Classes of attacks and Security Models

The attacks an adversary can mount can be classified as follows:

1. A passive attack where the adversary only monitors the communication channel. A passive attacker only threatens confidentiality of data
2. An active attack is one where the adversary attempts to delete, add or in some other way alter the transmission channel. An active attacker threatens data integrity, authentication as well as confidentiality.

Attacks on encryption schemes:

1. Cipher text only attack:

Adversary tries to deduce the decryption key or plaintext by only observing the cipher text. encryption scheme vulnerable to this attack is completely insecure

2. Known plaintext attack

Adversary has a quantity of plaintext and corresponding cipher text. This type of attack is only marginally more difficult to mount.

3. Chosen plaintext attack

Adversary choses plaintext and is then given corresponding cipher text. Then tries to deduce information to help him deduce other cipher texts

1. A key $k$ is generated by running $Gen(1^n)$.
2. The adversary $\mathcal{A}$ is given input $1^n$ and oracle access to $Enc_k(·)$, and outputs a pair of messages $m_0, m_1$ of the same length.
3. A uniform bit $b \in \{0,1\}$ is chosen, and then a cipher text $c \leftarrow Enc_k(m_b)$ is computed and given to $\mathcal{A}$.
4. The adversary $\mathcal{A}$ continues to have oracle access to $Enc_k(·)$, and outputs a bit $b^\prime$.
5. The output of the experiment is defined to be $1$ if $b^\prime = b$, and $0$ otherwise. In the former case, we say that $\mathcal{A}$ succeeds.
6. The encryption scheme $\Pi$ is CPA-secure if $Pr[\text{PrivK}_{\mathcal{A}, \Pi} ^ {\text{cpa}}(n) = 1] \le \frac{1}{2}$

4. Adaptive chosen plaintext attack

the choice of plaintext may depend on the cipher text received from previous requests

5. Chosen cipher text attack:

One where adversary selects the cipher text and is then given the corresponding plain text. the objective then is to be able to deduce the plain text from the other cipher text.

CCA in-distinguishability experiment

1. $Gen(1^n)$ is run to obtain keys $(pk,sk)$.
2. The adversary $\mathcal{A}$ is given $pk$ and access to a decryption oracle $\text{Dec}_{sk}(·)$. It outputs a pair of messages $m_0$ , $m_1$ of the same length. (These messages must be in the message space associated with $pk$.)
3. A uniform bit $b \in \{0,1\}$ is chosen, and then a ciphertext $c \leftarrow \text{Enc}_{pk}(m_b)$ is computed and given to $\mathcal{A}$.
4. $\mathcal{A}$ continues to interact with the decryption oracle, but may not request a decryption of $c$ itself. Finally, $\mathcal{A}$ outputs a bit $b^\prime$.
5. The output of the experiment is defined to be $1$ if $b^\prime = b$, and $0$ otherwise.

Attacks on Protocols

1. Known-key attack:

Adversary obtains some keys that were used previously and uses them to deduce the new key being used.

2. replay:

adversary records a communication session and replays the entire or partial session at some later point in time

3. impersonation:

Adversary assumes the identity of one of the legitimate parties in a network

4. dictionary:

Usually an attack against passwords. Typically passwords are stored as hashed values. When a user logs on and enters a password, it is hashed and checked against the stored hash.

Adversary can take a list of all probable passwords hash them and try to match the hashes hoping to finding a match.

5. Forward search:

The attack is similar to the dictionary attack and is used to decrypt messages. (Makes sense when the message space $\mathcal{M}$ is small??) (Wont this type of attack require deterministic encryption scheme and if that wont this type of scheme be vulnerable to chosen plain text attack??)

6. Interleaving attack:

this type of attack usually involves some form of impersonation in an authentication protocol

Models for evaluating security

The security of cryptographic primitives and protocols can be evaluated under several different models.

1. Unconditional security

Unconditional security for encryption systems is called perfect secrecy.

For perfect secrecy, the uncertainty in the plaintext, after observing the cipher text must be equal to the priori uncertainty about the plain text.

A necessary condition for symmetric key encryption schemes to be unconditionally secure is that the key be at least as long as the message.

Asymmetric key encryption schemes cannot be unconditionally secure since, given a cipher text $c$, the plaintext can be in principle be recovered by encrypting all possible plaintext until $c$ is obtained.

2. Complexity theoretic security

An appropriate model of computation is defined and adversaries are modelled as having polynomial computational power. A proof of security relative to the model is then constructed.

Asymptotic analysis and worst case analysis is used and so care must be taken when determining proofs have practical significance.

3. Provable security

A cryptographic scheme is said to be provable if the difficult of defeating it can be show to be equivalent to solving a well known and supposedly difficult problem.

4. Computational Security

A proposed scheme is said to be computationally secure if the perceived level of computation required to defeat it exceeds, by a comfortable margin, the computational resource of the hypothesised adversary.

Most of the best known private and public key encryption schemes belong to this class. This class is aka practical security.