A primitive or protocol with provable security is accompanied by a mathematical proof that shows how to reduce the security claims about the protocol to a set of assumptions.
0
votes
1answer
115 views
Why is proof-by-reduction needed (for Elgamal proof of security, for example)?
The textbook proof for Elgamal encryption basically reduces to the Decisional Diffie-Hellman assumption (DDH).
Elgamal:
$Gen(.): x \xleftarrow{R} \mathbb{Z}_p$; $Enc(m,g^x): r \xleftarrow{R} ...
-1
votes
1answer
39 views
Sematically Secure McEliece
I am read the Lemma 2 (pp13) in the paper [1]. Here a make a question Why "for any $Hash_z$ and any $Gen$"? The author of paper reply
The reason why "for any $Hash_z$ and any $Gen$" is that if ...
2
votes
0answers
77 views
Are there any secure commutative ciphers?
This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure.
My question is, here there any commutative ciphers out there that are secure ...
1
vote
0answers
92 views
Setting protocol parameters to achieve concrete security
Background
One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
-1
votes
0answers
36 views
Adaptative chosen ciphertext security McEliece
I am read the paper and I found the follow Lemma2 (pp. 13)
Suposse that there exists, for any $Hash_z$ and any $Gen$, an algorithm $A$ ...
My question is Why "for any $Hash_z$ and any $Gen$"? Are ...
-2
votes
0answers
56 views
One time Pad Adversary
I like know Why $Pr[\mathsf{PRIV_{EAV}}(\Pi,A,n)=1] = 1/2$, when $\Pi$ is a One Time Pad. I trying:
$$Pr[\mathsf{PRIV_{EAV}}(\Pi,A,n)=1] = Pr[b'=0|b=0]Pr[b=0] + ...
