# Tag Info

10

mikeazo's answer clearly covers what the question asks. However, I want to go further and answer this: How much information does a perfectly secure cipher leak about the key? Exactly all the excessive information of the key that does not help in finding anything about the message. In simple words: if the key length is $k$ bits and the message is $m$ bits ...

8

Actually, the problem with OTP isn't the storage of the pad (although secure erasure of the parts of the pad you used is trickier than it looks), and it isn't the pad generation (although, again, that's trickier than it looks), but the secure transport. After all, it's not enough for you (Alice) to have the secure pad, you also have to give a copy to the ...

8

The intuition behind the proof is as follows. Since the output of AND equals 0 when party P2 has input 0, then the transcript is distributed identically when P1 has input 0 and when P2 has input 1. Likewise, in the opposite direction. Thus, the set of possible transcripts when P1 has 1 and P2 has 0 equals the set of possible transcripts when both have 0, and ...

7

Sure, it can leak something about the key as long as that doesn't leak anything about the plaintext. Consider the following cipher, I'll call it 2-OTP. 2-OTP takes as input a message $M$ and two keys $K_1$ and $K_2$. Each key must be truly random, independent of one another, and each the same length as the message $M$. Define encryption as $ENC(M,K_1,K_2)=... 7 This expands CodesInChaos's comment into an answer. Forward Secrecy (that is, maintaining confidentiality of messages enciphered before compromise of the long term key) can be achieved in a protocol using a public-key signature scheme with a long-term public key, and a public-key encryption scheme with a per-session key; but in the case of RSA signature and ... 7 The way to extend the proof to arbitrary$t,n$and this threshold is as follows. Assume that there exists a protocol for any$n$parties that withstands a threshold of$t=n/2$corrupted parties, for computing$f(x_1,\ldots,x_n)=x_1 \wedge x_{n/2+1}$. (If it withstands$t>n/2$then it also withstands$t=n/2$, so that's fine.) I will now construct a two-... 5 The one-time pad is perfectly secure. It will also leak the complete key to any attacker who knows the message (and will leak some information about the key to any attacker who knows something about the message). It's important to note that there's nothing in the definition of perfect security that says that the attacker can't already know something, or ... 5 You can do anything in MPC, as long as you can express it in a circuit. I assume that there is a known upper bound on$k$(otherwise you can't even share it). In that case, all you need to do is to take enough randomness (security parameter number of bits more than the upper bound) and then compute the sum of the randomness held by each party modulo$k$(... 5 In order for information-theoretic security to imply computational security, you need to require that the simulator run in time that is polynomial in the running time of the real adversary. This is the standard definition, specifically to avoid protocols such as you presented in your question. So, the answer is: If you allow the simulator to be unbounded ... 4 The best option you have is TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA. This is likely to provide most security, as the AES keylength is maximal and ECDSA keys tend to provide more security than RSA keys, as a 128-bit security level is quite common with ECDSA (field size: 256 bit) whereas 112-bit is the standard with RSA (keylength: 2048 bit). However in practice ... 4 No, DHE is secure and allows to share a common secret between two parties over an insecure channel. But you cannot know, if the one you share the secret with is the one you want (DHE is vulnerable to man in the middle attacks). So DHE-RSA uses DHE to share a common secret and signs the communication with RSA to make sure, that both persons communicate with ... 4 For a nonuniform construction with perfect secrecy, consider this scheme, with 2 bits of plaintext$(b_1, b_0)$, and four bits of key$(k_3, k_2, k_1, k_0)$. The ciphertext consists of the three bits: $$(k_3 \land k_2) \oplus b_0 \oplus k_0$$ $$b_1 \oplus k_1$$ $$b_0 \oplus k_0$$ This has perfect secrecy, in that for each ciphertexts, there is the same ... 4 Your diagram is a Venn diagram that illustrates the information measures between the correlated random variables$X,Y$and$Z$.$H(X)$refers to a complete circle and is the entropy of$X$,$H(X|YZ)$is the entropy of$X$under the observation of$Y$and$Z$,$I(X;Y|Z)$is the mutual information between$X$and$Y$under the observation Z,$R(X;Y;Z)$... 4 First, do not ever use RC4. Second, it depends on how you use that stream... If you use AES-CTR as a stream cipher (see more here), you will specify a key$K$(and a nonce$IV$). The CTR mode of AES will generate a stream of bits, whose length matches the messages. All that is required is to XOR it with the message. In order to decipher. One will ... 3 The security notion one usually considers for OTP is perfect secrecy, which informally means that the ciphertext does not reveal any information about the original message, regardless of the computational power of the adversary. It is already known that this requires that the key size must be equal to the plaintext size and that all keys are equiprobable. ... 3 The term unconditional security was (as far as I know) coined by Diffie and Hellman in their seminal paper New Directions in Cryptography. Here is the snippet [... ] a system which can resist any cryptanalytic attack, no matter how much computation is allowed, is called unconditionally secure. Unconditionally secure systems are discussed in [3] and [4] ... 3 Imagine the following three scenarios. In each, you intercept an encrypted message and you know from context: the message is a randomly chosen key in$\{0,1\}^n$for some other cryptosystem the message is either "It's a boy!_" or "It's a girl!", both are equally likely the message is a vote from someone in a referendum; it's either "yes" or "no_", and the ... 3 Since this is homework, let me just give you a hint: consider the two-character messages$m_1 = \text{"aa"}$and$m_2 = \text{"ab"}$. Given a ciphertext$c$encrypted with a monoalphabetic substitution cipher, can you tell which of$m_1$or$m_2$it corresponds to, even without knowing the key? Why (not)? What does this imply about perfect secrecy? 3 One possibility for what you might be missing: normally the same key (the same matrix) is re-used to encrypt many messages. So now try counting the total entropy in$M$length-$N$messages, and the entropy in a$N\times N$matrix, and compare what happens when$M$gets large.... Another possibility you might be missing is the consequences of the fact that ... 3 To use the proper terminology: in TLS, cipher suites which include "some Diffie-Hellman" are: Anonymous Diffie-Hellman: DH_anon Static Diffie-Hellman: DH-RSA, DH-DSS... Ephemeral Diffie-Hellman: DHE-RSA, DHE-DSS... There is no "plain DHE" cipher suite in TLS; it is called "DH_anon". As the name indicates, with DH_anon, the server is "anonymous": you don'... 3 Oddly enough, if the equation holds for any$m_0, m_1$of the appropriate length, it would appear that relaxing this requirement doesn't allow us to shrink the key size at all (!). That is, the key size must still be as long as the plaintext size (or, more precisely, there must be at least as many possible keys are there plaintexts). Allowing a value of$E ...

