Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When it comes to designing new PKI-based key-exchange protocols, why are security proofs needed?

Without them, can we show a protocol's security? Does there exist a PKI-based key-exchange protocol that is secure without a security proof?

share|improve this question

closed as too broad by D.W., rath, Gilles, e-sushi, minar Sep 13 '13 at 19:47

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

If you cannot provide even a basic proof of security, or a reduction of the protocol security to the underlying algorithms in use, you should assume the protocol is insecure.

Even with a security proof, a logical analysis of attacks against the protocol should be performed, as a proof may be limited to security against a limited amount of attacks, and in practice all attacks must be considered, even those that are uncommon or even impractical.

share|improve this answer

Let me propose you this: Try to write down your protocol without any security proofs. Since you think that there are no attacks, give it a try here: Proverif ( or Scyther ( They are tools for formal verification of protocols. Not only will they tell you if your protocol is secure or not, but they will also show you how it can be attacked.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.