# Tagged Questions

A primitive or protocol with provable security is accompanied by a mathematical proof that shows how to reduce the security claims about the protocol to a set of assumptions.

25 views

### Gap problem for Learning With Errors

Informally, a "Gap" problem is the one that arises when solving the computational (or search) version using an oracle for the decisional version. For example, the Gap Diffie-Hellman Problem (GDH) is ...
63 views

### To prove $r \cdot f_1 +f_2 \cdot (s+1)$ is secure

We define the polynomials $r, f_1,f_2,s \in R[x]$. Where $r$ is a random degree 1 polynomial and $s$ is a random polynomial such that: $degree(s)=degree(f_1)=degree(f_2)$, let $R$ be $\mathbb{Z}_p$ ...
79 views

### Why is this cryptosystem insecure?

Can someone help me see the flaw in this cryptosystem? Note: This is homework and it is due today at 1:30pm. An answer before that is not expected; I'd just like to understand what the flaw is. ...
68 views

### Why does NTRUEncrypt lack a formal security proof?

Is there any particular reason why NTRUEncrypt lacks a formal security proof? That is, a demonstration that it achieves certain security notion (e.g. IND-CPA). I know there is a provable-secure ...
47 views

### Key escrow on indistinguishability games

Does it mean that when PPT attacker is breaking an indistinguishable based (equivalent with semantic security) game with non negligible probability that he is able to infer the secret keys either on ...
106 views

### Is this chat protocol safe?

I am in the design phase of a secure chat application at the moment. I am trying to make this as secure as possible. The Serverprovider should not have access to the messagedata. So my idea was the ...
50 views

### Bridging the gap between security proofs and “real-world” security

I've been studying cryptography for a little while. I understand fairly well the nuts and bolts of security proofs, but I'm having trouble reconciling the formal statements of security in these proofs ...
100 views

### Is this modified Schnorr signature scheme secure?

Signing Let y = g^x, which is your public/private keypair. Let r = g^v, for random v Let c = H(M) Let z = (v + cx) mod q The signature is the pair (r,z) Verifying g^z = ry^c mod p We further ...
57 views

### Privacy-Preserving Protocols and Proofs of Security

While dabbling in privacy-preserving protocols (mainly using Semi-Homomorphic Encryption) and coming up with miscellaneous ideas for comparison tests or other similar primitives, based on obfuscation ...
95 views

### How to prove Security of Onion Layers of encryption?

CryptDB has Onion layers of Encryption to provide wider functionality from weaker forms of encryption. How do we prove such things are indeed secure ? Intuitively It seems ok. Are there any parallels ...
30 views

### Hard problems in composite order group even when factorization is known

Composite discrete log problem has been proved to be reducible to hardness of factorization and discrete log on the prime factor groups. Are there any problems apart from that in composite order ...
35 views

### What is the restriction on k, for the kth composite residuosity problem to be hard

This paper considers the exponent to be an odd integer. When k = 2, it is called the quadratic residuosity problem (mod n where n is composite) which is hard and can be solved if the factorization of ...
174 views

### Proof for composed signatures

Assumes that we have 3 signature algorithms, $S^A$ with key pair $(sk^A,pk^A)$, $S^B$ with key pair $(sk^B,pk^B)$,$S^C$ with key pair $(sk^C,pk^C)$. We denote by $\epsilon$, $\epsilon'$ and ...
80 views

### OCB and GCM security

Is OCB as secure as GCM or CCM ? Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well. Thank you.
207 views

### Security equivalent to Diffie–Hellman problem?

I've been doing the security proof for one of my Theorem. Basically, given $g^a$, $g^b$, $g^{cb}$, $g$ and $c$ as known values. Is the problem of computing $g^{acb^{-1}}$ equivalent to the Diffie ...
62 views

### Are HMACs based on hashes with larger bit-lengths also more secure?

When doing encrypt-then-mac, I can choose to use a hmac as the MAC. For example, I could use a hash like SHA-256 or SHA-512 (by using it as a keyed hash) to create that HMAC. Does it increase ...
101 views

