4 ms·

No, in the CCA experiment the Dec() oracle uses the same key.

orlp 5y ago
Even if you make this assumption it still wouldn't be a successful attack because OTP makes no security claims if the key is re-used. If there's no security claim there's nothing to attack to begin with.
- l33t2328 5y ago
  It would still be a successful attack for the purposes of the definition of CCA secure. In the CCA experiment, an attacker is given access to a decryption oracle that has used the same key as the challenge message.
  - brazzy 5y ago
    The definition of CCA is then simply incompatible with the definition of an OTP. Making the question wether OTP is vulnerable to CCA meaningless.
    - l33t2328 5y ago
      That’s not true at all. You can make an oracle for whatever you want. That’s why it’s an oracle.
      - brazzy 5y ago
        It absolutely is true. I can declare that my "brazzy attack" involves an oracle that for any given cipher text gives me the key it was encrypted with. Wow, all modern ciphers are vulnerable to it, the only thing that resists it is keeping the algorithm secret! Just because you can think of something doesn't mean it makes sense.
        l33t2328 5y ago
        I’m not sure what point you were trying to make. I think you accidentally made the opposite point. Indeed your definition would imply that all modern ciphers are not Brazzy-secure. I’m not sure why this matters to you. No one is saying that the fact that OTP cipher is not CCA secure is practically relevant. But the fact of the matter is that a cryptosystem being CCA secure is defined as we discussed and the OTP cipher does not meet the requirements.
        brazzy 5y ago
        I think we're largely in agreement then, but I still believe that it makes more sense to say that the definitions of OTP and CCA are incompatible and therefore it's just meaningless to apply one to the other.
nybble41 5y ago
"The same key" in the context of OTP means the same pad… all the key material shared between the sender and recipient. However, every encryption with that pad must use a different part of the pad or it isn't OTP at all. Not reusing bits from the key material is the defining characteristic of the One-Time Pad. The only reasonable formulation of IND-CPA, IND-CCA1, or IND-CCA2 for OTP involves the encryption and decryption oracles using a unique subset of the pad for each plaintext. That's part of the cryptosystem definition, much like the selection of unique, random nonce values. When put in those terms, the encryption and decryption oracles can only ever reveal the parts of the pad used to encrypt the adversaries' chosen plaintext, which doesn't provide any information which could be used to decrypt any other ciphertext, so OTP easily passes all three tests.
- l33t2328 5y ago
  You’re mistaken. CCA has a formal definition that may not match with your expectation, but in the definition of CCA, the same key that is used to encrypt the challenge message is used for the decryption oracle.
  - rocqua 5y ago
    Is there a point to arguing whether a system is CCA secure if the 'formal definition' uses the system in an explicitly wrong way? Especially if there is a trivial modification of the 'formal definition' that better matches the intention and allows for results that apply to reality? Of course there is the question of whether the modification is trivial, and whether the modification changes CCA meaningfully for other systems. But argue about that, whether a definition modification changes past results using that definition. Just stating 'that is not the formal definition' if the formal definition gets criticism and an alternative is suggested, is not really good-faith engagement with criticism.
    - l33t2328 5y ago
      Is there a point? Probably not. I’m just saying that as a matter of fact, OTP is not CCA secure. It may be secure under whatever alternative notions you’re proposing, but they’re not standard.

orlp 5y ago

Even if you make this assumption it still wouldn't be a successful attack because OTP makes no security claims if the key is re-used. If there's no security claim there's nothing to attack to begin with.

l33t2328 5y ago
It would still be a successful attack for the purposes of the definition of CCA secure. In the CCA experiment, an attacker is given access to a decryption oracle that has used the same key as the challenge message.
- brazzy 5y ago
  The definition of CCA is then simply incompatible with the definition of an OTP. Making the question wether OTP is vulnerable to CCA meaningless.
  - l33t2328 5y ago
    That’s not true at all. You can make an oracle for whatever you want. That’s why it’s an oracle.
    - brazzy 5y ago
      It absolutely is true. I can declare that my "brazzy attack" involves an oracle that for any given cipher text gives me the key it was encrypted with. Wow, all modern ciphers are vulnerable to it, the only thing that resists it is keeping the algorithm secret! Just because you can think of something doesn't mean it makes sense.
      - l33t2328 5y ago
        I’m not sure what point you were trying to make. I think you accidentally made the opposite point. Indeed your definition would imply that all modern ciphers are not Brazzy-secure. I’m not sure why this matters to you. No one is saying that the fact that OTP cipher is not CCA secure is practically relevant. But the fact of the matter is that a cryptosystem being CCA secure is defined as we discussed and the OTP cipher does not meet the requirements.
        brazzy 5y ago
        I think we're largely in agreement then, but I still believe that it makes more sense to say that the definitions of OTP and CCA are incompatible and therefore it's just meaningless to apply one to the other.

nybble41 5y ago

"The same key" in the context of OTP means the same pad… all the key material shared between the sender and recipient. However, every encryption with that pad must use a different part of the pad or it isn't OTP at all. Not reusing bits from the key material is the defining characteristic of the One-Time Pad. The only reasonable formulation of IND-CPA, IND-CCA1, or IND-CCA2 for OTP involves the encryption and decryption oracles using a unique subset of the pad for each plaintext. That's part of the cryptosystem definition, much like the selection of unique, random nonce values. When put in those terms, the encryption and decryption oracles can only ever reveal the parts of the pad used to encrypt the adversaries' chosen plaintext, which doesn't provide any information which could be used to decrypt any other ciphertext, so OTP easily passes all three tests.

l33t2328 5y ago
You’re mistaken. CCA has a formal definition that may not match with your expectation, but in the definition of CCA, the same key that is used to encrypt the challenge message is used for the decryption oracle.
- rocqua 5y ago
  Is there a point to arguing whether a system is CCA secure if the 'formal definition' uses the system in an explicitly wrong way? Especially if there is a trivial modification of the 'formal definition' that better matches the intention and allows for results that apply to reality? Of course there is the question of whether the modification is trivial, and whether the modification changes CCA meaningfully for other systems. But argue about that, whether a definition modification changes past results using that definition. Just stating 'that is not the formal definition' if the formal definition gets criticism and an alternative is suggested, is not really good-faith engagement with criticism.
  - l33t2328 5y ago
    Is there a point? Probably not. I’m just saying that as a matter of fact, OTP is not CCA secure. It may be secure under whatever alternative notions you’re proposing, but they’re not standard.