Skip to main content

Questions tagged [adversarial-model]

An adversary model formally defines the power of the adversary. It includes specifics whether the adversary is deterministic/randomized, uniform/non-uniform, interactive/non-interactive and how he interacts with the security game.

Filter by
Sorted by
Tagged with
2 votes
1 answer
77 views

Reduction from factoring to RSA and the Oracle RSA problem

Recently I read some papers related to RSA Brown16,AM09,BNPS01 and I learned that there is a variant problem of RSA is The oracle RSA problem (or one more RSA Problem) is $m+1$ copies of the classic ...
constantine's user avatar
0 votes
0 answers
30 views

Signature forgery in different adversarial settings

I'm currently studying the different adversarial settings for digital signatures. In Goldwasser, Micali and Rivests paper they propose three different chosen message attack settings, which are vastly ...
limeeattack's user avatar
2 votes
1 answer
87 views

Replacing the Hash function with messages in the BLS signature scheme, the security degenerates from EUF to SUF?

​I have been thinking about this question: if I directly replace the hash function with the message in the BLS signature, does the security of the BLS degenerate from existential unforgeability(EUF) ...
X.H. Yue's user avatar
  • 392
2 votes
1 answer
226 views

Confirming understanding of security protocol modelled in Scyther

In university, I'm currently learning how to use Scyther to model security protocols. Currently I am trying to understand what is happening in an example protocol given to me which is: ...
hasin's user avatar
  • 77
2 votes
0 answers
106 views

Automated Security Protocol tool that models algebraic operations

Are there any automated security protocol verification tools that model algebraic operations; specifically addition. I am familiar with AVISPA and Verifpal, and they are both great and user-friendly ...
Mona's user avatar
  • 197
2 votes
1 answer
195 views

Breaking CDH also breaks DHI

I am trying to show that by breaking the Computational Diffie-Hellmann (CDH) assumption one also breaks the Diffie-Hellmann inverse assumption. Unfortunately, I am a bit stuck and do not know where to ...
Rory's user avatar
  • 335
0 votes
0 answers
57 views

Why is a protocol that is secure in the presence of a malicious adversary also secure in the presence of an augmented semi-honest adversary?

Proposition Let π be a protocol that securely computes a functionality f in the presence of malicious adversaries. Then π securely computes f in the presence of augmented semi-honest adversaries. ...
Peng Nie's user avatar
2 votes
2 answers
404 views

What is the relationship between "Challenger" and "Oracle" in a security proof?

In game-based security proof, I found that games are defiend to be played between a PPT adversary and a challenger. The adversary is able to issue queries to different oracles and receives ...
Chandler's user avatar
3 votes
1 answer
378 views

What does the bounded storage model mean?

In the bounded storage model, it assumes the storage of the adversary is bounded or limited, and thus it is possible that we can achieve a kind of cryptography without relying on hardness assumption. ...
user77340's user avatar
  • 797
2 votes
2 answers
534 views

Is there any good attack model of HMAC?

Are there any good attack models of HMAC? Like how it can be attacked? If there are any possible attacks of HMAC I would be happy to know about it.
malik bilal's user avatar
1 vote
1 answer
239 views

Superscript vs subscript notation in cryptographic formulation

I'm currently reading this paper [PDF]. On page 4, I bumped into these notations : \begin{equation} \text { Experiment } \operatorname{Exp}_{\mathcal{F} \mathcal{E}, A}^{\text {ind-mode }}(k) \text { :...
tur11ng's user avatar
  • 962
3 votes
1 answer
173 views

Are semi-honest adversaries specific for MPC?

I know that in multiparty computation we may consider semi-honest or malicious adversaries. I can find papers that consider malicious adversaries, but the semi-honest term is only mentioned in MPC ...
giga giga's user avatar
4 votes
1 answer
74 views

Secret sharing such that all shareholders obtain access to the secret (one shareholder can't just run off with the shares)

Say, using something like Shamir's polynomial scheme, you split a secret $x$ among $n$ people (each given a "share" of the secret) such that you need all $n$ shares to recover the secret. ...
chausies's user avatar
  • 335
7 votes
1 answer
516 views

Difference between Generic Group Models

I'm trying to understand the difference between the (classical) Generic Group Model as it is described by Shoup [Shoup] and the somewhat restricted Generic Group Model as it is described by Schnorr ...
einsteinwein's user avatar
1 vote
1 answer
130 views

RSA public key identification

Consider a multi party system where public keys of all receivers are known. Server wants to send message to one of them using (textbook?) RSA. Adversary is given ciphertext and even Message to be send,...
Sam's user avatar
  • 49
1 vote
0 answers
129 views

Impossibility of recovering the key of a keyed pseudorandom permutation

I'm currently working on some cryptography homework, but I'm stuck on this particular question. Let $F$ be a pseudorandom permutation with identical key length and block length (both equal to the ...
Peiffap's user avatar
  • 111
13 votes
1 answer
3k views

What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?

