Questions tagged [adversarial-model]
An adversary model formally defines the power of the adversary. It includes specifics whether the adversary is deterministic/randomized, uniform/non-uniform, interactive/non-interactive and how he interacts with the security game.
78 questions
1
vote
1
answer
51
views
What is the size of an adversary?
I was reading a SMPC paper, and it writes that "non-uniform adversary A of size $\text{poly}(λ)$".
What is the size of adversary in secure multiparty computation, and where can I find some ...
- 11
0
votes
0
answers
43
views
Proving statistically $\epsilon$-indistinguishable scheme is also $\epsilon$-adversarial indistinguishable
We say that $(\operatorname{Gen}, \operatorname{Enc}, \operatorname{Dec})$ with message and ciphertext spaces $\mathcal{M}$ and $\mathcal{C}$ is a statistically $\epsilon$-indistinguishable secure SKE ...
2
votes
0
answers
35
views
PFS and PCS Game
Where can I find a formal security definition for Perfect Forward Secrecy (PFS) and Post-Compromise Security (PCS) that includes a cryptographic game model and a challenge-response structure, ...
- 31
1
vote
1
answer
39
views
An upper bound for advantage related to differential privacy
My previous question define a security game, advantage $\mathsf{Adv}$ and two probability distributions $P_{m_0}$ and $P_{m_1}$, representing $Enc_k(m_0)$ and $Enc_k(m_1)$ separately.
There, my main ...
- 25
1
vote
1
answer
80
views
An upper bound for advantage in a security game
Suppose I have defined a security game in a private-key (symmetric) encryption scheme.
Remark: Note that encryption algorithm is probabilistic, so for a specific message m, $Enc_k(m)$ might output a ...
- 25
2
votes
2
answers
81
views
Understanding Adversary's Advantage for Target Key Recovery in Ideal Cipher Model
In the ideal cipher model, a block cipher is modeled by a different, independent random permutation for every key.
Let $$ \mathcal{A}_{q}^{\text{IC-EKS}} $$ be a ( q )-query exhaustive key-search ...
4
votes
1
answer
149
views
Certificateless public key cryptography
In the Wikipedia article on Certificateless Public Key Cryptography https://en.wikipedia.org/wiki/Certificateless_cryptography, it states, "For tight security, a certificateless system has to ...
2
votes
1
answer
97
views
Reduction from factoring to RSA and the Oracle RSA problem
Recently I read some papers related to RSA Brown16,AM09,BNPS01 and I learned that there is a variant problem of RSA is The oracle RSA problem (or one more RSA Problem) is $m+1$ copies of the classic ...
- 311
0
votes
0
answers
33
views
Signature forgery in different adversarial settings
I'm currently studying the different adversarial settings for digital signatures.
In Goldwasser, Micali and Rivests paper they propose three different chosen message attack settings, which are vastly ...
- 253
2
votes
1
answer
98
views
Replacing the Hash function with messages in the BLS signature scheme, the security degenerates from EUF to SUF?
I have been thinking about this question: if I directly replace the hash function with the message in the BLS signature, does the security of the BLS degenerate from existential unforgeability(EUF) to ...
- 456
2
votes
1
answer
261
views
Confirming understanding of security protocol modelled in Scyther
In university, I'm currently learning how to use Scyther to model security protocols. Currently I am trying to understand what is happening in an example protocol given to me which is:
...
- 77
2
votes
0
answers
107
views
Automated Security Protocol tool that models algebraic operations
Are there any automated security protocol verification tools that model algebraic operations; specifically addition.
I am familiar with AVISPA and Verifpal, and they are both great and user-friendly ...
- 327
2
votes
1
answer
217
views
Breaking CDH also breaks DHI
I am trying to show that by breaking the Computational Diffie-Hellmann (CDH) assumption one also breaks the Diffie-Hellmann inverse assumption. Unfortunately, I am a bit stuck and do not know where to ...
- 345
0
votes
0
answers
67
views
Why is a protocol that is secure in the presence of a malicious adversary also secure in the presence of an augmented semi-honest adversary？
Proposition Let π be a protocol that securely computes a functionality f in the presence of malicious adversaries. Then π securely computes f in the presence of augmented semi-honest adversaries.
...
- 1
2
votes
2
answers
476
views
What is the relationship between "Challenger" and "Oracle" in a security proof?
In game-based security proof, I found that games are defiend to be played between a PPT adversary and a challenger. The adversary is able to issue queries to different oracles and receives ...
