In a paper it says "In the generic group model, the PRF is adaptively secure for inputs of $\mathbb{Z}_q^n$". Maybe a stupid question, but what does "adaptively secure" mean exactly?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
Well, when we talk about "chosen plaintext attacks", there are two possible flavors for this attack:
The attacker gets to create a list of plaintexts to be encrypted; we'll go through and encrypt them all, and then hand over all the ciphertexts to the attacker.
The attacker gets to ask for a plaintext to be encrypted; we encrypt it and hand over that ciphertext. Based on what the ciphertext looks like, he can then select another plaintext for us to encrypt (and we'll go through the procedure for a number of plaintext/ciphertext pairs).
This second model is known as "adaptively chosen plaintext attack" model, because the attacker can adapt the plaintext he selects based on previous results. This is a strictly stronger attack model than the "nonadaptive" attack model, where we insist that the attacker gives us all the plaintext up front before we give him anything. "Adaptively secure" means that it is secure within this attack model.
Nowadays, this distinction is a bit obscure, mostly because we really don't have much use for a cryptographical primitive that is secure only in the nonadaptive model; hence a "chosen plaintext attack" typically does mean "adaptively chosen plaintext attack". However, the terminology does turn up when we're being precise.
-
$\begingroup$ I suppose the same distinction could be made for chosen-ciphertext attacks. $\endgroup$ Apr 10, 2013 at 17:36
-
1$\begingroup$ @PaŭloEbermann: absolutely. I mentioned chosen-plaintext attack because user4811 mentioned that this was in the context of a PRF. $\endgroup$– ponchoApr 10, 2013 at 18:06