3

You know that the definition of perfect secrecy is $P(M = m \mid C = c) = P(M = m)$ for all $m$ and $c$ and that each key is only used once. This mean that know about $c$ not affect $P(M=m)$ and if you know $c$ you can't access any information about $m$. But as yyyyyyy mentioned,since $k\oplus \operatorname{rev}(k)$ is symmetric, if $\operatorname{Enc}(k,m)$ ...

3

While the other answer is correct, there are multiple ways to disprove a theorem. In your case you want to disprove $$\Pr[\mathcal M=m|\mathcal C=c]=\Pr[\mathcal M=m]$$ holds for $$c=m\oplus k \oplus \operatorname{rev}(k)$$. The first one is to argue using the probabilities and show that the above equation doesn't hold for this scheme. The second (formally ...

3

Xor-ing the first half of the encrypted message with the second gives the same result as xor-ing the first and second half of the original message. (When the key is duplicated). This contradicts perfect secrecy as some information can be obtained from the cyphertext.

2

Well, for perfect secrecy, we require that for all message distributions over $\mathcal{M}$, all messages $m\in\mathcal{M}$, and all (possible) ciphertexts $c$ it holds that $$Pr[M=m\ |\ C = c] = Pr[M=m]$$ In particular, that means, if we can find a single counterexample, i.e. a distribution over $\mathcal{M}$, a message $m\in\mathcal{M}$, and a ...

2

Imagine that you have a ciphertext: Perfect secrecy means, that without knowing the key, any plaintext has to be a possible preimage. Because otherwise the ciphertext would give you information about the plaintext. Encryption is an injective function, because otherwise it could not be reversed. That means, for a given key and ciphertext you have at most ...

2

The usage of the r key forces both parties to "fix" the public DH keys. So Alice doesn't know Bob's public DH key before she's generating her own one. And Bob can not make the choice of the public key dependant on Alice's choice and vice versa. This forces both parties to be honest and to generate both public keys at random as there is no opportunity to ...

2

This would read out to the following: (I'm citing myself here) An encryption scheme, defined by key generator, encryption function and decryption function over a message space $M$ is perfectly secret if for every probability for a message $m$, for every message $m$ and every ciphertext $c$ which might occur ($Pr[C=c]>0$), ...... the ...

2

Assume that $P_1$ contains " the ". In that case you can get the key stream by XOR'ing " the " with $C_1$, lets call this key stream $K^1$. If this key stream is correct then $P_3^1$ should make sense, where $P_3^1 = K^1 \oplus C_3$. If $P_3^1$ doesn't make sense then you can create $K^2$ and $P_3^2$ from $C_2$ in using an identical calculation and check ...

2

What you need for this is something called an $n$-wise independent hash function (like "pairwise independent" but $n$ instead). Such a hash function has the property that when applied to at most $n$ different inputs, its outputs are completely random. These can be constructed efficiently; e.g., a random polynomial of the appropriate degree works. What you ...

Only top voted, non community-wiki answers of a minimum length are eligible