A primitive or protocol with provable security is accompanied by a mathematical proof that shows how to reduce the security claims about the protocol to a set of assumptions.

learn more… | top users | synonyms

14
votes
2answers
229 views

Formal verification in cryptography

I have seen in some places that people use formal verification and/or computer-aided verification for cryptography (tools like ProVerif, CryptoVerif, etc.). How do these approaches work?
5
votes
1answer
66 views

How many blocks can securely be encrypted with XTS

I could not find in the NIST recommendations on XTS how many blocks can securely be encrypted with XTS-AES. Through the recommendations, I've found: The length of the data unit for any instance ...
3
votes
1answer
56 views

How can I convert a mathematical formula into a logical formula?

I'm using cryptominisat2.9.6 to solve equation set (including more than 160 equations). There are 160 variables in total, which are as follows: ...
1
vote
1answer
56 views

Are the following schemes based on a pseudo-random permutation secure?

I am currently working on the following task: Let F be a pseudorandom permutation. Consider the encryption scheme for the message space $\{0, 1\}^n$ defined as follows: $Gen(1^n)$ chooses ...
0
votes
1answer
45 views

How are security proofs done in ABE Schemes?

I have been studying several ABE schemes and I understand the security assumptions and the several types of security models used for the security game between the Challenger and the Adversary. What ...
1
vote
0answers
62 views

Simulation-Based Proof: When a Secret Key is Involved

Assume we have a protocol in which a party receives an encrypted random polynomial. The polynomial is encrypted using his public key. We want to construct a simulator for this party (so this party ...
1
vote
1answer
295 views

An example of of an information theoretically secure protocol that is not cryptographically secure

Does there exist a protocol $\pi$ for some functionality $F$ which is information theoretically secure protocol that is not cryptographically secure for some threshold number of corrupt parties? ...
8
votes
3answers
155 views

How to prove the security of block ciphers

I see very often proofs of security for asymmetric crypto algorithms, for instance, using reductions to known hard problems, or game based proofs... In the field of protocols (like authentication) it ...
0
votes
2answers
78 views

Is a PRF applied to a secure MAC also a secure MAC?

Suppose I apply a PRF to a secure MAC. Do I still have a secure MAC?
0
votes
1answer
86 views

Difference left-or-right CPA security, IND-CPA security

I am trying to understand the notion of left-or-right-CPA (LOR-CPA) security for private-key encryption schemes introduced in my lecture. If I understood it correctly so far, the only difference to ...
2
votes
1answer
258 views

Security proof in pairing based cryptography

Let : $G_{0}$ and $G_{1}$ be two multiplicative cyclic groups of prime order $p$, $g$ be a generator of $G_{0}$ and $e$ be a bilinear map, $e : G_0 \times G_0 → G_1$ and let $𝐶_{1} = ...
11
votes
2answers
96 views

Practical differences between circuits and turing machines for cryptography

In formal cryptography, we model algorithms (mostly our adversaries) as (Probabilistic) Turing Machines or as boolean circuits. In our lecture on formal cryptography, we learned that circuits are more ...
3
votes
2answers
77 views

Why is it allowed to Generate Keys inside the game?

I am studying reductions to prove security of crypto systems. Generally "games" are used for the proofs. For example, the next image was extracted from the page 91 of the book Post-Quantum ...
2
votes
1answer
54 views

A confusion on the proof of Yao's theorem (Yao 82)

I'm reading the proof of Yao's theorem on Boaz Barak's lecture, the main part of the proof is the following claim: My question is: How can we say "without loss of generality" here? Since ...
5
votes
4answers
1k views

Security proofs for CBC mode

I'm looking for different approaches to proofs for the security of CBC mode encryption. What are the best sources of information about this subject?
2
votes
1answer
178 views

What is the meaning of IND-CCA secure under standard model? [duplicate]

I notice that in many research papers (viz. "Universal hash proofs and a paradigm for adaptive chosen ciphertext secure public-key encryption" by Cramer and Shoup) the authors showed that their ...
0
votes
0answers
29 views

How is Extended Euclidean Algorithm related to Approximate-GCD problem?

I had a doubt regarding the connection between the Extended Euclidean Algorithm and the Approximate-GCD problem. Are there any relations? i.e., the hardness of A-GCD is derived from EEA. Is there any ...
3
votes
1answer
74 views

How to prove hardness of approximate-GCD problem?

