A primitive or protocol with provable security is accompanied by a mathematical proof that shows how to reduce the security claims about the protocol to a set of assumptions.

learn more… | top users | synonyms

3
votes
1answer
174 views

Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?

where $g$ is a group element in bilinear group $\mathbb{G}$. I understand it is very similar to the conventional DBDH problem, but $g^{1/b}$ is also known, possibly making it easier? Does anyone know ...
3
votes
3answers
228 views

Chance in cryptography

I was just thinking about my own chance and the way chance can defeat even the most advanced algorithm. My thought was : you can make a strong session id, but what if by chance, a hacker set this ...
3
votes
1answer
110 views

Difference between computational and statistical indistinguishabilities

What is the difference between the two notions of computational and statistical indistinguishability?
3
votes
1answer
307 views

Relation between attack and attack model for signatures

I would like to know: What is the relationship between an attack and an attack model. For example, let $\Pi$ be the Lamport signature scheme. This signature has it's security based on the one-way ...
3
votes
1answer
219 views

Security equivalent to Diffie–Hellman problem?

I've been doing the security proof for one of my Theorem. Basically, given $g^a$, $g^b$, $g^{cb}$, $g$ and $c$ as known values. Is the problem of computing $g^{acb^{-1}}$ equivalent to the Diffie ...
3
votes
2answers
309 views

security in the standard model → random oracle model?

Can a protocol proved secure in the standard model be considered secure in the random oracle model?
3
votes
2answers
147 views

Reductionist proofs of decisional problems to computational

Are they any reductionist proofs where an attacker $\mathcal{I}$ for a well established computationally "hard" problem $\mathsf{Π}$ is employing an attacker $\mathcal{A}$ who we assume is able to ...
3
votes
1answer
163 views

Security proof of FO(Fujisaki-Okamoto) hybrid encryption

The proof of FO hybrid encryption is hard to understand. $\:$ Especially, how does the challenger respond to the decryption queries when the challenger can only have some encryption queries? Can ...
3
votes
2answers
219 views

Is a random oracle controled by the challenger?

When proving a Crypto scheme security under random oracle model, is the random oracle always controlled by the challenger? What if the Hash is only used by the adversary?
3
votes
2answers
435 views

Signature based on public key cryptography and forgery

In the definition of existential unforgeability, there is no detail about the following questions. In general, can we suppose that a signer is also a possible adversary ? When generating a signature, ...
3
votes
1answer
913 views

Perfect Secrecy -> One Time Semantic Security -> Secure PRG

I think I have some sense of what Perfect Security means, and even Semantic Security, but I am struggling with randomness, so I'm going to ask a question about CSPRG's (Cryptographically Secure PRG's) ...
3
votes
1answer
330 views

Proofs of security methodologies

I'm looking for course material on the subject of proofs, reductions, and games, as used to prove cryptographic schemes secure. What are the methodologies? What are the preferred ones? In what cases ...
3
votes
2answers
177 views

Security model for privacy-preserving aggregation scheme.

Suppose that $S=(E,D)$ is an additively homomorphic encryption scheme. Now I want to design a protocol $P$ such that given inputs $x_1,x_2,..,x_n$, the adversary $A$ (who can decrypt) can only learn ...
3
votes
1answer
838 views

Proof that IND$-CPA implies IND-CPA?

I've read a few papers recently that used a notion of security called "indistinguishability from random bits/strings" under chosen plaintext attack, also called IND\$-CPA. See e.g. ...
3
votes
1answer
114 views

Does there exist a two-pass AKE protocol that is secure in eCK model and also has PFS?

As we can know that the best two-pass AKE protocols with DH message can achieve is the weak form of perfect forward security (wPFS) which guarantees security against the passive adversary. But ...
3
votes
1answer
326 views

Exact mathematical definition of simulation based security?

I've been trying to understand cryptographic protocols and how to define their security. The problem is that while I can understand what the intuitive definition says, I have trouble understanding how ...
3
votes
1answer
108 views

A confusion about HMQV?

