A primitive or protocol with provable security is accompanied by a mathematical proof that shows how to reduce the security claims about the protocol to a set of assumptions.

learn more… | top users | synonyms

7
votes
2answers
704 views

Is SipHash cryptographically secure?

I'm evaluating different hash algorithms for use in my application. One of the kind of algorithms I am looking at are cryptographically secure ones to protect against DOS attacks. SipHash seems ...
1
vote
1answer
72 views

Proving security of TLS handshake with ProVerif

Background For my dissertation I am working on an application protocol for which I require a TLS session. I am looking to achieve Perfect Forward Secrecy, which means I have selected ephemeral ...
12
votes
1answer
819 views

Does unbalancing a feistel cipher always improve security? Does it improve security at all?

So according to Wikipedia unbalanced feistel ciphers provide greater provable security. Specifically, they state: The Thorp shuffle is an extreme case of an unbalanced Feistel cipher in which one ...
1
vote
2answers
60 views

Indistinguishability game hop

I am trying to prove that changing an input in a security game from a randomly permuted set to a set that is permuted using a pseudorandom permutation (PRP) results in a negligible distinguishing ...
1
vote
1answer
91 views

Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator

Imagine we have a 3-party protocol, including client $A$,client $B$ and a server. In this protocol client $B$ encrypts its input under its public key and sends it to the server. The server performs ...
4
votes
7answers
600 views

A block cipher with independent keys for each round

I want to modify a standard block cipher in the following way. I replace each round key by a key picked at random. Is this block cipher as secure as the original one ? Thank you. EDIT Some missing ...
2
votes
2answers
213 views

Is $G$ a secure PRG?

Is the following function a secure PRG? Given $F$ is a secure PRG and $k$ is choosen random from key space $K$. $$G(x) = F(k,x) \oplus F(k,x \oplus 1^s)$$ My solution is $x \oplus 1^s = x'$ ...
6
votes
4answers
381 views

Is there a proof for showing any cryptogram is crackable?

I commonly hear statements along the lines of "all cryptograms are crackable - it's only a matter of time". Is there a proof to show that any cryptogram is "crackable"? The proof may be of a more ...
0
votes
0answers
30 views

CPA-security of a pseudorandom permutation encryption scheme

Let $F$ be a pseudorandom permutation, and define a fixed-length encryption scheme $(Gen, Enc, Dec)$ as follows: on input $m \in$ $\{0,1\}^{n/2}$ and key $k \in \{0,1\}^n$, algorithm Enc ...
1
vote
1answer
65 views

Simulation Based Proof: What Can / Can not Simulator Do?

I have seen some examples in "Foundation of cryptography" and "Efficient two party computation", in which simulator can do some things that in the real world model the parties cannot do, for instance: ...
2
votes
1answer
106 views

How to prove that a function is not pseudorandom?

I am currently enrolled in a cryptography course, which uses the book by Katz and Lindell. I'm struggling with the exercies which ask for proofs, like the following one: Let G(k) be a PRG with ...
1
vote
2answers
40 views

Simulator in Private Outsourced Computation over Outsourced Datasets

Please, consider two honest parties $A$ and $B$ outsourced their private data to a malicious server $S$. So the parties store their data in the server. Then at a later point in time they want to ask ...
3
votes
1answer
72 views

What does “simulator” and “interactive” mean in a cryptographic credential system's definition of security?

Definition 1 on Page 7 of “An Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation” by Camenisch and Lysyanskaya, uses the term “simulator” in defining the ...
7
votes
1answer
360 views

Why is EdDSA collision-resilient with SHA-512?

In the Bernstein et al. paper about EdDSA, the authors claim EdDSA is resilient against collisions (i.e. it can still be secure even if the hash function used isn't collision-resistant), drawing on a ...
5
votes
5answers
2k views

Is a book cipher provably secure?

I've seen ciphers (usually in spy drama shows) that involve taking a book and writing down an index to individual characters. Essentially it's a keyed substitution cipher, where the key is the name ...
1
vote
1answer
81 views

Simulation based proofs: Simple examples

I am aware that,(in theory) in order to proof that a scheme is secure using simulation based proof we replace an adversary in real world with a simulator in ideal world. Then we try to show that their ...
2
votes
1answer
146 views

Easy explanation of “IND-” security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
1
vote
1answer
224 views

How to prove Security of Onion Layers of encryption?

