One example is OCB2;

• Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC by Rogaway. It is standardized in ISO/IEC 19772:2009. The author also provided a proof by security reductions, that is, a break of OCB2 implies the break of the underlying block cipher.

However, Akiko Inoue and Kazuhiko Minematsu describe practical forgery attacks against OCB2 in 2018. From the abstract;

We present practical attacks against OCB2, an ISO-standard authenticated encryption (AE) scheme. OCB2 is a highly-efficient blockcipher mode of operation. It has been extensively studied and widely believed to be secure thanks to the provable security proofs. Our attacks allow the adversary to create forgeries with single encryption query of almost-known plaintext. This attack can be further extended to powerful almost-universal and universal forgeries using more queries. The source of our attacks is the way OCB2 implements AE using a tweakable blockcipher, called XEX∗ . We have verified our attacks using a reference code of OCB2. Our attacks do not break the privacy of OCB2, and are not applicable to the others, including OCB1 and OCB3.

And other works that improve the Inoue and Minematsu's work;

• 2018 Plaintext Recovery Attack of OCB2 Tetsu Iwata

• 2018 Breaking the confidentiality of OCB2 by Bertram Poettering

• 2019 Cryptanalysis of OCB2: Attacks on Authenticity and Confidentiality Akiko Inoue and Tetsu Iwata and Kazuhiko Minematsu and Bertram Poettering ( Combined paper)

One example is OCB2;

• Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC by Rogaway. It is standardized in ISO/IEC 19772:2009. The author also provided a proof by security reductions, that is, a break of OCB2 implies the break of the underlying block cipher.

However, Akiko Inoue and Kazuhiko Minematsu describe practical forgery attacks against OCB2 in 2018. From the abstract;

We present practical attacks against OCB2, an ISO-standard authenticated encryption (AE) scheme. OCB2 is a highly-efficient blockcipher mode of operation. It has been extensively studied and widely believed to be secure thanks to the provable security proofs. Our attacks allow the adversary to create forgeries with single encryption query of almost-known plaintext. This attack can be further extended to powerful almost-universal and universal forgeries using more queries. The source of our attacks is the way OCB2 implements AE using a tweakable blockcipher, called XEX∗ . We have verified our attacks using a reference code of OCB2. Our attacks do not break the privacy of OCB2, and are not applicable to the others, including OCB1 and OCB3.

And other works that improve the Inoue and Minematsu's work;

• 2018 Plaintext Recovery Attack of OCB2 Tetsu Iwata

• 2018 Breaking the confidentiality of OCB2 by Bertram Poettering

• 2019 Cryptanalysis of OCB2: Attacks on Authenticity and Confidentiality Akiko Inoue and Tetsu Iwata and Kazuhiko Minematsu and Bertram Poettering ( Combined paper)

A half one;

• 2012 Enhancements of Trapdoor Permutations by Oded Goldreich and Ron D. Rothblum. They stated that doubly-enhanced trapdoor permutations suffice for constructing $NIZK$s for $NP$. Later, Canetti and Lichtenberg, the proposed enhancements may not suffice for the NIZK application.

  • 2018 Certifying Trapdoor Permutations, Revisited by Ran Canetti and Amit Lichtenberg.

One example is OCB2;

• Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC by Rogaway. It is standardized in ISO/IEC 19772:2009. The author also provided a proof by security reductions, that is, a break of OCB2 implies the break of the underlying block cipher.

However, Akiko Inoue and Kazuhiko Minematsu describe practical forgery attacks against OCB2 in 2018. From the abstract;

We present practical attacks against OCB2, an ISO-standard authenticated encryption (AE) scheme. OCB2 is a highly-efficient blockcipher mode of operation. It has been extensively studied and widely believed to be secure thanks to the provable security proofs. Our attacks allow the adversary to create forgeries with single encryption query of almost-known plaintext. This attack can be further extended to powerful almost-universal and universal forgeries using more queries. The source of our attacks is the way OCB2 implements AE using a tweakable blockcipher, called XEX∗ . We have verified our attacks using a reference code of OCB2. Our attacks do not break the privacy of OCB2, and are not applicable to the others, including OCB1 and OCB3.

One example is OCB2;

• Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC by Rogaway. It is standardized in ISO/IEC 19772:2009. The author also provided a proof by security reductions, that is, a break of OCB2 implies the break of the underlying block cipher.

However, Akiko Inoue and Kazuhiko Minematsu describe practical forgery attacks against OCB2 in 2018. From the abstract;

We present practical attacks against OCB2, an ISO-standard authenticated encryption (AE) scheme. OCB2 is a highly-efficient blockcipher mode of operation. It has been extensively studied and widely believed to be secure thanks to the provable security proofs. Our attacks allow the adversary to create forgeries with single encryption query of almost-known plaintext. This attack can be further extended to powerful almost-universal and universal forgeries using more queries. The source of our attacks is the way OCB2 implements AE using a tweakable blockcipher, called XEX∗ . We have verified our attacks using a reference code of OCB2. Our attacks do not break the privacy of OCB2, and are not applicable to the others, including OCB1 and OCB3.

And other works that improve the Inoue and Minematsu's work;

• 2018 Plaintext Recovery Attack of OCB2 Tetsu Iwata

• 2018 Breaking the confidentiality of OCB2 by Bertram Poettering

• 2019 Cryptanalysis of OCB2: Attacks on Authenticity and Confidentiality Akiko Inoue and Tetsu Iwata and Kazuhiko Minematsu and Bertram Poettering ( Combined paper)