As the full version of HMQV is very long, I will give a graph of it below \begin{array}{@{}l@{}c@{}l@{}} \hat{A} && \hat{B} \\ (a,A=g^a)&&(b,B=g^b) \\ x\in_R[1,q-1],\quad X=g^x ...
3
votes
1answer
231 views

Is $q(n)=1/n$ a negligible function?

By definition - $q(n)$ is a negligible function if for every positive integer $c>0$ there exist an integer $N_c$ such that for all $x>N_c$ : $q(n)<1/x^c$ So for the function $1/x$, if we ...
3
votes
0answers
94 views

Looking for a detailed example of proof by reduction

I'm looking for a very detailed example of proof by reduction. Say we have two or three protocols (that have been proven secure) and we construct a new protocol. We want to provide a proof of security ...
2
votes
1answer
219 views

Randomized stream cipher using multivariant quadratic equations

This is an idea I had for cipher that I thought might reduce to a known hard problem. It is efficient (compared to something like BBS) in terms of time but not in terms of space. Here's the ...
2
votes
2answers
602 views

What are the differences between proofs based on simulation and proofs based on games?

what are the main pros and cons of proving the "security" of a crypto scheme under simulation proofs instead of game based proofs?
2
votes
2answers
369 views

What does “Worst-case hardness” mean in lattice-based cryptography?

In the wiki page of Lattice-based Cryptography the "Worst-case hardness" is defined as below: Worst-case hardness of lattice problems means that breaking the cryptographic construction (even with ...
2
votes
1answer
806 views

Question about the definition of a secure PRF

I'm taking a cryptography introduction course, and we're covering the definition of a secure PRF. I understand the test goes as follows: A challenger picks a function $f$ such that $f \leftarrow ...
2
votes
1answer
80 views

RFID Protocol Cryptanalysis

Assume we have the following scheme for RFID: TAG & READER both have initially k keys. Every session the TAG computes $k_i$=F($k_{i-1})$ where F is a function which computes XOR of previous key ...
2
votes
1answer
137 views

Is this modified Schnorr signature scheme secure?

Signing Let y = g^x, which is your public/private keypair. Let r = g^v, for random v Let c = H(M) Let z = (v + cx) mod q The signature is the pair (r,z) Verifying g^z = ry^c mod p We further ...
2
votes
1answer
174 views

Security of cloud computational protocols in UC Framework?

The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is ...
2
votes
1answer
284 views

Proof of the standard pseudorandom generator + XOR encryption scheme in Goldreich

Reading Goldreich's Foundations of Cryptography II, I found this proof for the security of the common pseudorandom generator + XOR encryption scheme (Proposition 5.2.12 in the book): Assume you ...
2
votes
1answer
113 views

Why is this cryptosystem insecure?

Can someone help me see the flaw in this cryptosystem? Note: This is homework and it is due today at 1:30pm. An answer before that is not expected; I'd just like to understand what the flaw is. ...
2
votes
1answer
369 views

Why are protocols often proven secure under the random oracle model instead of a hash assumption?

Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle? I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
2
votes
2answers
88 views

Formal security of recycled random blinding in a Paillier scheme

This question is a follow-up/variant on a previous question. Supposing that we are trying to generate a large number of (indistinguishable) ciphertexts of a given plaintext and want to avoid the ...
2
votes
1answer
196 views

Flaw in the security definition of *Stateful* Authenticated Encryption?

I'm in search of the correct definition of a stateful authenticated encryption scheme (sAE), and its related security notion. This has been treated several times in the academic literature, however, ...
2
votes
2answers
146 views

how much trust can we place in protocol verifiers? [closed]

I read many papers on authenticated key exchange protocols, and most security proofs are done by the authors. In this method, you can imagine that the efficiency is low. Moreover, even if you have ...
2
votes
2answers
167 views

What are the cryptographic assumptions in the Dolev Yao model?

