# Tag Info

## New answers tagged provable-security

1

I have sent this question to the ProVerif mailing list as suggested in the comments. The response I obtained from Bruno Blanchet was as follows. Actually, ProVerif does not say that the code is dead, it just says that it cannot prove that it is not dead. (It says "RESULT not attacker:serverFinished_96[...] cannot be proved.") If it said "RESULT not ...

0

There is a similar approach to prove the semantic security of real world one time pad, using a pseudorandom generator. Basically the idea is to correlate the success probabilities of an alleged hard problem with the success probabilities of an attacker for your scheme. In the case of RWOTP once the simulator chooses a pseudorandom generator to pick up its ...

2

While I cannot point you to a specific paper that works as a great example for this technique, the idea is quite simple. Assume two distributions $X,Y$ which have the same support, so random variables distributed according to one of these distributions are drawn from the same set. Now assume you got a probabilistic adversary $A$ that takes as input $misc$ ...

0

If each round key is of the same size of the block to be encrypted and all round keys are truly randomly generated independent from each other, then we have OTP. This is similar to using a truly randomly generated key of the same size of the plaintext to be encrypted. Each bit of this key is used only one-time to encrypt one plaintext bit.

1

The simulator obtains "client $B$'s input" in the same way the simulator obtains $\:\{\hspace{-0.03 in}0,\hspace{-0.04 in}0\hspace{-0.03 in}\}\;$. Even in the real world, the server computes its response without using any secrets, that response is the only message $B$ receives, and (from your description) no other party gives any output. $\:$ Thus, it ...

1

If, as can be reasonably inferred from the question, a fresh random $k$ is chosen on each invocation of $G$, then $G$ is not a pseudorandom generator because it is not deterministic. (A pseudorandom generator by definition is a deterministic algorithm.) If $k$ is fixed, then more information would be needed. For example, is $k$ always the same, or is a ...

1

To give this question its deserved answer, I’ll repeat what Ricky Demer noted in his comment: G(x \oplus 1^s) = F(k,x \oplus 1^s) \oplus F(k,x \oplus 1^s \oplus 1^s) \\ \downarrow \\ F(k,x \oplus 1^s) \oplus F(k,x \oplus 1^s \oplus 1^s) = F(k,x \oplus 1^s) \oplus F(k,x \oplus 0^s) \\ \downarrow \\ F(k,x \oplus 1^s) \oplus F(k,x \oplus 0^s) = F(k,x ...

Top 50 recent answers are included