New answers tagged

10

The usual approach to prove IND-CPA security is to construct a logical argumentation called "reduction". In this argumentation you first start with the assumption that certain computational problem is hard (for example, the Decisional Diffie-Hellman assumption), and then you proceed to demonstrate that if your crypto scheme were insecure with respect to ...


3

From what I understood, data units are sectors, so a sector can have at most $2^{128}-2$ blocks but you can only encrypt $2^{20}$ blocks which cannot be correct (it seems too little compared to a disk's capacity). The data unit is the sector, yes, but both of those quotes only talk about the length of a single data unit. The larger number in the latter ...


1

Considering you are working in $GF(2)$, every multiplication is equivalent to a AND and addition to a XOR. $GF(2)$ also known as $<\mathbb{Z}_2,+,\times>$ is the Galois Field (GF) of two elements: $0$ and $1$. Because $GF(2)$ is a field, addition has an identity element ($0$) and an inverse for every element; multiplication has an ...


0

Given your answer to my comment, I'll try to give you an intuition about why simulators are used in cryptographic proofs (but as already mentioned, I cannot help much for the particular case of ABE). Disclaimer: this will be a very (very) informal explanation Imagin two players, Alice and Bob, performing some cryptographic protocol. Alice has an input $a$, ...


5

In order for information-theoretic security to imply computational security, you need to require that the simulator run in time that is polynomial in the running time of the real adversary. This is the standard definition, specifically to avoid protocols such as you presented in your question. So, the answer is: If you allow the simulator to be unbounded ...


4

There is actually a field of study regarding provably secure block ciphers. The seminal paper was "How to construct pseudorandom permutations from pseudorandom functions" (1988) by Luby and Rackoff. Their paper used pseudorandom round functions in a Feistel construction, and proved that 4 rounds were sufficient to make the resulting block cipher a ...


1

I remember that BEAR and LION are two block ciphers are provably secure under the assumption that the primitives used (hash and stream cipher) are secure. This is the most "provable secure like" approach I can remember. A part of that, I think the securite of block ciphers are anaylized as the paper you have cited do. Checking the security against the ...


3

Yes. A secure PRF is a secure MAC. A secure MAC of a secure MAC is a secure MAC. Therefore, applying a PRF to a MAC still gives you a MAC. Depending on the length of the inner MAC and the PRF you may lose security bits, but if they are long enough it works.


4

In symmetric cryptography it is hard to prove security properties on algorithm. Most of block ciphers relies on showing resistances to the current attacks (cf the paper you linked or any paper that introduce a new block cipher). As nobody can know what will be the next attack vector, it is not possible to be prepared against it. From The design of Rijndael ...



Top 50 recent answers are included