# Tag Info

9

AES is deemed secure because: Its building blocks and design principles are fully specified. It was selected as part of an open competition. It has sustained 15 years of attempted cryptanalysis from many smart people, in a high-exposure situation, and it came out relatively unscathed. Another reason, which is not as good but felt important by many ...

6

Randomness is not a property of strings of bits (or characters of any sort). Rather it is a property of the process that generates those strings. However, it is convenient to conflate the string with the thing that produced the string, and thus to speak about strings being 'random' or 'not random'. The string '00000', for example, is random if it was the ...

4

The two primary techniques I'm familiar with is structuring a cryptographic primitive as a sequence of games and the universally composable security framework. Sequence of Games The idea here is to represent a protocol/primitive as a game played between an attacker and a challenger. You define a bad event and show through the game that the event happens ...

4

The encryption scheme in the experiment you describe does not have to be fixed-length. We simply require that the two messages the adversary sends to its oracle have the same length. The restriction is on the adversary, not on the encryption algorithm. So why do we put this requirement on the adversary? The reason is that in every practical encryption ...

4

To be concise, true randomness boils down to the selected data being causally unrelated. That is, if each piece of data is the result of no common cause, then there is no relation by which the rest of the data can be predicted or inferred. So being unpredictable is a consequence of being truly random, but it is the lack of causal relationship that is the ...

3

Super-Pseudo-Random A function family is super-pseudo-random if no polynomial time adversary can tell the difference between a function from the family and a real random function, given oracle access to the function and its inverse. (As a practical example: block ciphers are typically modeled as super-pseudo-random permutations.) So, defining it a bit: a ...

3

Randomness is the information loss of any causal relationship between events. The universe needn't be a clockwork universe for the assumption of pervasive causality - if events are "sticky" and accrue localised causality in the same way that a molecular cloud accretes into stars and planets. The underlying cause of the speed of light might also be the prime ...

3

Advantage and success probability are just words. Their meaning is in practice decided by how the speakers of the language use the words. You have observed that people use the terms advantage and probability in this way. One could probably argue that this is confusing or illogical or something like that, but such is language. About dividing by two: ...

3

You had your finger on it, you do know something about the encryption of two messages of different length before they are actually encrypted: the length of the corresponding ciphertexts. If the setting in which you're using your encryption scheme allows for a maximum message length then you can always pad to make every ciphertext the same size ...

3

There is no hard problem to which AES can be provably be reduced. It is believed to be difficult to break because lots of smart people have tried for more than a decade now, using the best (publically known) techniques, and so far the only successes have been marginal improvements compared to brute force.

2

You can probably prove the security against your game from the security in the IND-ID-CCA game of Boneh and Franklin (see http://courses.cs.vt.edu/cs6204/Privacy-Security/Papers/Crypto/IBE-Weil-Pairing.pdf). The idea is to create an adversary $\mathcal{B}$ against IND-ID-CCA from your adversary $\mathcal{A}$. Essentially $\mathcal{B}$ will play ...

2

Do you have a specific application domain in mind? I do not know of any formal definition that spans multiple application domains. A formal definition of Perfect Forward Secrecy for the domain of key exchange protocols is included in this paper: Beyond eCK: Perfect Forward Secrecy under Actor Compromise and Ephemeral-Key Reveal

2

In a signature scheme with appendix (such as RSASSA-PSS), the signature $s=Sign(M,PrivateKey)$ of the message $M$ is usually appended to the unmodified message $M$, forming $(M,s)$. This is effectively sent, and verified; the signature is an appendix to the message. Signature scheme with appendix opposes to signature scheme with message recovery (such as ...

2

Suppose Alice has $x$ and Bob has $y$ in your scenario, and let $\pi =(\pi_A, \pi_B)$ be the protocol machines for Alice & Bob respectively. Here is how you would formally define security of the protocol against a corrupt Alice. Define the following algorithms / random variables: ${\sf Real}(\pi, y,\mathcal{A},1^k)$: Internally simulate an instance ...

2

Does anyone have a reliable source for this? Well, you are asking about the definition of a CSPRNG, and whether this second criteria is a necessary part. Well, it comes down the to exact definition of the term 'CSPRNG'. If we define a CSPRNG as something that generates output which is indistinguishable from random (your first criteria), then a ...

2

An efficiently computable Permutation Ensemble is (Weakly) Pseudo-Random if and only if it is infeasible for an adversary with oracle access to [a function that was chosen either from then Ensemble or uniformly from the set of all permutations on bit-strings of the corresponding length] to distinguish between those two cases. An efficiently computable ...

1

This depends on the encryption algorithms in use. If the encryption algorithm is a bijection, then every possible $C$ must have a preimage. Examples of this include block ciphers like AES. In these cases, the decryption algorithm will output a message $m$ such that $E_k(m)=c$. Note that if $c$ has been tampered with by an adversary but is still the same ...

1

Here's a couple of useful sources for definitions of CSPRNG or DRBGs (Deterministic Random Bit Generator). Check out the NIST documents for CSPRNG: http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf http://csrc.nist.gov/publications/drafts/800-90/draft-sp800-90b.pdf http://csrc.nist.gov/publications/drafts/800-90/draft-sp800-90c.pdf B and ...

1

In the context of the original question, what you're comparing your stream cipher to is a particular probability model. That model has each bit have probability 0.5 of being a 1, and has that probability be independent of the bit's position in the string and any surrounding bits. It's the kind of source you would get if you flipped a fair coin to determine ...

1

I think there are two issues involved here: How do you tell if a ciphertext has the properties of a truly random stream? How do you tell if a stream actually is truly random? For the first part, there are many statistical techniques. But the basic question is whether there is any detectable relationship between the plaintext and the ciphertext. If ...

1

Here is the proof I came up with. Please let me know if you see any problems with it... Statement to prove: If an encryption scheme is secure in the IND\$-CPA sense, then it is secure in the IND-CPA sense as well. i.e. IND\$-CPA $\Rightarrow$ IND-CPA The contrapositive is easier to prove: $\neg$IND-CPA $\Rightarrow$ $\neg$IND\$-CPA. This statement is a ... 1 Informally,if you intercept a cipher-text from a perfectly secure encryption system, you can find a key that causes that cipher-text to decrypt to any message you want ( of the correct length). So without knowing which key the author actually picked, you never learn anything about the message. This holds even if you try every possible key (because all keys ... 1 I can't give an example illustrating why leakage must be non-negligible for the utility of the mechanism, but I can give a proof of why leakage must be non-negligible for the utility of the mechanism. Let$\;\; U \: = \: \left\{\langle D,D'\rangle : D,D' \text{ differ in one element}\right\} \;\;\;$. By the triangle inequality, for all$D$and$D'\$, for ...

1

If M0, and M1 are any 2 m-bit messages, how is it possible that their encryption be equal b? The definition does not say that their encryption is equal b. It says that the function f outputs b. This function is often called distinguisher (or attacker) and he should not be able to distinguish which message M0 or M1 was encrypted. In other words there ...

Only top voted, non community-wiki answers of a minimum length are eligible