I don't have a proper computer science education, so bear with my misunderstandings. UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
Expectator's user avatar
3 votes
2 answers
349 views

What is the advantage of adversary if the random number repeats?

In proof of CPA-security of encryption scheme $(r, F_k(r)\oplus m )$ where: $F_k$ is a keyed function $r\in_R\{0,1\}^n$ is a random number, on page 85 of Introduction to modern cryptography we have ...
Doralisa's user avatar
  • 151
0 votes
0 answers
178 views

Formal proof that the following definitions of perfect secrecy are equivalent

I've seen the following two definitions of perfect secrecy for an encryption scheme (Gen, Enc, Dec). ...
NJay's user avatar
  • 1
2 votes
1 answer
322 views

Extended Canetti-Krawczyk - Clean Session Definition

In the extended Canetti-Krawczyk (eCK) model [1] the adversary $\mathcal{M}$ is allowed to make a sequence of queries, eventually performs a $Test(sid)$ query, receives a value $C$ and at some point ...
DobTheBard's user avatar
3 votes
1 answer
301 views

Is there any examples of information-theoretic secure MPC for dishonest majority against malicious adversary?

My research is to propose highly secure MPC protocol with some conditions. Especially, I want to consider that security against malicious (active) adversary dishonest majority setting information-...
shoy700's user avatar
  • 33
0 votes
1 answer
222 views

Proof by reduction for for digital signature scheme $S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$

Let $(Gen,S,V)$ be a secure signature scheme (existentially unforgeable under a chosen message attack) with message space${\{0,1\}}^n$. Generate two signing/verification key ...
mike's user avatar
  • 41
4 votes
1 answer
248 views

Differential Privacy: What is the 'game' between data holder and adversary?

I have been reading the Differential Privacy (DP) literature for some time to get familiar with it. I feel comfortable with the Math and Stats foundations of it, but I am suffering a bit from the '...
independentvariable's user avatar
0 votes
0 answers
86 views

Model a dishonest majority controlled by several adversaries in a voting protocol?

In the context of secure multi-party computation protocols, when a dishonest majority is considered, it is assumed the worst case scenario, i.e., all the corrupted parties are controlled by the same ...
Lorenzo's user avatar
  • 149
1 vote
2 answers
98 views

How can an adversary request decryption of an unused sector?

The Wikipedia article on Disk Encryption Theory mentions this a powerful adversary can modify an unused sector on the disk and then request its decryption. I understand that an adversary is ...
user avatar
0 votes
1 answer
516 views

What does it mean that a semi-honest adversary can look at the internal state of a controlled party?

I have a doubt regarding the definition of (static) semi-honest adversaries. In this tutorial I read: Such an adversary controls one of the parties (statically, and so at the onset of the ...
Lorenzo's user avatar
  • 149
0 votes
0 answers
44 views

What does it mean exactly that an adversary can control a polynomial number of parties?

I have an intuitive idea of this, but I am not sure if I am formally interpreting it correctly. In the scenario I am considering, each party is identified by a sequence of $n$ bits and I have $2^{n}$ ...
Lorenzo's user avatar
  • 149
1 vote
1 answer
342 views

Computational binding implies Perfect hiding?

Given a commitment scheme which is computationally binding (based on some conjectured hard problem, say), does it also imply that the scheme is unconditionally hiding? My idea was: Since the scheme ...
user2505282's user avatar
1 vote
1 answer
300 views

Adversary model for malicious but selfish adversaries?

Covert adversaries have the property that they may deviate arbitrarily from the protocol specification in an attempt to cheat, but do not wish to be caught doing so. Does this model includes also the ...
Lorenzo's user avatar
  • 149
3 votes
2 answers
352 views

Things already known to adversary before planning an attack

This is a very basic and practical question. Since I started reading cryptography recently, these things keep bugging me. What are the things that an adversary is usually aware of before planning an ...
user8499104's user avatar
1 vote
0 answers
41 views

How does one ensure that a handshake protocol is secure assuming all underlying cryptography used are secure

Suppose one have to design handshake protocol using known secure cryptographic algorithm. The designer of implementer can assume that crypotography is secure but how would they ensure protocol itself ...
RealTimeEngineer91's user avatar
1 vote
1 answer
383 views

IND-CPA security of mode of operation using triple AES with plaintext || IV+counter

I have found this figure of a mode of operation using a triple AES with m||IV+ctr input: I suppose it's a custom mode of operation since I haven't seen it anywhere else. My question is if it is IND-...
Giannis Pappas's user avatar
2 votes
1 answer
455 views

Attacks on code misusing RSA_public_decrypt

I've encountered some code that I'm reviewing that is misusing RSA_public_decrypt to "authenticate" a variable-length response without using any hash. The code ...
slipheed's user avatar
  • 427
2 votes
1 answer
493 views

What does non-collusion assumption mean in server-aided protocol based on secret sharing?

