CBC not CCA secure

gsmoke1

5/14/24, 9:01 PM

I always get stuck at those kind of exercises in my Cryptography class. I just don't understand how should I build these scenarios of "sending m1 and m2 and then somehow telling if it was m1 or m2 etc..." attacks. Can someone explain to me in simple terms how can I describe a scenario for this exercise: "Show that the CBC mode is not CCA-secure by describing an attacker A and name its advantage."

And please any Book suggestions to learn those attacks, because I understand the theory, but when it comes to practice, I get stuck.

128

1 + 4

cbc

chosen-ciphertext-attack

fgrieu

5/15/24, 6:34 AM

Suggestions for this kind of exercise: 1) Write down the definitions you work with (here, of CCA-secure, and of CBC mode); it's strongly suggested that you [edit](https://crypto.stackexchange.com/posts/106519/edit) the question with that. 2) Meanwhile, make sure to use consistent notation (e.g. here, it's probably best to make the Initialization Vector part of the ciphertext so that CBC encryption matches the formalism of the CCA experiment). 3) If that does not impair the desired proof, go for the simplest (here: restricting to the less block of plaintext that make sense, e.g. one block).

gsmoke1

5/15/24, 12:22 PM

@fgrieu thank you:) Can you suggest me any site/book where I can practice these kind of attacks?

fgrieu

5/15/24, 1:48 PM

The definitions you should use are those in your class, because the level of formalism and the notations vary. For CCA, the problem statement most likely is about CCA2, which is explained [here](https://crypto.stackexchange.com/a/26738/555) (I say so because CBC is CCA1-secure). For CBC, any text source that makes IV the first block of ciphertext will do, e.g. [the HAC's drawing](https://cacr.uwaterloo.ca/hac/about/chap7.pdf#page=8) and alg 7.13. The proof itself would have a structure similar to [this](https://crypto.stackexchange.com/a/80912/555) (but I wish I had a better example).

fgrieu

5/15/24, 5:35 PM

[This answer](https://crypto.stackexchange.com/a/72662/555) could also help; at least, it contains a definition of IND-CCA2.

Score:1

Crypto

Richard Thiessen

5/19/24, 4:31 AM

The CPA security game involves guessing which of m1 and m2 the encryption oracle encrypted and returned as a challenge. Adversary picks both messages. They win if they do better than 50:50 random guessing. In simple terms, this means the adversary can distinguish between messages after they're encrypted.

CCA is the same but gives access to a decryption oracle that decrypts anything but the challenge value. Challenge values are obviously blacklisted or the adversary just asks for a decryption and then they know whether it was m1 or m2 and win trivially. CCA insecurity means the attacker can learn information about one encrypted message by decrypting another different chosen ciphertext.

CBC is malleable

bit flips in the IV flip bits in the first plaintext block
bit flips in ciphertext flip bits in the next plaintext block and randomise that plaintext block

So the attacker can decrypt blacklisted messages by flipping one of the IV bits, submitting that to the decryption oracle, and flipping the same bit in the first block of whatever comes back. This gets them around the blacklist and wins the game with 100% probability. The attacker has learned the challenge ciphertext by decrypting a related message.

In real applications malleability has real consequences, attackers can flip bits in the first block for free and the nth block at the cost of trashing the (n-1)th block.

+ 1

gsmoke1

5/22/24, 11:17 AM

thank you for the clarification. (sorry for the late reply)

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: CBC not CCA secure

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.