- 39
3
votes
1
answer
413
views
What does the bounded storage model mean?
In the bounded storage model, it assumes the storage of the adversary is bounded or limited, and thus it is possible that we can achieve a kind of cryptography without relying on hardness assumption. ...
- 807
2
votes
2
answers
662
views
Is there any good attack model of HMAC?
Are there any good attack models of HMAC? Like how it can be attacked? If there are any possible attacks of HMAC I would be happy to know about it.
- 21
1
vote
1
answer
268
views
Superscript vs subscript notation in cryptographic formulation
I'm currently reading this paper [PDF]. On page 4, I bumped into these notations :
\begin{equation}
\text { Experiment } \operatorname{Exp}_{\mathcal{F} \mathcal{E}, A}^{\text {ind-mode }}(k) \text { :...
- 992
3
votes
1
answer
180
views
Are semi-honest adversaries specific for MPC?
I know that in multiparty computation we may consider semi-honest or malicious adversaries.
I can find papers that consider malicious adversaries, but the semi-honest term is only mentioned in MPC ...
- 31
4
votes
1
answer
85
views
Secret sharing such that all shareholders obtain access to the secret (one shareholder can't just run off with the shares)
Say, using something like Shamir's polynomial scheme, you split a secret $x$ among $n$ people (each given a "share" of the secret) such that you need all $n$ shares to recover the secret.
...
- 365
7
votes
1
answer
615
views
Difference between Generic Group Models
I'm trying to understand the difference between the (classical) Generic Group Model as it is described by Shoup [Shoup] and the somewhat restricted Generic Group Model as it is described by Schnorr ...
- 379
1
vote
1
answer
138
views
RSA public key identification
Consider a multi party system where public keys of all receivers are known. Server wants to send message to one of them using (textbook?) RSA. Adversary is given ciphertext and even Message to be send,...
- 49
1
vote
0
answers
138
views
Impossibility of recovering the key of a keyed pseudorandom permutation
I'm currently working on some cryptography homework, but I'm stuck on this particular question.
Let $F$ be a pseudorandom permutation with identical key length and
block length (both equal to the ...
- 111
14
votes
1
answer
3k
views
What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?
I don't have a proper computer science education, so bear with my misunderstandings.
UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
- 352
3
votes
2
answers
358
views
What is the advantage of adversary if the random number repeats?
In proof of CPA-security of encryption scheme $(r, F_k(r)\oplus m )$
where:
$F_k$ is a keyed function
$r\in_R\{0,1\}^n$ is a random number,
on page 85 of Introduction to modern cryptography we have
...
- 151
0
votes
0
answers
207
views
Formal proof that the following definitions of perfect secrecy are equivalent
I've seen the following two definitions of perfect secrecy for an encryption scheme (Gen, Enc, Dec).
...
- 1
2
votes
1
answer
343
views
Extended Canetti-Krawczyk - Clean Session Definition
In the extended Canetti-Krawczyk (eCK) model [1] the adversary $\mathcal{M}$ is allowed to make a sequence of queries, eventually performs a $Test(sid)$ query, receives a value $C$ and at some point ...
- 45
4
votes
1
answer
354
views
Is there any examples of information-theoretic secure MPC for dishonest majority against malicious adversary?
My research is to propose highly secure MPC protocol with some conditions.
Especially, I want to consider that
security against malicious (active) adversary
dishonest majority setting
information-...
- 43
0
votes
1
answer
227
views
Proof by reduction for for digital signature scheme $S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$
Let $(Gen,S,V)$ be a secure signature scheme (existentially unforgeable under a chosen message attack) with message space${\{0,1\}}^n$. Generate two signing/verification key ...
- 51
4
votes
1
answer
273
views
Differential Privacy: What is the 'game' between data holder and adversary?
I have been reading the Differential Privacy (DP) literature for some time to get familiar with it. I feel comfortable with the Math and Stats foundations of it, but I am suffering a bit from the '...
0
votes
0
answers
91
views
Model a dishonest majority controlled by several adversaries in a voting protocol?
In the context of secure multi-party computation protocols, when a dishonest majority is considered, it is assumed the worst case scenario, i.e., all the corrupted parties are controlled by the same ...
- 149
1
vote
2
answers
102
views
How can an adversary request decryption of an unused sector?
The Wikipedia article on Disk Encryption Theory mentions this
a powerful adversary can modify an unused sector on the disk and then request its decryption.
I understand that an adversary is ...
user80567
0
votes
1
answer
573
views
What does it mean that a semi-honest adversary can look at the internal state of a controlled party?