CryptDB has Onion layers of Encryption to provide wider functionality from weaker forms of encryption. How do we prove such things are indeed secure ? Intuitively It seems ok. Are there any parallels ...
1
vote
1answer
47 views

Does anyone still use BAN or GNY logic in practice?

I want to implement a simple protocol, and I'd like to verify it through BAN or GNY logic. I would assume that if these logics are still used that there would be some programs available that would ...
3
votes
1answer
96 views

Simulation aborted because the adversary doesn't use the random oracle

I'm trying to construct a proof for an encryption scheme in the Random Oracle model. This encryption scheme is like a PKE scheme but with an additional function that kind of "alters" ciphertexts ...
-1
votes
1answer
193 views

Prove that the affine cipher over Z26 has perfect secrecy if every key is used with equal probability of 1/312

Prove that the affine cipher over Z26 has perfect secrecy if every key is used with equal probability of 1/312. Just some guidance/help with this problem would be greatly appreciated not sure how to ...
6
votes
1answer
115 views

Secret key and Decryption oracle in the revised Fujisaki-Okamoto transformation

Recently, Fujisaki and Okamoto provided a revised version of the Fujisaki-Okamoto transformation [1], a generic transformation for achieving IND-CCA2 security in the Random Oracle model. This new ...
4
votes
1answer
69 views

On Proving That a Primitive Does Not Exist

In the paper of Hsiao and Reyzin, Section $1.4$: Note that to show that no general reduction from $P$ to $Q$ exists requires proving that $Q$ does not exist Since the statement is about trying ...
0
votes
0answers
198 views

Variant of the Decisional Bilinear Diffie Hellman problem

I am working on a cryptographic scheme and I need to rely on the following problem, which I have nicknamed the "Hybrid Decisional Bilinear Diffie Hellman (hDBDH)" problem: Let $e: \mathbb G_1 ...
2
votes
1answer
96 views

Hash “Preimage by product” resistance

Let H() be a hash function that achieves collision resistance as well as first and second preimage resistance. Let's equip the output set of H of a multiplicative group structure, more precisely a ...
4
votes
2answers
160 views

Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?

A modern trend in cryptography consists of defining security as rigorously as possible, and then designing schemes which are secure according to those definitions. Proving security comes in the form ...
2
votes
1answer
87 views

Is MCrypt's 8-bit OFB mode secure?

I just stumbled across a Stack Overflow post which points out that the libmcrypt library (notably used in PHP) implements a somewhat unusual set of block cipher modes: it calls the usual CFB and OFB ...
1
vote
2answers
42 views

Definition of indistinguishable schemes

Let $\mathsf{Exp}_{A,\Pi}(\lambda)$ be some indistinguishability experiment that finally outputs 1 if A outputs $b'$ that satisfies $b' = b$, otherwise 0. Then the textbooks often define the security ...
1
vote
3answers
81 views

Is it possible to encrypt a message's destination as well as its content?

I have imagined a way to break through any kind of censorship but since I don't have enough professional knowledge of cryptography I don't know whether it is feasible or not. If there is a method ...
0
votes
0answers
38 views

Anyone familiar with domain of hash functions in bilinear pairing based system?

I need a clarification regarding domain of hash functions. I have defined a bilinear pairing based system as follows: Let G1 and G2 be cyclic multiplicative groups of prime order p generated by g1 ...
0
votes
1answer
71 views

Correctness in Multi-party Computation: Real/Ideal Paradigm in Malicious case

I need to know: 1- What does exactly correctness mean in this context? 2- How is correctness implied in malicious model? 3- If the correctness means " the adversary cannot cause the output to be ...
4
votes
1answer
333 views

Proofs by reduction and times of adversaries

I have some difficulties to understand, when we construct a reduction, how we determine the time for the constructed adversary to break a target security property. In general these details are not ...
11
votes
5answers
1k views

Can you make a hash out of a stream cipher?

