A primitive or protocol with provable security is accompanied by a mathematical proof that shows how to reduce the security claims about the protocol to a set of assumptions.
0
votes
0answers
27 views
BAN Logic, Problem to Idealize the protocols
I'm studying the BAN logic.
In the application of it, there is a step,where I have to idealize the protocol
that I'm analyzing.
I have problems to make this.
Anyone that has expertise in BAN logic ...
2
votes
0answers
56 views
Questions about the ideal cipher model
I've read that we can study the security of modes of operation by assuming the use of an ideal block cipher. I've also seen a paper suggesting that the ideal cipher model could be something else than ...
3
votes
1answer
95 views
Proofs of security methodologies
I'm looking for course material on the subject of proofs, reductions, and games, as used to prove cryptographic schemes secure. What are the methodologies? What are the preferred ones? In what cases ...
0
votes
0answers
30 views
Conditions for proving that a signcryption scheme is secure
If I'm able to prove that any scheme satisfies confidentiality ad unforgeability conditions, will it be a valid signcryption scheme, without explicit signature and encryption parts ?
-2
votes
2answers
71 views
Perfect Secrecy, two Definitions
I'm reading the proof of the implication "Def 2.1 $\Rightarrow$ Def 2.4" in these slides about Adversarial Indistinguishability and Perfectly-Secret Encryption. I have a doubt in the slide 10. Here it ...
-2
votes
0answers
66 views
One time Pad Adversary
I like know Why $Pr[\mathsf{PRIV_{EAV}}(\Pi,A,n)=1] = 1/2$, when $\Pi$ is a One Time Pad. I trying:
$$Pr[\mathsf{PRIV_{EAV}}(\Pi,A,n)=1] = Pr[b'=0|b=0]Pr[b=0] + ...
1
vote
1answer
127 views
Indistinguishability attack example
I want solve the next exercise. The author defined the experiment for the cryptosystem $\Pi$, the adversary $A$ and the security parameter $n$ as follows
$\mathsf{PRIV_{EAV}}(\Pi,A,n)$
The ...
-1
votes
1answer
40 views
Sematically Secure McEliece
I am read the Lemma 2 (pp13) in the paper [1]. Here a make a question Why "for any $Hash_z$ and any $Gen$"? The author of paper reply
The reason why "for any $Hash_z$ and any $Gen$" is that if ...
0
votes
1answer
103 views
Is this scheme a provably fair random number generation?
I have thought up a method for generating random numbers between a client and a server which I hope is fair:
The client and server decide on a range in advance, $0$ trough $n-1$.
The server ...
1
vote
1answer
52 views
What does “securely realize” mean?
I was wondering what "securely realizes" means. I see this in some cryptographic papers but I don't know what it means for a protocol to "securely realize" a function $F$. Is it just a fancy way of ...
2
votes
1answer
81 views
Is it safe to assume Salsa20 to be a PRP?
Often in security proofs a certain block cipher is assumed to be a pseudorandom permutation or PRP. I wonder if this goes for stream ciphers as well, and specifically for Salsa20.
If limit ourselves ...
2
votes
1answer
75 views
Question about the definition of a secure PRF
I'm taking a cryptography introduction course, and we're covering the definition of a secure PRF.
I understand the test goes as follows: A challenger picks a function $f$ such that
$f \leftarrow ...
1
vote
1answer
67 views
Proof of the standard pseudorandom generator + XOR encryption scheme in Goldreich
Reading Goldreich's Foundations of Cryptography II, I found this proof for the security of the common pseudorandom generator + XOR encryption scheme (Proposition 5.2.12 in the book):
Assume you have ...
2
votes
1answer
130 views
What should I be aware of when implementing algorithms myself?
I plan to build my own crypto library. The project will be primarily for me to learn (and if useful for no other purpose, that is fine). In the past I have implemented a few hashes, and AES quite a ...
2
votes
0answers
85 views
Are there any secure commutative ciphers?
This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure.
My question is, here there any commutative ciphers out there that are secure ...
1
vote
1answer
69 views
Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model?
First of all, the Guillou-Quisquater digital signature scheme is:
Note everything is $\bmod n$. Message is denoted by $m$.
Private key: $s$
Public key: Hash function $H$, $e$, ...
0
votes
1answer
74 views
Why is Blum-Goldwasser not IND-CCA-2 secure?
Consider the Blum-Goldwasser encryption scheme as described on Wikipedia. I was told that it was not IND-CCA-2 secure.
I heard there was malleabilty, probably it has to do with XOR-ing. But I do not ...
1
vote
2answers
110 views
What are the differences between proofs based on simulation and proofs based on games?
what are the main pros and cons of proving the "security" of a crypto scheme under simulation proofs instead of game based proofs?
0
votes
1answer
126 views
Why is proof-by-reduction needed (for Elgamal proof of security, for example)?
The textbook proof for Elgamal encryption basically reduces to the Decisional Diffie-Hellman assumption (DDH).
Elgamal:
$Gen(.): x \xleftarrow{R} \mathbb{Z}_p$; $Enc(m,g^x): r \xleftarrow{R} ...
