# Tag Info

## Hot answers tagged security-definition

12

AES is deemed secure because: Its building blocks and design principles are fully specified. It was selected as part of an open competition. It has sustained 15 years of attempted cryptanalysis from many smart people, in a high-exposure situation, and it came out relatively unscathed. Another reason, which is not as good but felt important by many ...

10

Randomness is not a property of strings of bits (or characters of any sort). Rather it is a property of the process that generates those strings. However, it is convenient to conflate the string with the thing that produced the string, and thus to speak about strings being “random” or “not random”. The string 00000, for example, is random if it was the ...

7

If you sample a random element, then you sample it according to some distribution. Uniformly then means that you sample from the uniform distribution, i.e., you sample if from a set where drawing each element is equally probable. Let us assume you have a set of 4 elements, then sampling uniformly at random from this set, every element is drawn with ...

6

It fails to be a cryptographically-strong PRNG because it is predictable: given some outputs, you can predict the next outputs. For instance, if you observe the outputs at offsets 0, 1, and 4096, you can predict what the output will be at offset 4097. What it's missing: it's not that it's missing some little tweak (just change line 7 to use addition ...

5

Randomness is the information loss of any causal relationship between events. The universe needn't be a clockwork universe for the assumption of pervasive causality - if events are "sticky" and accrue localised causality in the same way that a molecular cloud accretes into stars and planets. The underlying cause of the speed of light might also be the prime ...

5

To be concise, true randomness boils down to the selected data being causally unrelated. That is, if each piece of data is the result of no common cause, then there is no relation by which the rest of the data can be predicted or inferred. So being unpredictable is a consequence of being truly random, but it is the lack of causal relationship that is the ...

5

By a generic attack we also understand an attack that with minimal corrections would apply to every block cipher. For example, suppose you have a (plaintext,ciphertext) pair and test keys by exhaustive search: you apply the keyed cipher $E_K$ to plaintext $P$ for every $K$ and check if you get ciphertext $C$ in response. Quite often, the ciphertext bits ...

5

This lecture (PDF) has the solution in section 3. Here's my informal explanation of the proof: We have an unpredictable PRG $G$. We want to show that $G$ is secure, or in other words indistinguishable from $R$ (I'll use = to mean indistinguishable whenever referring to two distributions for the remainder of the proof). Using the notation that $G_k ... 4 The two primary techniques I'm familiar with is structuring a cryptographic primitive as a sequence of games and the universally composable security framework. Sequence of Games The idea here is to represent a protocol/primitive as a game played between an attacker and a challenger. You define a bad event and show through the game that the event happens ... 4 The encryption scheme in the experiment you describe does not have to be fixed-length. We simply require that the two messages the adversary sends to its oracle have the same length. The restriction is on the adversary, not on the encryption algorithm. So why do we put this requirement on the adversary? The reason is that in every practical encryption ... 4 As explained in a comment: A generic attack is one that works against all block-ciphers (with a given block and key size), without consideration about the structure of the block-cipher. One generic attack for a block cipher of a given block size$b$bits builds a dictionary of input/output pairs (e.g. from past plaintext/ciphertext), for a fixed key. When ... 4 The classic standard assumptions (such as DDH, CDH) are not parametrized and always have constant size (are static). Consequently, the assumption when used in a reductionist proof is independent of any system parameters or oracle queries and only related to the security parameter. In contrast, non-static ($q$-type) assumptions as already mentioned by ... 4 Without the specific reference I can't be sure this is what you are talking about, but generally a "long message" attack is a way to defeat second preimage resistance with less complexity than expected. It uses a time-space tradeoff to find a second preimage with complexity$2^{n/2}$for a$n$-bit hash function (normally you would expect$2^n$). In the ... 4 A long message is a message that, when padded, is longer than the block size of the hash function. That means that the hash function has to process the message in parts and keep track of state somehow, which may allow for attacks. Such attacks would not apply to messages shorter than the block size, and may additionally require a large number of blocks to ... 3 Answering my own question since there haven't been any response. In fact there is no flaw in the definition. Nor in my attack per se! However, the entire point of this definition is to rule out non-stateful schemes (and stateful schemes that doesn't incorporate the state in a sufficient manner) as being secure. In particular, when the adversary asks for ... 3 With this amount of information it is hard to advice. Previously when somebody asked about new algorithm he had produced, he was answered: Answer to Where could I submit my algorithm?. No matter what kind of cryptographic work, generally large part of that answer applies. If we knew anything about the work (like on which existing algorithms or problems you ... 3 Super-Pseudo-Random A function family is super-pseudo-random if no polynomial time adversary can tell the difference between a function from the family and a real random function, given oracle access to the function and its inverse. (As a practical example: block ciphers are typically modeled as super-pseudo-random permutations.) So, defining it a bit: a ... 3 An efficiently computable Permutation Ensemble is (Weakly) Pseudo-Random if and only if it is infeasible for an adversary with oracle access to [a function that was chosen either from then Ensemble or uniformly from the set of all permutations on bit-strings of the corresponding length] to distinguish between those two cases. An efficiently computable ... 3 Advantage and success probability are just words. Their meaning is in practice decided by how the speakers of the language use the words. You have observed that people use the terms advantage and probability in this way. One could probably argue that this is confusing or illogical or something like that, but such is language. About dividing by two: ... 3 Does anyone have a reliable source for this? Well, you are asking about the definition of a CSPRNG, and whether this second criteria is a necessary part. Well, it comes down the to exact definition of the term 'CSPRNG'. If we define a CSPRNG as something that generates output which is indistinguishable from random (your first criteria), then a ... 3 Here is the proof I came up with. Please let me know if you see any problems with it... Statement to prove: If an encryption scheme is secure in the IND\$-CPA sense, then it is secure in the IND-CPA sense as well. i.e. IND\$-CPA$\Rightarrow$IND-CPA The contrapositive is easier to prove:$\neg$IND-CPA$\Rightarrow\neg$IND\$-CPA. This statement is a ...

3

There is no hard problem to which AES can be provably be reduced. It is believed to be difficult to break because lots of smart people have tried for more than a decade now, using the best (publically known) techniques, and so far the only successes have been marginal improvements compared to brute force.

3

You had your finger on it, you do know something about the encryption of two messages of different length before they are actually encrypted: the length of the corresponding ciphertexts. If the setting in which you're using your encryption scheme allows for a maximum message length then you can always pad to make every ciphertext the same size ...

3

Suppose Alice has $x$ and Bob has $y$ in your scenario, and let $\pi =(\pi_A, \pi_B)$ be the protocol machines for Alice & Bob respectively. Here is how you would formally define security of the protocol against a corrupt Alice. Define the following algorithms / random variables: ${\sf Real}(\pi, y,\mathcal{A},1^k)$: Internally simulate an instance ...

3

Informally,if you intercept a cipher-text from a perfectly secure encryption system, you can find a key that causes that cipher-text to decrypt to any message you want ( of the correct length). So without knowing which key the author actually picked, you never learn anything about the message. This holds even if you try every possible key (because all keys ...

3

The standard definition of existential forgery allows the adversary to ask and obtain the signature of any message she wants, and claim success if she can exhibit (with sizable odds) any acceptable (message, signature) pair, for any message for which she did not ask signature. Update: There is also strong existential unforgeability, where the adversary ...

3

Reductionist security In a reductionist security proof for some cryptographic protocol $\Pi$ to some alleged hard problem $P$ means, that we can build an algorithm $\cal B$ for solving $P$ if we have access to a hypothetical algorithm $\cal A$ that efficiently breaks the security definition for the protocol $\Pi$. In general, showing a polynomial time ...

3

Perfect Secrecy (or information-theoretic secure) means that the ciphertext conveys no information about the content of the plaintext. In effect this means that, no matter how much ciphertext you have, it does not convey anything about what the plaintext and key were. It can be proved that any such scheme must use at least as much key material as there is ...

3

How secure is this cipher? At first glance, not very. It would appear to be vulnerable to a ciphertext-only attack, for example, the attacker can recover the plaintext given a ciphertext of about 10k (actually, he probably can deal with less), even assuming that all the attacker initially knows is that the plaintext is "ASCII English", and he has no ...

3

I just read that chapter of the book, and the authors don't really justify their claim. They also talk about "using random data to prevent collision and precomputation attacks" (which would then give you back the full key-size crypto strength) – this is about using random initialization vectors and such. But if you are using an insecure mode of operation, ...

Only top voted, non community-wiki answers of a minimum length are eligible