Suppose $m$ clients split their own input into $n$ shares using additive secret sharing scheme (mod something). Then, each of the clients sends each share to each of $n$ external servers. After ...
mallea's user avatar
  • 1,635
1 vote
1 answer
264 views

AES Threat Model

I've read/skimmed a few documents about the AES family of encryption, but haven't seen anything about what exactly it protects against. There are many ways to "encrypt" things, and not all of them ...
Erhannis's user avatar
  • 147
1 vote
2 answers
616 views

RSA-FDH Signature Scheme EUF-CMA

I am aware of attacks whereby an attacker is able to forge a message IF the hash of the original message is the same hash as their current message. The question is, is it still possible for RSA-FDH to ...
Yusuf Mohamedillahy's user avatar
-1 votes
1 answer
73 views

Ensuring correctness property in multi-party protocols

Can you suggest mechanisms to ensure the correctness of the protocol output, against Active Adversaries in multi-party protocols. Specifically for a dishonest majority setting? I would like to have ...
Ananya Shrivastava's user avatar
1 vote
1 answer
263 views

Is the simulation-based proof difficult and needed? [closed]

What is the role for simulation-based proof under the semi-honest model without considering malicious adversaries? I agree with that a view of a some party is important to prove that a protocol is ...
mallea's user avatar
  • 1,635
11 votes
0 answers
245 views

How to build a security model

What are the minimal components to build a security model proof for a protocol? This question might seem trivial, but having read many papers-- from the IEEE, ACM, etc., that talk about a KMP-- I ...
CipherX's user avatar
  • 381
4 votes
3 answers
429 views

Homomorphic & Functional encryption: Mapping unencrypted outputs to encrypted outputs using existing data

Let's assume I have datapiece A which, after being put through a model or neural network, has a known output X in the unencrypted space. When I move datapiece A into an encrypted space, and put it ...
nick carraway's user avatar
4 votes
1 answer
4k views

Comparing stronger vs. weaker assumptions

If I have to argue that an assumption A is stronger than B, should I argue this way:- An adversary breaking the security of A does not translate to breaking the security of B. But, if an adversary ...
Cinderella's user avatar
0 votes
1 answer
122 views

The differences between the attackers in the definitions of IND-ATK and NM-ATK

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
Blanco's user avatar
  • 1,622
3 votes
0 answers
162 views

How do adversary models and security types relate [from InfoSec SE]

I have been told to move the question to this forum in order to get a better insight, so here we go: Reading some questions in this forum I encountered this answer mentioning IND-CPA as a requirement ...
Alvai's user avatar
  • 63
3 votes
1 answer
185 views

Idiomatic description for an adversary in possesion of a quantum computer?

I was wondering what the "accepted" way is to describe an adversary who: is in possession of a quantum computer with which they can efficiently run quantum algorithms such as Grover's or Shor's ...
user1870238's user avatar
5 votes
5 answers
499 views

How to rigorously prove that $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$ is CPA secure assuming $\Pi$ is?

Assume $\Pi$ is a CPA secure scheme. Let $\Pi'$ be a derived scheme, such that the encryption of a message $M$ is as follows: $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$, where $LSB(k)$ is the ...
mercury0114's user avatar
1 vote
0 answers
169 views

How to provide security against malicious adversary in Ring LWE homomorphic encryption scheme?

I was reading Ring LWE homomorphic encryption scheme referred in http://www.wisdom.weizmann.ac.il/~zvikab/localpapers/IdealHom.pdf But this encryption scheme provides security mostly in the semi-...
Tushar Saha's user avatar
1 vote
0 answers
135 views

Given the block cipher compute max PRF advantage

Hey all I'm having a bit of problem with this question. Not sure how to approach it. Any help will be appreciated :)
Ishida 's user avatar
2 votes
1 answer
289 views

Compute maximum PRF advantage

Hello all, I'm new to crypto, I'm not sure if my thought process is correct ? any assistance will be helpful. How useful is the partial info that A gets from (a), (b), and (c) ; in (c) A can ...
Rukia 's user avatar
  • 21
3 votes
1 answer
482 views

Show G is insecure against adaptive adversaries

Hey crypto SE, i'm having a bit of trouble with this question. Can anyone help me to understand how to go about solving this problem? Any help is appreciated :) Show G is insecure against adaptive ...
Ishida 's user avatar
0 votes
1 answer
1k views

Build a scheme that is CCA secure but not authenticated

Trying to understand a solution from this paper: Summary: $E'_K=0||E_K(m)$ and $D'_K(0||c)=D_K(c)$ and $D'_K(1||c)=1$ IND-CCA secure (how?) as $1||c$ and $0||c$ are are easily decryptable Not ...
user153882's user avatar