In the Dolev Yao model for interactive protocols, the cryptographic primitive (encryption, for example) is considered as a blackbox. Does blackbox here mean that the primitive is to be considered CPA ...
2
votes
1answer
356 views

server side Javascript security

It is accepted that the javascript library lacks the ability to create an adequate PRNG. My understanding that this was mainly due to the limits of a sandboxed browser enviroment that javascript ...
2
votes
1answer
97 views

Definition of the Decryption oracle

In the context of public-key encryption, what would be a formal definition of the decryption oracle? I know the informal definition (i.e., a function that is available to the adversary and that ...
2
votes
1answer
69 views

Encrypting decryption key

What's that property called when a scheme is secure even if you encrypt the decryption key? Some schemes have problems when your plaintext is the decryption key (or just the key if symmetric).
2
votes
1answer
118 views

Gap problem for Learning With Errors

Informally, a "Gap problem" arises when solving the computational (or search) version using an oracle for the decisional version. This definition of Gap Problem was introduced by Okamoto and ...
2
votes
1answer
32 views

Is the CONF key sharing Problem equivalent to discrete log problem?

If there a proof in the literature which says the CONF Problem is equivalent to solving the discrete log ? Let $g$ be a generator of a cyclic group $\mathbb{G}$ of prime order $q$ CONF problem: ...
2
votes
1answer
118 views

Is this EAX extension weakening the (provable) security of EAX?

I would like to insert a key deriving function into EAX mode, in order to hamper brute-force attacks for a key-size restricted cipher (56 bits). The modification inserts an identical multi-block ...
2
votes
2answers
169 views

Where does the meaning of reduction to a hard problem lie?

Given you a protocol, if we can reduce breaking the protocol to a hard problem, such as DLP or CDH, then we can say that this protocol is secure. Theoretically speaking, reduction is a good method ...
2
votes
1answer
330 views

some of my confusions about DDH assumption

The wiki defines the decisional Diffie–Hellman assumption as follows: Decisional Diffie–Hellman assumption Consider a (multiplicative) cyclic group $G$ of order $q$, and with generator $g$. The DDH ...
2
votes
1answer
446 views

Why is proof-by-reduction needed (for Elgamal proof of security, for example)?

The textbook proof for Elgamal encryption basically reduces to the Decisional Diffie-Hellman assumption (DDH). Elgamal: $Gen(.): x \xleftarrow{R} \mathbb{Z}_p$; $Enc(m,g^x): r \xleftarrow{R} ...
2
votes
1answer
400 views

Security analysis of a “one-time pad” type hill cipher

Suppose the Hill cipher were modified to something like a one-time pad cipher, where Alice wants to send a message to Bob, and she chooses a key matrix randomly everytime a new message is sent (and ...
2
votes
1answer
103 views

To prove $r \cdot f_1 +f_2 \cdot (s+1)$ is secure

We define the polynomials $r, f_1,f_2,s \in R[x]$. Where $r$ is a random degree 1 polynomial and $s$ is a random polynomial such that: $degree(s)=degree(f_1)=degree(f_2)$, let $R$ be $\mathbb{Z}_p$ ...
2
votes
1answer
160 views

The Goldreich-Goldwasser-Micali Construction with bad PRGS

I understand that if we have a secure PRG then the Goldreich-Goldwasser-Micali construction gives us a secure PRF. However, what I've not been able to find much material on is how will the GGM ...
2
votes
1answer
152 views

Can you help me understand PFS and wPFS?

Every time I encounter the concepts of PFS (perfect forward secrecy) and wPFS (weak perfect forward secrecy), I feel uncertain about them. My understanding is that: PFS ensures that, if the ...
2
votes
1answer
165 views

Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model?

First of all, the Guillou-Quisquater digital signature scheme is: Note everything is $\bmod n$. Message is denoted by $m$. Private key: $s$ Public key: Hash function $H$, $e$, ...
2
votes
1answer
45 views

Is MCrypt's 8-bit OFB mode secure?

I just stumbled across a Stack Overflow post which points out that the libmcrypt library (notably used in PHP) implements a somewhat unusual set of block cipher modes: it calls the usual CFB and OFB ...
2
votes
1answer
96 views

Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?

A modern trend in cryptography consists of defining security as rigorously as possible, and then designing schemes which are secure according to those definitions. Proving security comes in the form ...
2
votes
0answers
53 views

Bridging the gap between security proofs and “real-world” security

I've been studying cryptography for a little while. I understand fairly well the nuts and bolts of security proofs, but I'm having trouble reconciling the formal statements of security in these proofs ...