A primitive or protocol with provable security is accompanied by a mathematical proof that shows how to reduce the security claims about the protocol to a set of assumptions.

learn more… | top users | synonyms

3
votes
2answers
258 views

security in the standard model → random oracle model?

Can a protocol proved secure in the standard model be considered secure in the random oracle model?
3
votes
1answer
109 views

Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?

where $g$ is a group element in bilinear group $\mathbb{G}$. I understand it is very similar to the conventional DBDH problem, but $g^{1/b}$ is also known, possibly making it easier? Does anyone know ...
3
votes
2answers
136 views

Reductionist proofs of decisional problems to computational

Are they any reductionist proofs where an attacker $\mathcal{I}$ for a well established computationally "hard" problem $\mathsf{Π}$ is employing an attacker $\mathcal{A}$ who we assume is able to ...
3
votes
1answer
144 views

Security proof of FO(Fujisaki-Okamoto) hybrid encryption

The proof of FO hybrid encryption is hard to understand. $\:$ Especially, how does the challenger respond to the decryption queries when the challenger can only have some encryption queries? Can ...
3
votes
2answers
204 views

Is a random oracle controled by the challenger?

When proving a Crypto scheme security under random oracle model, is the random oracle always controlled by the challenger? What if the Hash is only used by the adversary?
3
votes
2answers
398 views

Signature based on public key cryptography and forgery

In the definition of existential unforgeability, there is no detail about the following questions. In general, can we suppose that a signer is also a possible adversary ? When generating a signature, ...
3
votes
1answer
746 views

Perfect Secrecy -> One Time Semantic Security -> Secure PRG

I think I have some sense of what Perfect Security means, and even Semantic Security, but I am struggling with randomness, so I'm going to ask a question about CSPRG's (Cryptographically Secure PRG's) ...
3
votes
1answer
279 views

Proofs of security methodologies

I'm looking for course material on the subject of proofs, reductions, and games, as used to prove cryptographic schemes secure. What are the methodologies? What are the preferred ones? In what cases ...
3
votes
2answers
172 views

Security model for privacy-preserving aggregation scheme.

Suppose that $S=(E,D)$ is an additively homomorphic encryption scheme. Now I want to design a protocol $P$ such that given inputs $x_1,x_2,..,x_n$, the adversary $A$ (who can decrypt) can only learn ...
3
votes
1answer
89 views

Why does NTRUEncrypt lack a formal security proof?

Is there any particular reason why NTRUEncrypt lacks a formal security proof? That is, a demonstration that it achieves certain security notion (e.g. IND-CPA). I know there is a provable-secure ...
3
votes
1answer
182 views

Proofs by reduction and times of adversaries

I have some difficulties to understand, when we construct a reduction, how we determine the time for the constructed adversary to break a target security property. In general these details are not ...
3
votes
1answer
726 views

Proof that IND$-CPA implies IND-CPA?

I've read a few papers recently that used a notion of security called "indistinguishability from random bits/strings" under chosen plaintext attack, also called IND\$-CPA. See e.g. ...
3
votes
1answer
105 views

Does there exist a two-pass AKE protocol that is secure in eCK model and also has PFS?

As we can know that the best two-pass AKE protocols with DH message can achieve is the weak form of perfect forward security (wPFS) which guarantees security against the passive adversary. But ...
3
votes
1answer
96 views

A confusion about HMQV?

As the full version of HMQV is very long, I will give a graph of it below \begin{array}{@{}l@{}c@{}l@{}} \hat{A} && \hat{B} \\ (a,A=g^a)&&(b,B=g^b) \\ x\in_R[1,q-1],\quad X=g^x ...
3
votes
1answer
211 views

Is $q(n)=1/n$ a negligible function?

By definition - $q(n)$ is a negligible function if for every positive integer $c>0$ there exist an integer $N_c$ such that for all $x>N_c$ : $q(n)<1/x^c$ So for the function $1/x$, if we ...
2
votes
1answer
209 views

Randomized stream cipher using multivariant quadratic equations

This is an idea I had for cipher that I thought might reduce to a known hard problem. It is efficient (compared to something like BBS) in terms of time but not in terms of space. Here's the ...
2
votes
2answers
281 views

What does “Worst-case hardness” mean in lattice-based cryptography?