A comment on another question made me wonder about something: Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
3
votes
1answer
193 views

Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?

where $g$ is a group element in bilinear group $\mathbb{G}$. I understand it is very similar to the conventional DBDH problem, but $g^{1/b}$ is also known, possibly making it easier? Does anyone know ...
2
votes
1answer
173 views

Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure

Any thoughts on how this can be done? Let $\Pi_1 = (\mathrm{Gen}_1, \mathrm{Enc}_1, \mathrm{Dec}_1)$ and $\Pi_2 = (\mathrm{Gen}_2, \mathrm{Enc}_2, \mathrm{Dec}_2)$ be two encryption schemes for ...
0
votes
1answer
65 views

What should I think about these unique certificate serial numbers [closed]

I was looking at the serial numbers of the certificates for www.google.com and wordpress.com. Wordpress was listed by openssl as: 04:0B:D4:F8:25:88:C5 This serial is listed as the serial for both ...
0
votes
1answer
72 views

Computational indistinguishability with Example

Based on computational indistinguishability definition no PPT algorithm can distinguish $X$ from $Y$, where $X=\{X_n\}_{n \in N}$ and $Y=\{Y_n\}_{n \in N}$ are ensembles of probability ...
1
vote
2answers
75 views

Negilible Function $\frac{1}{n!}$

Is $\frac{1}{n!}$ a negligible function where $n$ is a security parameter? Application: I have a vector of n>100 elements. I permute it and give it to an adversary. The adversary can break it if it ...
0
votes
0answers
32 views

Outsourced Multiparty computation proof in Ideal world

I need to know in an outsourced two party computation where honst $A$ and $B$ outsource their private and secure data to a malicious server, why we need to design a simulator that interacts with an ...
0
votes
0answers
48 views

Role of trusted party in the Ideal model in Malicious case

Imagine there is a protocol supporting outosurced multi party computation. There are three parties involved in the protocol: client $A$, client $B$ and a server. Client $A$ and $B$ send their private ...
1
vote
1answer
54 views

Malicious party security model: When one party is corrupted at a time

Consider we have three parties,namely client $A$, client $B$ and a server. Client $B$ and the server can be malicious, but we do not allow the adversary to simultaneously corrupt the server and ...
1
vote
1answer
147 views

Permuted vectors

Consider we have two vectors $v_1, v_2$ of size $n$, and each vector contains $n$ elements. We permute the vectors as: $\pi (k_1,v_1), \pi (k_2,v_2)$. Where $\pi (k_i,v)$ denotes a permutation of a ...
1
vote
0answers
51 views

How to securely map an element from an smaller domain to the other element in a large domain

Problem: I have a small sized domain, say s-bit. It's clear that the probability for an adversary to guess an element is $ \frac{1}{2^s}$. I need to make the probability negligible. However, I need to ...
5
votes
3answers
158 views

Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?

background In [Shoup2004], Victor Shoup synthesizes the 'sequence of games' technique for proving security properties: Roughly it consists in a sequence from game_0 to game_n, game_0 consisting in ...
2
votes
1answer
96 views

RFID Protocol Cryptanalysis

Assume we have the following scheme for RFID: TAG & READER both have initially k keys. Every session the TAG computes $k_i$=F($k_{i-1})$ where F is a function which computes XOR of previous key ...
1
vote
0answers
43 views

why are both ipad and opad required for HMAC? [duplicate]

I was reading about HMAC and why it is crucial to avoid security issues with normal prepending / appending the secret k to a message (issues due to merkel damagard construction). I am not familiar ...
0
votes
1answer
85 views

uniform vs. non-uniform PPT

I'm trying to understand PPT and in particular what the differences are in uniform and non-uniform PPT's. First, this is how I see it: A Probabilistic Polynomial-Time algorithm A is an algorithm that ...
0
votes
2answers
193 views

Why are twofish or other algorithms not NIST approved, are they still safe?

NIST has a total of 3 approved block ciphers on their website: AES, TDES and skipjack. I get why those are on there (though personally I find TDES a bit iffy) but from my understanding Twofish and ...
0
votes
1answer
164 views

How to compare between two cryptographic algorithms in terms of security? [closed]

How to compare between two cryptographic algorithms (e.g. SHA-1 and SipHash) in terms of security? That is, how could one prove that algorithm X is more secure than algorithm Y?
0
votes
1answer
112 views

Hardness of problem related to bilinear pairings

Let $e: \mathbb G_1 \times \mathbb G_1 \rightarrow \mathbb G_T$ be an efficient bilinear pairing. Note that the pairing is symmetric (i.e., Type 1). The problem is, given $g \in \mathbb G_1$ and ...