Score:0

Is the following scheme CCA secure? I purposed a scheme and I am not sure if it is CCA secure, if not, how can it be CCA secure?

kn flag

Here is my idea:

Under the symmetric key encryption. Alice and Bob share the symmetric key K. Let HASH be a secure hash function and Enc_k(message) be the encryption message m by AES in the CBC mode with a random IV

First, Alice compute c = Enc_k(message)

Second, Alice compute t = Hash(m)

Third, Alice sends (c, t) to Bob

Fourth, Bob receive (c, t), first verify if Hash(c) = t. If this is the case, Bob decrypts c using share K to output m.

Is this CCA secure? Why and why not? How can I improve this?

Maarten Bodewes avatar
in flag
Deleting your post along with the answer is not the way to behave here, undeleted it.
Score:3
tr flag

This scheme is not CCA secure because it is not even CPA secure. In fact, it is not CCA secure even if we would replace AES-CBC with a CCA secure scheme, to begin with. The issue is that the ciphertext includes a hash of the plaintext, which leaks lots of plaintext information.

Additionally, using a simple hash function as an integrity protection mechanism instead of a MAC is quite problematic. But even if you used a MAC instead of a hash function, this scheme is still not generically CCA secure. A MAC need not conceal information about the message that it is integrity-protecting.

kevin yang avatar
kn flag
Thank you, great answer i think
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.