In the wiki page of Lattice-based Cryptography the "Worst-case hardness" is defined as below: Worst-case hardness of lattice problems means that breaking the cryptographic construction (even with ...
2
votes
1answer
711 views

Question about the definition of a secure PRF

I'm taking a cryptography introduction course, and we're covering the definition of a secure PRF. I understand the test goes as follows: A challenger picks a function $f$ such that $f \leftarrow ...
2
votes
1answer
121 views

Is this modified Schnorr signature scheme secure?

Signing Let y = g^x, which is your public/private keypair. Let r = g^v, for random v Let c = H(M) Let z = (v + cx) mod q The signature is the pair (r,z) Verifying g^z = ry^c mod p We further ...
2
votes
1answer
164 views

Security of cloud computational protocols in UC Framework?

The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is ...
2
votes
1answer
253 views

Proof of the standard pseudorandom generator + XOR encryption scheme in Goldreich

Reading Goldreich's Foundations of Cryptography II, I found this proof for the security of the common pseudorandom generator + XOR encryption scheme (Proposition 5.2.12 in the book): Assume you ...
2
votes
2answers
511 views

What are the differences between proofs based on simulation and proofs based on games?

what are the main pros and cons of proving the "security" of a crypto scheme under simulation proofs instead of game based proofs?
2
votes
1answer
90 views

Why is this cryptosystem insecure?

Can someone help me see the flaw in this cryptosystem? Note: This is homework and it is due today at 1:30pm. An answer before that is not expected; I'd just like to understand what the flaw is. ...
2
votes
1answer
336 views

Why are protocols often proven secure under the random oracle model instead of a hash assumption?

Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle? I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
2
votes
2answers
80 views

Formal security of recycled random blinding in a Paillier scheme

This question is a follow-up/variant on a previous question. Supposing that we are trying to generate a large number of (indistinguishable) ciphertexts of a given plaintext and want to avoid the ...
2
votes
1answer
173 views

Flaw in the security definition of *Stateful* Authenticated Encryption?

I'm in search of the correct definition of a stateful authenticated encryption scheme (sAE), and its related security notion. This has been treated several times in the academic literature, however, ...
2
votes
2answers
146 views

how much trust can we place in protocol verifiers? [closed]

I read many papers on authenticated key exchange protocols, and most security proofs are done by the authors. In this method, you can imagine that the efficiency is low. Moreover, even if you have ...
2
votes
2answers
151 views

What are the cryptographic assumptions in the Dolev Yao model?

In the Dolev Yao model for interactive protocols, the cryptographic primitive (encryption, for example) is considered as a blackbox. Does blackbox here mean that the primitive is to be considered CPA ...
2
votes
1answer
344 views

server side Javascript security

It is accepted that the javascript library lacks the ability to create an adequate PRNG. My understanding that this was mainly due to the limits of a sandboxed browser enviroment that javascript ...
2
votes
1answer
285 views

Exact mathematical definition of simulation based security?

I've been trying to understand cryptographic protocols and how to define their security. The problem is that while I can understand what the intuitive definition says, I have trouble understanding how ...
2
votes
1answer
55 views

Definition of the Decryption oracle

In the context of public-key encryption, what would be a formal definition of the decryption oracle? I know the informal definition (i.e., a function that is available to the adversary and that ...
2
votes
1answer
66 views

Encrypting decryption key

What's that property called when a scheme is secure even if you encrypt the decryption key? Some schemes have problems when your plaintext is the decryption key (or just the key if symmetric).
2
votes
1answer
106 views

Gap problem for Learning With Errors

Informally, a "Gap problem" arises when solving the computational (or search) version using an oracle for the decisional version. This definition of Gap Problem was introduced by Okamoto and ...
2
votes
1answer
29 views

Is the CONF key sharing Problem equivalent to discrete log problem?

If there a proof in the literature which says the CONF Problem is equivalent to solving the discrete log ? Let $g$ be a generator of a cyclic group $\mathbb{G}$ of prime order $q$ CONF problem: ...
2
votes
1answer
113 views

Is this EAX extension weakening the (provable) security of EAX?

