# Tag Info

0

Your proof certainly has to work even if the adversary doesn't use the random oracle. One technique that you can try is to begin by proving a separate lemma that if the adversary doesn't ask a certain query, then it definitely cannot succeed in distinguishing. Then, you proceed to prove the simulation conditioned on it asking this query. On another note, ...

1

As you say, CCA proofs are actually reductions to underlying problems. In all CCA proofs that I can think of at the moment, the underlying problem is a weaker security notion for an "embedded" encryption scheme - e.g. Cramer-Shoup and friends use IND-CPA of ElGamal and Fujisaki-Okamoto uses OWE of the contained scheme. The general proof strategy is to take ...

1

(Note that this attempted answer contains a significant amount of guessing and must not be considered reliable!) If one assumes "there is a general reduction from $P$ to $Q$" to mean "existence of $Q$ implies existence of $P$" (which is up to interpretation since the authors do not clearly define that term, but it seems somewhat reasonable), then the ...

0

Your definition seems to be wrong. The correct definition is: $\left|{\Pr[\textsf{Exp}_{A, \Pi}(\lambda)]-\frac{1}{2}}\right|<\text{negl}(\lambda)$ EDIT: after reading again, your initial definition is also correct (the one you initially quoted). It says for all $A$. So it automatically implies that the probability cannot be too low from 1/2 for any ...

3

Note that in the definition you gave, it says that in order for $\Pi$ to be an indistinguishable scheme, then the above inequality must hold for all PPT adversaries. So it seems that if $\Pi$ holds the indistinguishability, then there should not exist any adversary A that $\Pr[\mathsf{Exp}_{A,\Pi}(\lambda) = 1] < 1/2 + \mathsf{negl}(\lambda)$, for ...

2

Here's an artificial example: Start with some secure encryption scheme with encryption function $\mathcal{E}(\cdot)$, and construct a new scheme with encryption function $\mathcal{E}'(\cdot)$, which for any input message $m$ copies the first bit, $b$, of the message, and outputs $b||\mathcal{E}(m)$, where $||$ denotes concatenation. For such a scheme, ...

0

First, forget about the idea to use this approach for web-browsing. If you want to circumvent censorship while browsing TOR is your way, but can't provide full censorship-freedom. TOR works by establishing a tunnel through the internet (changed evey 10min) via three servers where the first received triple-encrypted contenet, the second double-encrypted and ...

1

Any peer to peer mesh network would be sufficient. If peers pass messages on to other peers then no peer can no for certain which peer a message is intended for. It would be possible to determine (with some degree of confidence) the source of the message. The real difficulty is handling all the other problems. How do you deal with malicious nodes, denial ...

-1

Pretty much TLS can do this - by encrypting the link to the recipient's mailserver, any intercept would be unable to see the header info (and hence, which user of the mailserver is receiving the mail) Onionskin routing is better at hiding who is sending an email, but usually does not conceal the recipient (as the last hop is normal SMTP)

1

1- $\:$ I believe correctness does not have an exact meaning in this context. It would certainly involve not letting the distinguisher see the transcript, and might involve not letting the distinguisher see the adversary's randomness, and possibly involved not even letting the distinguisher see the auxiliary input. 2- $\:$ ...

Top 50 recent answers are included