Return to Question

Is there moderns (post World War II) and famous protocols that were proven secure (in any model: game based, UC...) but whose proof were wrong and could have lead to real world attacks?

Note that:

• I'm not really concerned about attacks on the mathematical assumptions themself (which seem to be the focus of this thread, and can't be considered as mistakes in the proof: they are "just" unfortunate assumptions). But of course, I'd love to hear about protocols that claimed to be secure as soon as assumption X was true, while in fact they are broken despite the fact that X is not broken.
• By "real world attack", I would prefer attacks that broke protocols used in practice by non-specialists end users, but I'm also fine with well known protocols that are mostly known and used in the academic world.

Ideally, I'd love to learn if the "mistake" in the proof was really a mistake or is likely to be created on purpose (NSA backdoor...).

EDIT

Could you also precise, whenever possible, if the attack is due to a mistake in the proof itself, or if the model of security is not appropriately chosen?

Are there moderns (post World War II) and famous protocols that were proven secure (in any model: game-based, UC...) but whose proof was wrong and could have led to real-world attacks?

Note that:

• I'm not really concerned about attacks on the mathematical assumptions themself (which seem to be the focus of this thread, and can't be considered as mistakes in the proof: they are "just" unfortunate assumptions). But of course, I'd love to hear about protocols that claimed to be secure as soon as assumption X was true, while in fact they are broken despite the fact that X is not broken.
• By "real world attack", I would prefer attacks that broke protocols used in practice by non-specialist end-users, but I'm also fine with well known protocols that are mostly known and used in the academic world.

Ideally, I'd love to learn if the "mistake" in the proof was really a mistake or is likely to be created on purpose (NSA backdoor...).

EDIT

Could you also be precise, whenever possible, if the attack is due to a mistake in the proof itself, or if the model of security is not appropriately chosen?