I would like to insert a key deriving function into EAX mode, in order to hamper brute-force attacks for a key-size restricted cipher (56 bits). The modification inserts an identical multi-block ...
2
votes
2answers
164 views

Where does the meaning of reduction to a hard problem lie?

Given you a protocol, if we can reduce breaking the protocol to a hard problem, such as DLP or CDH, then we can say that this protocol is secure. Theoretically speaking, reduction is a good method ...
2
votes
1answer
277 views

some of my confusions about DDH assumption

The wiki defines the decisional Diffie–Hellman assumption as follows: Decisional Diffie–Hellman assumption Consider a (multiplicative) cyclic group $G$ of order $q$, and with generator $g$. The DDH ...
2
votes
1answer
410 views

Why is proof-by-reduction needed (for Elgamal proof of security, for example)?

The textbook proof for Elgamal encryption basically reduces to the Decisional Diffie-Hellman assumption (DDH). Elgamal: $Gen(.): x \xleftarrow{R} \mathbb{Z}_p$; $Enc(m,g^x): r \xleftarrow{R} ...
2
votes
1answer
382 views

Security analysis of a “one-time pad” type hill cipher

Suppose the Hill cipher were modified to something like a one-time pad cipher, where Alice wants to send a message to Bob, and she chooses a key matrix randomly everytime a new message is sent (and ...
2
votes
1answer
101 views

To prove $r \cdot f_1 +f_2 \cdot (s+1)$ is secure

We define the polynomials $r, f_1,f_2,s \in R[x]$. Where $r$ is a random degree 1 polynomial and $s$ is a random polynomial such that: $degree(s)=degree(f_1)=degree(f_2)$, let $R$ be $\mathbb{Z}_p$ ...
2
votes
1answer
147 views

The Goldreich-Goldwasser-Micali Construction with bad PRGS

I understand that if we have a secure PRG then the Goldreich-Goldwasser-Micali construction gives us a secure PRF. However, what I've not been able to find much material on is how will the GGM ...
2
votes
1answer
140 views

Can you help me understand PFS and wPFS?

Every time I encounter the concepts of PFS (perfect forward secrecy) and wPFS (weak perfect forward secrecy), I feel uncertain about them. My understanding is that: PFS ensures that, if the ...
2
votes
1answer
158 views

Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model?

First of all, the Guillou-Quisquater digital signature scheme is: Note everything is $\bmod n$. Message is denoted by $m$. Private key: $s$ Public key: Hash function $H$, $e$, ...
2
votes
0answers
51 views

Bridging the gap between security proofs and “real-world” security

I've been studying cryptography for a little while. I understand fairly well the nuts and bolts of security proofs, but I'm having trouble reconciling the formal statements of security in these proofs ...
2
votes
0answers
86 views

Looking for a detailed example of proof by reduction

I'm looking for a very detailed example of proof by reduction. Say we have two or three protocols (that have been proven secure) and we construct a new protocol. We want to provide a proof of security ...
2
votes
0answers
60 views

Protocol/algorithms based on a variable-length input PRF

Are the proofs based on a PRF assumption still valid when using a variable-length input PRF ? The answer might be obvious, but I have a doubt.
2
votes
0answers
125 views

Ideal system for an encryption scheme

What is the ideal system for an encryption scheme? For a pseudorandom permutation the ideal one is a random permutation, for a pseudorandom function the ideal one is a random function. For an ...
2
votes
2answers
343 views

The security proof for Key Policy Attribute Based Encryption

My question relates to the original KP-ABE paper: http://research.microsoft.com/en-us/um/people/vipul/abe.pdf I'm having trouble understanding the proof (pages 10–13) that the scheme is secure in ...
2
votes
0answers
136 views

Setting protocol parameters to achieve concrete security

Background One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
1
vote
2answers
580 views

Tools for modelling and analysis of cryptographic protocols

I am designing some cryptographic protocols and I am new to it. Are there any well-known tools that can be used to model and design these protocols? And also verify or analyze their validity? If not ...