### Use ElGamal to solve Diffie-Hellman problem

Say we are able to decrypt a Elgamal ciphertext $c$ using only the public key. Apparantly it is now possible to solve the Diffie-Hellman problem (given $g^a, g^b$ calculate $g^{ab}$). How? I know how ...
343 views

### Is SipHash cryptographically secure?

I'm evaluating different hash algorithms for use in my application. One of the kind of algorithms I am looking at are cryptographically secure ones to protect against DOS attacks. SipHash seems ...
72 views

### Protocol composition [closed]

I have been trying to wrap my head around different definitions of protocol security (stand alone, sequential composition, parallel composition, universal composition) and how the proofs of any of ...
109 views

### Hamiltonicity proof of knowledge

I'm learning the POK notion and definitions and as a self exercise I wante to prove the statement that the Hamiltonicity protocol is a POK system with knowledge error $1/2$. So the question will be ...
117 views

### Reductionist proofs of decisional problems to computational

Are they any reductionist proofs where an attacker $\mathcal{I}$ for a well established computationally "hard" problem $\mathsf{Π}$ is employing an attacker $\mathcal{A}$ who we assume is able to ...
144 views

### What is the “artificial abort” technique?

In the security proof of Brent Waters's paper Efficient Identity-Based Encryption Without Random Oracles, he uses a novel “artificial abort” step on page 6. At this point the simulator is still ...
101 views

### Is it possible to construct a secure block cipher of size $2n$ given a secure block cipher of size $n$?

Given, say, the Blowfish block cipher, which is considered secure but only has a 64-bit block size, can we construct a secure block cipher of 128-bit block size? Say we run the key through two KDFs, ...
27 views

### Is the CONF key sharing Problem equivalent to discrete log problem?

If there a proof in the literature which says the CONF Problem is equivalent to solving the discrete log ? Let $g$ be a generator of a cyclic group $\mathbb{G}$ of prime order $q$ CONF problem: ...
83 views

### Is less security required for a short stream cipher than for the AES enciphering of very long messages? [closed]

Criticisms of a cipher system such as 'the ciphertext from one message must be indistinguishable from the ciphertext of a second message" surely only apply when there are very large amounts of ...
74 views

### Exchanging Keyspace and Message space in PRF

Suppose there is a secure PRF $F: K \times X \to Y$. Then is $F': X \times K \to Y$, defined by $F'(x,k):=F(k,x)$, a secure PRF? In my opinion it should be because exchanging the keyspace with ...
50 views

### Showing that security of a elgamal invariant is insecure

Original Elgamal signature is defined $S(m, \alpha) = (r, s)$, where $$r = g^k \bmod p$$ $$s = (m – r*α)k^{-1} \bmod (p – 1)$$ more information on Elgamal signature can be found here. Variant ...
209 views

### security in the standard model → random oracle model?

Can a protocol proved secure in the standard model be considered secure in the random oracle model?
83 views

### Times of nested algorithms in proofs of security

Proofs of security may be constructed such that an adversary $A$ is used to construct an adversary $A'$. The reduction/algorithm which uses $A$ has to perform a number of computations in order to ...
121 views

### Security proof of FO(Fujisaki-Okamoto) hybrid encryption

The proof of FO hybrid encryption is hard to understand. $\:$ Especially, how does the challenger respond to the decryption queries when the challenger can only have some encryption queries? Can ...
81 views

### Looking for a detailed example of proof by reduction

I'm looking for a very detailed example of proof by reduction. Say we have two or three protocols (that have been proven secure) and we construct a new protocol. We want to provide a proof of security ...
191 views

### Is a random oracle controled by the challenger?

When proving a Crypto scheme security under random oracle model, is the random oracle always controlled by the challenger? What if the Hash is only used by the adversary?
110 views

### Rock-paper-scissors over network, how to protect from cheating server?

I'm trying to design cryptographic protocol to play Rock-Paper-Scissors with two parties, neither trusting each other, nor trusting server they use for communication, so game is 'provably fair'. So ...
147 views