I have a doubt regarding the definition of (static) semi-honest adversaries. In this tutorial I read:
Such an adversary controls one of the parties (statically, and so at the onset
of the ...
- 149
0
votes
0
answers
45
views
What does it mean exactly that an adversary can control a polynomial number of parties?
I have an intuitive idea of this, but I am not sure if I am formally interpreting it correctly. In the scenario I am considering, each party is identified by a sequence of $n$ bits and I have $2^{n}$ ...
- 149
1
vote
1
answer
364
views
Computational binding implies Perfect hiding?
Given a commitment scheme which is computationally binding (based on some conjectured hard problem, say), does it also imply that the scheme is unconditionally hiding?
My idea was: Since the scheme ...
- 279
1
vote
1
answer
304
views
Adversary model for malicious but selfish adversaries?
Covert adversaries have the property that they may deviate arbitrarily from the protocol specification in an attempt to cheat, but do not wish to be caught doing so.
Does this model includes also the ...
- 149
3
votes
2
answers
354
views
Things already known to adversary before planning an attack
This is a very basic and practical question. Since I started reading cryptography recently, these things keep bugging me.
What are the things that an adversary is usually aware of before planning an ...
- 65
1
vote
0
answers
42
views
How does one ensure that a handshake protocol is secure assuming all underlying cryptography used are secure
Suppose one have to design handshake protocol using known secure cryptographic algorithm. The designer of implementer can assume that crypotography is secure but how would they ensure protocol itself ...
1
vote
1
answer
400
views
IND-CPA security of mode of operation using triple AES with plaintext || IV+counter
I have found this figure of a mode of operation using a triple AES with m||IV+ctr input:
I suppose it's a custom mode of operation since I haven't seen it anywhere else. My question is if it is IND-...
2
votes
1
answer
599
views
Attacks on code misusing RSA_public_decrypt
I've encountered some code that I'm reviewing that is misusing RSA_public_decrypt to "authenticate" a variable-length response without using any hash. The code ...
- 437
2
votes
1
answer
542
views
What does non-collusion assumption mean in server-aided protocol based on secret sharing?
Suppose $m$ clients split their own input into $n$ shares using additive secret sharing scheme (mod something).
Then, each of the clients sends each share to each of $n$ external servers.
After ...
- 1,685
1
vote
1
answer
271
views
AES Threat Model
I've read/skimmed a few documents about the AES family of encryption, but haven't seen anything about what exactly it protects against. There are many ways to "encrypt" things, and not all of them ...
- 147
1
vote
2
answers
659
views
RSA-FDH Signature Scheme EUF-CMA
I am aware of attacks whereby an attacker is able to forge a message IF the hash of the original message is the same hash as their current message. The question is, is it still possible for RSA-FDH to ...
-1
votes
1
answer
74
views
Ensuring correctness property in multi-party protocols
Can you suggest mechanisms to ensure the correctness of the protocol output, against Active Adversaries in multi-party protocols. Specifically for a dishonest majority setting?
I would like to have ...
1
vote
1
answer
269
views
Is the simulation-based proof difficult and needed? [closed]
What is the role for simulation-based proof under the semi-honest model without considering malicious adversaries?
I agree with that a view of a some party is important to prove that a protocol is ...
- 1,685
11
votes
0
answers
247
views
How to build a security model
What are the minimal components to build a security model proof for a protocol?
This question might seem trivial, but having read many papers-- from the IEEE, ACM, etc., that talk about a KMP-- I ...
- 381
4
votes
3
answers
446
views
Homomorphic & Functional encryption: Mapping unencrypted outputs to encrypted outputs using existing data
Let's assume I have datapiece A which, after being put through a model or neural network, has a known output X in the unencrypted space. When I move datapiece A into an encrypted space, and put it ...
- 143
4
votes
1
answer
4k
views
Comparing stronger vs. weaker assumptions
If I have to argue that an assumption A is stronger than B, should I argue this way:-
An adversary breaking the security of A does not translate to breaking the security of B. But, if an adversary ...
- 307
0
votes
1
answer
126
views
The differences between the attackers in the definitions of IND-ATK and NM-ATK
I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
- 1,632
3
votes
0
answers
164
views
How do adversary models and security types relate [from InfoSec SE]
I have been told to move the question to this forum in order to get a better insight, so here we go:
Reading some questions in this forum I encountered this answer mentioning IND-CPA as a requirement ...
- 63