4
votes
2answers
164 views
Is it possible to break a hash-based block cipher?
Let's define the following block cipher:
$C_n = M_n \oplus H(k + n)$ where $C_n$ is the nth block of ciphertext, $M_n$ is the nth block of plaintext, $H$ is a cryptographic hash function, and $k$ is ...
2
votes
2answers
105 views
Security model for privacy-preserving aggregation scheme.
Suppose that $S=(E,D)$ is an additively homomorphic encryption scheme. Now I want to design a protocol $P$ such that given inputs $x_1,x_2,..,x_n$, the adversary $A$ (who can decrypt) can only learn ...
2
votes
2answers
87 views
What are the cryptographic assumptions in the Dolev Yao model?
In the Dolev Yao model for interactive protocols, the cryptographic primitive (encryption, for example) is considered as a blackbox.
Does blackbox here mean that the primitive is to be considered CPA ...
2
votes
1answer
147 views
Why are protocols often proven secure under the random oracle model instead of a hash assumption?
Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle?
I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
2
votes
2answers
160 views
The security proof for Key Policy Attribute Based Encryption
My question relates to the original KP-ABE paper:
http://research.microsoft.com/en-us/um/people/vipul/abe.pdf
I'm having trouble understanding the proof (pages 10–13) that the scheme is secure in ...
1
vote
0answers
43 views
IND-CPA security scheme [duplicate]
Possible Duplicate:
CPA Secure Chosen plaintext scheme
The example for IND-CPA secure schemes given is generally:
for a random r,
$Enc_k(m) =(r|| E_k(r)$ $XOR$ $m)$ where $E$ is a $PRF$
...
2
votes
1answer
212 views
server side Javascript security
It is accepted that the javascript library lacks the ability to create an adequate PRNG. My understanding that this was mainly due to the limits of a sandboxed browser enviroment that javascript ...
2
votes
1answer
156 views
Exact mathematical definition of simulation based security?
I've been trying to understand cryptographic protocols and how to define their security. The problem is that while I can understand what the intuitive definition says, I have trouble understanding how ...
1
vote
1answer
128 views
Randomized stream cipher using multivariant quadratic equations
This is an idea I had for cipher that I thought might reduce to a known hard problem. It is efficient (compared to something like BBS) in terms of time but not in terms of space.
Here's the ...
5
votes
1answer
112 views
How to turn adversary against encryption of zeroes into adversary against random bits?
I recently read the article Nonce-Based Symmetric Encryption by Rogaway, where he presents two different notions of indistinguishability, which he calls ind$ and ind, respectively. Here's the ...
1
vote
0answers
94 views
Setting protocol parameters to achieve concrete security
Background
One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
5
votes
1answer
141 views
Goldreich-Goldwasser-Micali Construction
The Goldreich-Goldwasser-Micali construction allows to build a (cryptographically secure) pseudo-random function from of a (cryptographically secure) pseudo-random generator.
More formally, let $G: ...
1
vote
1answer
213 views
Security analysis of a “one-time pad” type hill cipher
Suppose the Hill cipher were modified to something like a one-time pad cipher, where Alice wants to send a message to Bob, and she chooses a key matrix randomly everytime a new message is sent (and ...
5
votes
1answer
217 views
How do process calculi, CSP, Promela, … compare?
In protocol analysis, formal verification is a very important tool.
What are the major differences between ...
4
votes
2answers
147 views
Where is the proof of security of Diffie's cipher?
There is an apparently provably secure cipher that was proposed by Diffie, but enhanced by R.A. Rueppel. The scheme, which was mentioned in Applied Cryptography, works like this:
Measure the length ...
4
votes
3answers
535 views
Is a book cipher provably secure?
I've seen ciphers (usually in spy drama shows) that involve taking a book and writing down an index to individual characters. Essentially it's a keyed substitution cipher, where the key is the name ...
5
votes
1answer
147 views
Academic papers on ECDSA security
What are the most authoritative papers on the security analysis of ECDSAs?
I`m mainly looking for comparisons of how secure different curves are considered to be, what potential methods are there of ...
20
votes
1answer
2k views
What is the “Random Oracle Model” and why is it controversial?
What is the "Random Oracle Model"? Is it an "assumption" akin to the hardness of factoring and discrete log? Or something else?
And why do some researchers have a strong distrust of this model?
8
votes
1answer
231 views
How did the Koblitz/Menezes papers affect the cryptography community?
Two highly-critical papers by Koblitz and Menezes (two well-regarded mathematicians who've contributed to the crypto community) were published years ago: Another Look at “Provable Security” in 2004, ...
13
votes
2answers
2k views
Why does nobody use (or break) the Camellia Cipher?
If Camellia is of equivalent security and speed to AES, concerns arise.
First of all, assuming the above, why is Camellia so rarely used in practice?
Why aren't there any breaks in Camellia? Does ...
9
votes
1answer
352 views
Does unbalancing a feistel cipher always improve security? Does it improve security at all?
So according to wikipedia unbalanced feistel ciphers provide greater provable security. Specifically, they state:
The Thorp shuffle is an extreme case of an unbalanced Feistel cipher in which one ...