I am trying to prove the security of my system using the hardness assumption of the approximate-GCD problem using contradiction, i.e. If the attacker is able to break in our scheme, then attacker ...
11
votes
1answer
827 views

Easy explanation of “IND-” security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
0
votes
2answers
88 views

How to show that this modification of CBC-MAC is insecure?

I'm working on some cryptography problems, found this and I'm not sure how to solve it: Modify CBC-MAC so that all blocks $t_1,\dots,t_l$ are output rather than just $t_l$ and prove it is not ...
1
vote
0answers
21 views

Should we use exponent 3 in RSA-OAEP?

As I understand it the proof that RSA-OAEP is secure in the random oracle model is much tighter for exponent 3. Does that mean that exponent 3 should be chosen?
3
votes
1answer
172 views

Provable security of cryptographic hash functions

I am working on the following exercise question: Consider the following construction of a “keyed” hash function from Katz & Lindell (ex. 7.22 (1st ed.)/ 8.21(2nd ed.)). Gen : On input ...
0
votes
0answers
29 views

Is original DSA a TEGTSS-I scheme?

Brickell et al. define TEGTSS-I scheme in paper "Design validations for discrete logarithm based signature schemes" In this paper original DSA is generalized as DSA-I variant where $r = g^k \bmod p ...
6
votes
0answers
53 views

Explanation and proof of a well-know probabilistic lemma

Pointcheval and Stern in their paper on "Security proofs for Signature Schemes" state the following "well-known" probabilistic lemma: Let $A \subset X \times Y$, such that $\mathrm{Pr}[A(x, y)] ...
1
vote
0answers
16 views

Finding missing probabilities for formal proofs

In formal proofs, you often need to use probabilities to show that the Advantage of an algorithm is negligible. In proofs by contradiction, these probabilities are often tied to probabilities of ...
2
votes
2answers
80 views

Shannon theorem of perfect secrecy

From the class: Shannon Theorem: For a perfect encryption scheme, the number of keys is at least the size of the message space (number of messages that have a non-zero probability). Proof: ...
3
votes
1answer
68 views

Does concatenation of two pair computational indistinguishable distributions still indistinguishable?

Let $X,X',Y,Y'$ be some distribution ensembles such that $X\sim X'$ and $Y\sim Y'$, where $\sim$ means computational indistinguishable. Define $(X,Y)$ be the distribution ensemble over $\{0,1\}^{2n}$ ...
6
votes
5answers
3k views

Is a book cipher provably secure?

I've seen ciphers (usually in spy drama shows) that involve taking a book and writing down an index to individual characters. Essentially it's a keyed substitution cipher, where the key is the name ...
3
votes
1answer
51 views

Selective and existential unforgability of signature schemes

I understand that one can define EUF-CMA of a signature scheme is terms of a game where the adversary is allowed to query signatures on messages of his choosing, and at the end of the game he must ...
7
votes
4answers
200 views

Why haven't we proven many things computationally secure yet?

Brute Force is infeasible for just about every algorithm we use today. Yet, attacks are feasible. This is because weaknesses keep coming up in our algorithms. Why? We have proven lower bounds for ...
3
votes
1answer
73 views

How can I formally verify fuzzy commitment scheme based security protocol?

I am currently working on designing a security protocol which involves usage of fuzzy commitment schemes, for. eg Reed-Solomon codes which allows us to tolerate a certain level of error. I was ...
5
votes
1answer
511 views

One-Way property of Random Oracle

I'm currently working on a proof in the Random Oracle model, and could not find the formal argument on why the random oracle is one-way (i.e. for an Oracle $O$, it is easy to calculate $x=O(n)$, but ...
3
votes
1answer
51 views

Difference between Constructor and Destructor terms

I was thinking that in the formal model (or symbolic model?) the destructor terms were used to model processes that could abort generating some errors or something like that. But then, I realized that ...
-1
votes
1answer
433 views

Prove that the affine cipher over Z26 has perfect secrecy if every key is used with equal probability of 1/312

Prove that the affine cipher over Z26 has perfect secrecy if every key is used with equal probability of 1/312. Just some guidance/help with this problem would be greatly appreciated not sure how to ...
5
votes
1answer
103 views

Is the concept of provably secure hash the same as entropy smoothing hash functions?

