(A chosen ciphertext attack on RSA) Bob's public RSA key is (n, e). Alice sends Bob...

Transcribed Image Text:

(A chosen ciphertext attack on RSA) Bob's public RSA key is (n, e). Alice sends Bob the ciphertext c which Eve intercepts. Eve then picks some integer r, computes c' = c. pe mod n, and asks Bob to decrypt c' for her using his private key. (a) Explain how, if Bob provides Eve with the plaintext decryption of c' she can recover the original message m. (b) Will this attack allow her to decrypt future messages to Bob which she intercepts, or will she have to repeat the attack for each message? (c) (Harder) Can Bob distinguish between a nefarious chosen ciphertext attack as in (a) and a benign request to decrypt a ciphertext that will not expose a past plaintext? Hint: consider c' c mod n. It's exceedingly unlikely that c is not invertible mod n, so you may assume that it is. (A chosen ciphertext attack on RSA) Bob's public RSA key is (n, e). Alice sends Bob the ciphertext c which Eve intercepts. Eve then picks some integer r, computes c' = c. pe mod n, and asks Bob to decrypt c' for her using his private key. (a) Explain how, if Bob provides Eve with the plaintext decryption of c' she can recover the original message m. (b) Will this attack allow her to decrypt future messages to Bob which she intercepts, or will she have to repeat the attack for each message? (c) (Harder) Can Bob distinguish between a nefarious chosen ciphertext attack as in (a) and a benign request to decrypt a ciphertext that will not expose a past plaintext? Hint: consider c' c mod n. It's exceedingly unlikely that c is not invertible mod n, so you may assume that it is.

Answer rating: 100% (QA)

a In this chosen ciphertext attack scenario Eve intercepts the ciphertext c and computes c cre mod n She then asks Bob to decrypt d for her If Bob pro... View the full answer