CPA-Secure Encryption — Modes of Operation
Stub. Turning the abstract CPA-security definition (already covered) into concrete, deployed encryption modes: security against multi-key attacks, a generic hybrid construction, randomized counter mode and CBC mode (with their concrete parameter tradeoffs), the CBC-padding attack on TLS 1.0, and nonce-based variants of each.
Corresponds to Chapter 5. private-key-encryption-and-pseudorandomness already covers the definition of CPA security; this note covers the concrete block-cipher-based modes of operation that achieve it in practice. Covers security against multi-key attacks (an adversary attacking many independently-keyed instances at once), a generic hybrid PRG/PRF-plus-one-time-pad construction, randomized counter mode (encrypt a counter stream, XOR with plaintext — parallelizable, no padding needed) and CBC mode (chain each block’s encryption into the next, needing padding) as the two dominant concrete constructions, their relative performance/parameter tradeoffs, and the famous CBC-padding oracle attack on TLS 1.0 (decrypting ciphertext byte-by-byte by observing whether a server accepts or rejects malformed padding) as a cautionary case study — see transport-layer-security-and-tls for the broader TLS context. Closes with nonce-based (rather than fully random IV) variants of both modes.
Outline (TODO — flesh out each)
- Security against multi-key attacks
- Semantic security against chosen plaintext attack (recap)
- Building CPA-secure ciphers — a generic hybrid construction
- Randomized counter mode
- CBC mode
- Case study: CBC padding attack on TLS 1.0
- Concrete parameters — counter vs. CBC mode
- Nonce-based encryption (hybrid, counter, and CBC variants)
- Fun application: revocable broadcast encryption