3 ms·
It is vulnerable to chosen cipher text attacks. Give me a one time pad cipher text c of length n and a decryption oracle Dec(). Then the key k = Dec(0^n) and
by l33t2328 5y ago
It is vulnerable to chosen cipher text attacks.
Give me a one time pad cipher text c of length n and a decryption oracle Dec(). Then the key k = Dec(0^n) and I can easily tell you that the message is c xor k.
- kickling 5y agoAssuming you have the Decryption oracle is the same as assuming you have the key in your example, so you are just saying a OTP is vulnerable if you have the key. This is true for any encryption scheme that I can think of.
- l33t2328 5y agoThis is not generally true. You can easily imagine a cryptosystem where having a decryption Oracle does not give the key. The fact that it is so easy to get the key given a decryption oracle for OTP just tells us that it’s really easy to show that it’s not CCA secure. The definition of CCA secure allows a decryption oracle with the same key as the challenge ciphertext.
- Robotbeat 5y agoBeing a one-time pad makes it irrelevant if you get the key. So it’s CCA secure because you never reuse the pad. You’ve gathered no useful information, ie you’ve only gathered noise that has no use.
- l33t2328 5y agoIt is not CCA secure because an adversary with access to a decryption oracle may get the key that was used to encrypt a challenge ciphertext via the method I’ve described. In the CCA experiment, the oracle uses the same key as the challenge ciphertext.
- Robotbeat 5y agoBut the OTP is still secure against that attack because the “key” is never reused. It is literally just noise, no useful information whatsoever.
- l33t2328 5y agoIt isn’t secure against the attack because the oracle uses the same key. The oracle is a tool used to formalize our definition. You’re right that the fact that OTP isn’t CCA secure doesn’t matter in practice because the key is only used for one message so such an oracle doesn’t generally exist.
- orlp 5y agoNo, Dec(0^n) would give you a unique keystream never used before or since. That is the whole point of the >>one-time<< pad.
- l33t2328 5y agoNo, in the CCA experiment the Dec() oracle uses the same key.
- orlp 5y agoEven if you make this assumption it still wouldn't be a successful attack because OTP makes no security claims if the key is re-used. If there's no security claim there's nothing to attack to begin with.
- l33t2328 5y agoIt would still be a successful attack for the purposes of the definition of CCA secure. In the CCA experiment, an attacker is given access to a decryption oracle that has used the same key as the challenge message.
- brazzy 5y agoThe definition of CCA is then simply incompatible with the definition of an OTP. Making the question wether OTP is vulnerable to CCA meaningless.
- l33t2328 5y agoThat’s not true at all. You can make an oracle for whatever you want. That’s why it’s an oracle.
- brazzy 5y agoIt absolutely is true. I can declare that my "brazzy attack" involves an oracle that for any given cipher text gives me the key it was encrypted with. Wow, all modern ciphers are vulnerable to it, the only thing that resists it is keeping the algorithm secret! Just because you can think of something doesn't mean it makes sense.