# Tag Info

3

Note that in the definition you gave, it says that in order for $\Pi$ to be an indistinguishable scheme, then the above inequality must hold for all PPT adversaries. So it seems that if $\Pi$ holds the indistinguishability, then there should not exist any adversary A that $\Pr[\mathsf{Exp}_{A,\Pi}(\lambda) = 1] < 1/2 + \mathsf{negl}(\lambda)$, for ...

2

Here's an artificial example: Start with some secure encryption scheme with encryption function $\mathcal{E}(\cdot)$, and construct a new scheme with encryption function $\mathcal{E}'(\cdot)$, which for any input message $m$ copies the first bit, $b$, of the message, and outputs $b||\mathcal{E}(m)$, where $||$ denotes concatenation. For such a scheme, ...

2

Your proof certainly has to work even if the adversary doesn't use the random oracle. One technique that you can try is to begin by proving a separate lemma that if the adversary doesn't ask a certain query first, then it definitely cannot succeed in distinguishing. Then, you proceed to prove the simulation conditioned on it asking this query. However, if ...

1

As you say, CCA proofs are actually reductions to underlying problems. In all CCA proofs that I can think of at the moment, the underlying problem is a weaker security notion for an "embedded" encryption scheme - e.g. Cramer-Shoup and friends use IND-CPA of ElGamal and Fujisaki-Okamoto uses OWE of the contained scheme. The general proof strategy is to take ...

1

(Note that this attempted answer contains a significant amount of guessing and must not be considered reliable!) If one assumes "there is a general reduction from $P$ to $Q$" to mean "existence of $Q$ implies existence of $P$" (which is up to interpretation since the authors do not clearly define that term, but it seems somewhat reasonable), then the ...

1

Any peer to peer mesh network would be sufficient. If peers pass messages on to other peers then no peer can no for certain which peer a message is intended for. It would be possible to determine (with some degree of confidence) the source of the message. The real difficulty is handling all the other problems. How do you deal with malicious nodes, denial ...

1

1- $\:$ I believe correctness does not have an exact meaning in this context. It would certainly involve not letting the distinguisher see the transcript, and might involve not letting the distinguisher see the adversary's randomness, and possibly involved not even letting the distinguisher see the auxiliary input. 2- $\:$ ...

Only top voted, non community-wiki answers of a minimum length are eligible