### Would a symmetric cipher with a keylength a big as the data length be information theoretically secure?

One-Time-Pad is information theoretically secure as long as the random number stream is evenly long or longer than the data stream it encrypts, for a "decyphered" message could have been any message ...
588 views

### Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)

I have a question about Pseudo Random Functions. Let $f:\{0,1\}^m \times \{0,1\}^n → \{0,1\}^n$ be a secure PRF. Define $F(k,x) = f(k,x) - f(k, x-1 \bmod 2^{n}) \bmod 2^{n}$. Is $F$ is a secure ...
86 views

### Modular protocol design

What does modular protocol design mean? Why does TLS not have modular protocol design? What protocols have modular design? (IPSec, SSH)
140 views

### Proofs by reduction and times of adversaries

I have some difficulties to understand, when we construct a reduction, how we determine the time for the constructed adversary to break a target security property. In general these details are not ...
356 views

### Signature based on public key cryptography and forgery

In the definition of existential unforgeability, there is no detail about the following questions. In general, can we suppose that a signer is also a possible adversary ? When generating a signature, ...
532 views

### Perfect Secrecy -> One Time Semantic Security -> Secure PRG

I think I have some sense of what Perfect Security means, and even Semantic Security, but I am struggling with randomness, so I'm going to ask a question about CSPRG's (Cryptographically Secure PRG's) ...
204 views

### What does “Worst-case hardness” mean in lattice-based cryptography?

In the wiki page of Lattice-based Cryptography the "Worst-case hardness" is defined as below: Worst-case hardness of lattice problems means that breaking the cryptographic construction (even with ...
141 views

### Reason for difference in assumptions for practical private-key and public-key crypto

Theoretical cryptography tells us that everything in the world of private-key cryptography (CCA-secure symmetric encryption, message authentication codes, etc.) can be built from one-way functions and ...
131 views

### Can you prove the existance of a PRG $G$ s.t. for each even $k$: $G(k)=G(k+1)$?

In one of the exercises in [KL] Book I need to tell whether an encryption scheme is secure under an eavesdropper of only one message. Given a PRG $G: \{0,1\}^n \rightarrow \{0,1\}^{n+1}$. The ...
59 views

### Is it feasible to break an encrypted and later encoded message?

A message is sent from a person to another. The plain message is first encrypted, even with a weak algorithm - say, DES. Then, the encrypted message is encoded with a simple substitution, which is ...
218 views

### Chance in cryptography

I was just thinking about my own chance and the way chance can defeat even the most advanced algorithm. My thought was : you can make a strong session id, but what if by chance, a hacker set this ...
92 views

As the full version of HMQV is very long, I will give a graph of it below \begin{array}{@{}l@{}c@{}l@{}} \hat{A} && \hat{B} \\ (a,A=g^a)&&(b,B=g^b) \\ x\in_R[1,q-1],\quad X=g^x ...
162 views

### CDH problem and Square-DH problem

CDH problem roughly says that choose $U=g^u, V=g^v$ uniformly at random from cyclic group $G$, it's hard to compute $CDH(U,V)=g^{uv}$. Square-DH problem roughly says choose $U=g^u$ uniformly at ...
171 views

### Can we say that if $P=NP$ there is no CPA secure public key encryption?

I've learned that public key encryption is based on the problem of Discrete Log (as regard to group theory) which believed to be hard. But, can we say that it doesn't matter on which problem our ...
57 views

### Are those two distributions indistinguishable?

The Decision composite residuosity problem problem states that is impossible two distinguish between those two ensembles: $\{x^N \mod {N^2} | x \in \mathbb{Z^*_{N{^2}}}\}$ and \$\{r \in ...
184 views

### Unforgeability and type of adversary

When trying to prove security of asymmetric signature, for instance for existential (or strong) unforgeability against chosen messages attack, do we need to consider the signer as a possible ...
143 views

### How can I tell how many bits of security a secure hash function has?

How can I tell how many bits of security a secure hash function has? For example, how would I calculate or tell how many bits of security a secure hash function with 160 bits output would have? ...