Is AES with random bitstring IND-CPA?

gb flag

Let $E:\{0,1\}^{128}\times\{0,1\}^{128}\to\{0,1\}^{128}$ be the AES encryption and $R\gets\{0,1\}^{128}$ uniform random bitstring. Would $E'(K,P):=R\mathbin\|E(K,P)\mathbin\|E(K,R\oplus P)$ be IND-CPA?

I am not sure about my opinion, but I think this would not be IND-CPA since $E$ is determistic and $R$ is used twice in $E'$, therefore showing some pattern.

Can someone explain if $E'$ can be IND-CPA?

DannyNiu avatar
vu flag
Hint: R is used twice in E', but is it used twice across two separate invocations?
DannyNiu avatar
vu flag
2nd hint: Is R used in all places where P is involved?
fgrieu avatar
ng flag
Hint: is $E(K,P)$ IND-CPA? Proof? Adapt that proof for $E′(K,P)$.
kelalaka avatar
in flag
Ill-defined question. Nobody needs $R$ and $E(K,R\oplus P)$ to decrypt! Assume that it is not. Can you show that $E$ is not $\text{Ind-CPA}$ assuming it was already..
Maarten Bodewes avatar
in flag
Funny, you could see this as ECB and CBC over the plaintext.

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.