Is the concept of provably secure hash the same as entropy smoothing hash functions? In the tutorial Sequences of Games: A Tool for Taming Complexity in Security Proofs V. Shoup shows us a proof of ...
1
vote
0answers
64 views

Is $E_{k}(x) = F_{k}(x) \oplus F_{k}( \bar x)$ PRF?

$E_{k}(x) = F_{k}(x) \oplus F_{k}( \bar x)$ and F is PRF which maps $\left \{0,1 \right \}^n \times \left \{0,1 \right \}^n $ to $\left \{0,1 \right \}^n$. Let two messages $m_{0} = 0^l $ and $m_{1} ...
3
votes
1answer
50 views

About the necessity simulators set adversary random-tape

In the ideal/real proof paradigm we sometimes find simulators with the capacity of set adversary random tape. My question: when do we have to consider the necessity of simulators set adversary ...
1
vote
1answer
35 views

Create a potential input for sha-256 hash given a substring of input?

Let's say I'm given a specific SHA-256 hash. Further assume that the SHA-256 input, that yielded this hash contained a known sub-string. Is there a way to find the input (containing the specific ...
4
votes
1answer
419 views

Relation between attack and attack model for signatures

I would like to know: What is the relationship between an attack and an attack model. For example, let $\Pi$ be the Lamport signature scheme. This signature has its security based on any one-way ...
1
vote
0answers
25 views

Is Shamir's Secret Sharing Scheme insecure for larger field? [duplicate]

According to wikipedia, if you are using shamir's secret sharing scheme with a field of order $p$, "High values of $p$ are risky because Eve knows that the chance for $f(x)\pmod{p}=f(x)$ increases ...
0
votes
0answers
29 views

Permuted Hash Table

Suppose we have a hash table, $HT$, consisting of $100$ bins.The hash table uses a hash function $H$ that is public. We all know that given value $a$ we can compute the address in the hash by ...
2
votes
2answers
247 views

Simulation based proofs: Simple examples

I am aware that,(in theory) in order to proof that a scheme is secure using simulation based proof we replace an adversary in real world with a simulator in ideal world. Then we try to show that their ...
3
votes
2answers
68 views

How to generate a random number so server cannot cheat?

Here is the protocol: Bunch of players connected to server. Server creates nonce and hashes it - send hash to clients as bit commitment. Clients make nonces and send hashes to server as their bit ...
3
votes
1answer
47 views

Is it okay to send an encrypted key using XSalsa20-Poly1305, and send subsequent messages using ChaCha20-Poly1305?

I am looking at a cryptographic protocol in a somewhat unusual environment: the communicating parties can share arbitrarily long secret keys over a secure channel. If forward secrecy is not required, ...
3
votes
0answers
64 views

LR-Oracle Experiment in Lindell and Katz

In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme $\pi = (Gen,Enc_K,Dec_K)$ is CPA secure for ...
1
vote
1answer
49 views

Why Boneh-Franklin BasicIdent IBE is not chosen-ciphertext secure? Why use random oracle?

I don't know why BasicIdent is not chosen-ciphertext secure. If there are anybody who knows well, please explain it to me with example. Moreover, I don't know random oracle and its usage for security ...
6
votes
2answers
204 views

Hamiltonicity proof of knowledge

I'm learning the POK notion and definitions and as a self exercise I wante to prove the statement that the Hamiltonicity protocol is a POK system with knowledge error $1/2$. So the question will be ...
3
votes
3answers
1k views

What are the differences between proofs based on simulation and proofs based on games?

what are the main pros and cons of proving the "security" of a crypto scheme under simulation proofs instead of game based proofs?
2
votes
1answer
68 views

Proven secure scheme under random oracle

Currently I am trying to understand random oracle model in order to make a small presentation about it but I seem to be very confused about it. Since it's an hypothetical model without a real life ...
3
votes
1answer
251 views

Construct IND-CPA secure encryption scheme by combining two given schemes

I have two encryption schemes $\Pi_0, \Pi_1$, at least one of them is IND-CPA secure but I don't know which one. The task is to construct a scheme $\Pi$ that is guaranteed to be CPA secure and to ...