-2

Let $G$ be a pseudorandom generator.

Is the scheme with encryption

$$\text{Enc}_k(m) = s \| \left( m\oplus G(k) \oplus s \right),\quad s\in\{0,1\}^n \text{ uniformly sampled},$$

and decryption

$$\text{Dec}_k(s,c) = c \oplus s \oplus G(k)$$

multi-message indistinguishable?

CRYPTONEWBIE
  • 468
  • 3
  • 12

2 Answers2

3

It is not entirely clear what you mean by "multi-message indistinguishable". I'm going to assume the weakest possible interpretation I can think of.

So consider the scenario where the adversary is trying to distinguish between the encryptions of two random pairs of messages without knowledge of any additional ciphertexts. I.e. your adversary gets as input two pairs of random messages $(m_0^0,m_0^1),(m_1^0,m_1^1)$ as well as $((s_0,c_0) =Enc_k(m_b^0),(s_1,c_1)=Enc_k(m_b^1))$ for a uniformly chosen bit $b$ and is supposed to guess $b$.

As observed by SEJPM, xoring with $s$ in your construction does not serve any purpose because $s$ is public and can therefore simply be removed. And once you've done that, the encryption is deterministic and you can completely cancel out the key and reveal the xor of the two messages.

So what our adversary does is simly check for which $a\in\{0,1\}$ it holds that $$m_a^0\oplus m_a^1 = c_0\oplus s_0 \oplus c_1 \oplus s_1$$ and output $a$.

This will be correct with overwhelming probability, because we have that $$c_0\oplus s_0 \oplus c_1 \oplus s_1\\ =m_b^0\oplus G(k) \oplus s_0 \oplus s_0 \oplus m_b^1 \oplus G(k) \oplus s_1 \oplus s_1\\ =m_b^0\oplus m_b^1.$$

The only ambiguity left would be if it so happens that $m_0^0\oplus m_0^1 = m_1^0\oplus m_1^1$ but that happens only with probability $2^{-n}$. So our adversary is successful with probability at least $1-2^{-n}$.

Maeher
  • 7,185
  • 1
  • 36
  • 46
0

No. First of all, you can strip out $s$ with regards to security properties. $s$ is part of the output, so the ciphertext $c$ may as well consist of $G(k) \oplus m$.

Now $G$ is only pseudo-random. Which means that it depends fully on the input parameters. And the only parameter given is the key $k$. Multi-message indistinguishable means that $k$ remains the same across multiple messages. This means that the output of $G$, lets call it the key stream value $g$ will have the same value as well.

So this scheme is identical to reusing a one-time pad (OTP), which in turn means that it is certainly not multi-message secure. Actually, it fails spectacularly with only 2 messages required to expose a lot of information on both of the messages.

Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323