Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> which is vaguely classifiable as a "chosen-ciphertext attack"

Only if we interpret the jargon at face value as a layman. But is is jargon, with a specific meaning. A chosen-ciphertext attack isn't just any attack in which you send (modified) ciphertext to your victim, it specifically refers to breaking a cipher (by e.g. deriving the key) using the information gained from getting ciphertexts of your choice decrypted. The only information you can gain this way about a one-time-pad is a random keystream that will never be used again for anything.



The important part being that what makes a one time pad secure from this attack is that it is in fact, one time. If you re-use your keystream, well, it's not a one time pad.


Recall that in the CCA experiment, the decryption oracle uses the same key as the message in your challenge ciphertext.


Is it really an OTP if you have an oracle that uses the same key? By definition of OTP, such an oracle should not exist, right?


It’s an oracle, we allow it to exist for the experiment.


Then it’s not an oracle of OTP, but an oracle of a single-key XOR.

If an encryption scheme cannot have an oracle by definition, then it automatically passes all tests which requires the attacker to access an oracle.

Just like my wooden pencil is not vulnerable to stack overflow attacks.


Any encryption scheme may have an oracle by definition of oracle. You’re (possibly intentionally) changing the situation by refusing to allow OTP to be an actual encryption scheme.

Here is a blog post that summarizes some facts about Vernan’s OTP as it is defined in cryptography: https://wiki.soimort.org/crypto/one-time-pad/

Regardless, this is a silly discussion with nothing to be gained by me.


Well, my bad to have wasted your time with a silly discussion, then. I find it neither silly nor gain-less. I'm sorry that you feel differently.


I meant that it’s all pretty trivial business, focusing on the technicalities of what oracle is used in what security experiment.

Although if you were previously unfamiliar with the definitions at play I apologize for calling an informative discussion gain-less.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: