# Tag Info

## New answers tagged security-definition

3

It is certainly possible to conceive protocols, for which a 128 bit key might cause collisions that might be avoided by using a 256 bit key. For instance, suppose you have a protocol that uses AES-CCM with a 56 bit nonce for bulk encryption. If the nonce is generated randomly, there is at least a $2^{-28}$ collision rate. It is essential that you ensure ...

2

When talking about effective security level, one first have to say what type of attack is considered. There are two main attack types on a blockcipher with block size $n$ in the mode of operation $\Pi$: Key-recovery attack: an attacker finds the secret key of length $k$. Distinguishing attack: an attacker distinguishes the ciphertexts, produced by $\Pi$, ...

3

I just read that chapter of the book, and the authors don't really justify their claim. They also talk about "using random data to prevent collision and precomputation attacks" (which would then give you back the full key-size crypto strength) – this is about using random initialization vectors and such. But if you are using an insecure mode of operation, ...

4

This lecture (PDF) has the solution in section 3. Here's my informal explanation of the proof: We have an unpredictable PRG $G$. We want to show that $G$ is secure, or in other words indistinguishable from $R$ (I'll use = to mean indistinguishable whenever referring to two distributions for the remainder of the proof). Using the notation that $G_k ... 2 I've found an answer to my question, I'm going to post it because it can be useful to someone out there. The point is that, if we assume that$\mbox{Prob}[\mbox{Priv}_{\mathcal{A},\Pi}^{\mbox{eav}}(n)=1]\leq 1/2+negl(n)$, then$\mbox{Prob}[\mbox{Priv}_{\mathcal{A},\Pi}^{\mbox{eav}}(n)=0]\leq 1/2+negl(n)\$ too (if this were not to happen, then we could create ...

Top 50 recent answers are included