Proving CPA security using a PRG in place of a PRF

Asked Feb 14 '17 at 23:53

Active Feb 16 '17 at 00:53

Viewed 731 times

I am stuck on a question involving a security proof. Any Hints on how to approach this is helpful and greatly appreciated.

Question is:

State whether the following scheme has indistinguishable encryptions in the presence of an eavesdropper and whether it is CPA-secure: In this case, the key is random $k\in \{0,1\}^n$.

To encrypt $m\in \{0,1\}^{n+1}$, pick a random $r\in \{0,1\}^n$, and send $\langle r, G(r)\oplus m\rangle$, where $G$ is a PRG with expansion factor $n+1$.

I think it is CPA- secure, but am having a hard time proving it. My rough idea is, given a PPT adversary A, construct an algorithm D, takes input $w\in \{0,1\}^{n+1}$, with no oracles. But how would D answer queries? Its not like the case where a PRF is used in place of $G$, when D can use its oracle to distinguish a random function from a pseudorandom function.

edited Feb 16 '17 at 00:53

e-sushi

17,891
12
83
229

asked Feb 14 '17 at 23:53

hlcrypto123

1

Hint: tell me where the encryption/ decryption algorithms use the secret key. – Mikero Feb 15 '17 at 00:17
It does not use the key at all. How does that help at all though? – hlcrypto123 Feb 15 '17 at 00:18
The key is what allows a legitimate recipient to decrypt but not an eavesdropper. – fkraiem Feb 15 '17 at 07:58
It's clearly not. given $C = (r',C')$ you can compute $m=C' \xor G(r')$. Notice that $G$ is public and known by everyone. – AntonioFa Feb 16 '17 at 08:43
Oh Yes if $G$ was known publicly then this question is easy, but that was one of the things I was not sure about. – hlcrypto123 Feb 17 '17 at 21:50
Thank you to everyone for the help. They really make a difference. – hlcrypto123 Feb 17 '17 at 21:54

Proving CPA security using a PRG in place of a PRF

0 Answers0