Tag
chosen-ciphertext
- Jan 17, 2025 The Release of Unverified Plaintext Problem in AEAD APIs Why a decryption function that returns plaintext before the tag is checked reintroduces chosen-ciphertext attacks, and how streaming interfaces force the verification decision into the caller. cryptography
- Nov 1, 2024 RSA Padding and Why Textbook RSA Fails Textbook RSA is multiplicative and deterministic, which makes it malleable and open to chosen-ciphertext attacks; how OAEP and PSS impose the structure that closes them. cryptography
- Mar 26, 2024 All-or-Nothing Transforms and the Extra Tightness in ML-KEM Why the Fujisaki-Okamoto transform alone leaves a small gap in decapsulation security, and how an all-or-nothing transform closes it for lattice schemes. cryptography
- Mar 21, 2024 Encrypt-and-MAC, MAC-then-Encrypt, Encrypt-then-MAC Three orderings of a cipher and a MAC, only one of which authenticates the ciphertext itself, and the attacks that distinguish them under chosen-ciphertext access. cryptography
- Oct 2, 2023 How a Padding Check Becomes a Decryption Oracle Byte-at-a-time plaintext recovery against CBC from a single bit of observable padding validity, the arithmetic that makes it work, and why constant-time unpadding does not close the hole. cryptography