2
$\begingroup$

I have a research paper on data security using proxy re-encryption, and I need to provide an answer to a reviewer's comment. However, I have no idea on what to do or how to answer it.

The security analysis of the proposed method is based on indistinguishability against chosen plaintext attack. This is the comment:

The security analysis is based on or is limited to known attacks, but no security model/framework is provided that could guarantee security in front of unknown attacks.

What is the "unknown attack" the reviewer is referring to? What is the best answer I can give for this?

$\endgroup$
4
$\begingroup$

What is the "unknown attack" the reviewer is referring to?

The reviewer did not say "the unknown attack", but "in front of unknown attacks". That refers to no attack in particular. Much like a reviewer of a math paper could tell, without thinking of a particular $y$: "the argument that $p$ is prime is unconvincing, for it fails to show $\gcd(p,y)=1$ for hypothetical $y\in\left[2,\left\lfloor\sqrt n\right\rfloor\right]$ with $y\not\in\mathbb S$" (where $\mathbb S$ is a set defined in the paper).

I read the reviewer's argument as equivalent to: the existing analysis gives no proof that the claimed IND-CPA security follows from the difficulty of some assumed-hard problem.

That's what so-called security proofs are when it comes to encryption. Since about the last decade of the 20th century, such proof is considered necessary for proposing a new cryptosystem or protocol in a serious peer-reviewed crypto journal or conference, with few exceptions. These exceptions include block ciphers, hashes, or similar low-level primitives: for these, we still examine known attacks, and prove they do not apply, preferably with some quantitative assessment.

For all other cryptosystems, modern arguments against unknown attacks are on the tune of: Assume a PPT algorithm $\mathcal A$ that breaks IND-CPA security of the proposed system. (..) Hence PPT algorithm $\mathcal B$, using $\mathcal A$ as a subroutine, is able to solve the well-studied smurf problem with non-vanishing probability. Perhaps that smurf problem is: attack of AES with random key under IND-CPA.

If such security reduction is missing entirely from a paper, adding it will be a major rework; or sometime, impossible.

Up to the early 1990s, practice allowed to claim security without proof, or even without a clear definition. It was common the claim was disproved. For example, El Gmamal encryption in $\mathbb Z_p^*$ turned out to leak one bit about the plaintext. Countless attacks where found on RSA encryption and signature schemes. Crypto was then proverbial for it's break and fix cycles, much like bridge design used to be. Fortunately, these times are over when it come to crypto designs in IACR publications. That's still the norm for implementation, some standards, and less than recommendable publications.


My favorite example of why we should not trust security claims based on repelling existing attacks is the ISO/IEC 9796:1991 signature scheme, withdrawn 2000. It was AFAIK the first official standard for RSA signature, and carefully justified by Louis Claude Guillou, Jean-Jacques Quisquater¹, Mike Walker, Peter Landrock, Caroline Shaer Precautions taken against various potential attacks in ISO/IEC DIS 9796 “Digital signature scheme giving message recovery”, in proceedings of Eurocrypt 1990. And then, in 1999, that scheme was broken by Don Coppersmith, Shai Halevi, and Charanjit S. Jutla extending an almost working attack by Jean-Sébastien Coron, David Naccache, and Julien Stern; and independently by me using a technique a child could apply: all there is to do is find two different paths across this maze and collect the node values. 9796 maze


¹ I thank JJQ for having taught me multiprime RSA (then uncommon and perhaps unpublished) and using the Chineese Remainder Theorem for that.

$\endgroup$
4
  • $\begingroup$ I have such reductions in the paper, so I'm wondering why the reviewer still asks for that $\endgroup$
    – Kwame
    Mar 27 at 21:21
  • $\begingroup$ @Kwame you can ask them to clarify? Although FGrieu translated into a possible equivalent statement, the in front of unknown attacks is still needs explanations from the original poster. $\endgroup$
    – kelalaka
    Mar 28 at 10:18
  • $\begingroup$ @kelalaka thank you very much. I will do as suggested $\endgroup$
    – Kwame
    Mar 28 at 18:53
  • $\begingroup$ @Kwame you can upvote and accept the answer, if the answer is good (UP) and satisfies you (Accept). Could you inform us when you get respond? $\endgroup$
    – kelalaka
    Mar 28 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.