and I can easily tell you that the message is c xor k.
  • kickling 5y ago
    Assuming you have the Decryption oracle is the same as assuming you have the key in your example, so you are just saying a OTP is vulnerable if you have the key. This is true for any encryption scheme that I can think of.
    • l33t2328 5y ago
      This is not generally true. You can easily imagine a cryptosystem where having a decryption Oracle does not give the key. The fact that it is so easy to get the key given a decryption oracle for OTP just tells us that it’s really easy to show that it’s not CCA secure. The definition of CCA secure allows a decryption oracle with the same key as the challenge ciphertext.
      • Robotbeat 5y ago
        Being a one-time pad makes it irrelevant if you get the key. So it’s CCA secure because you never reuse the pad. You’ve gathered no useful information, ie you’ve only gathered noise that has no use.
        • l33t2328 5y ago
          It is not CCA secure because an adversary with access to a decryption oracle may get the key that was used to encrypt a challenge ciphertext via the method I’ve described. In the CCA experiment, the oracle uses the same key as the challenge ciphertext.
          • Robotbeat 5y ago
            But the OTP is still secure against that attack because the “key” is never reused. It is literally just noise, no useful information whatsoever.