Questions tagged [adversarial-model]
An adversary model formally defines the power of the adversary. It includes specifics whether the adversary is deterministic/randomized, uniform/non-uniform, interactive/non-interactive and how he interacts with the security game.
70
questions
2
votes
1
answer
56
views
Replacing the Hash function with messages in the BLS signature scheme, the security degenerates from EUF to SUF?
I have been thinking about this question: if I directly replace the hash function with the message in the BLS signature, does the security of the BLS degenerate from existential unforgeability(EUF) ...
- 368
2
votes
1
answer
84
views
Confirming understanding of security protocol modelled in Scyther
In university, I'm currently learning how to use Scyther to model security protocols. Currently I am trying to understand what is happening in an example protocol given to me which is:
...
- 77
2
votes
0
answers
102
views
Automated Security Protocol tool that models algebraic operations
Are there any automated security protocol verification tools that model algebraic operations; specifically addition.
I am familiar with AVISPA and Verifpal, and they are both great and user-friendly ...
- 177
0
votes
0
answers
35
views
Game-based security notion and hybrid proofs - adversarial randomness
Say we have a game-based definition of security and wish to prove the security of our construction using a series of hybrids. Can we somehow "fix" an adversary that we interact with in one ...
- 61
2
votes
1
answer
158
views
Breaking CDH also breaks DHI
I am trying to show that by breaking the Computational Diffie-Hellmann (CDH) assumption one also breaks the Diffie-Hellmann inverse assumption. Unfortunately, I am a bit stuck and do not know where to ...
- 335
0
votes
0
answers
48
views
Why is a protocol that is secure in the presence of a malicious adversary also secure in the presence of an augmented semi-honest adversary？
Proposition Let π be a protocol that securely computes a functionality f in the presence of malicious adversaries. Then π securely computes f in the presence of augmented semi-honest adversaries.
...
- 1
1
vote
2
answers
313
views
What is the relationship between "Challenger" and "Oracle" in a security proof?
In game-based security proof, I found that games are defiend to be played between a PPT adversary and a challenger. The adversary is able to issue queries to different oracles and receives ...
- 29
3
votes
1
answer
305
views
What does the bounded storage model mean?
In the bounded storage model, it assumes the storage of the adversary is bounded or limited, and thus it is possible that we can achieve a kind of cryptography without relying on hardness assumption. ...
- 787
2
votes
2
answers
444
views
Is there any good attack model of HMAC?
Are there any good attack models of HMAC? Like how it can be attacked? If there are any possible attacks of HMAC I would be happy to know about it.
- 21
1
vote
1
answer
187
views
Superscript vs subscript notation in cryptographic formulation
I'm currently reading this paper [PDF]. On page 4, I bumped into these notations :
\begin{equation}
\text { Experiment } \operatorname{Exp}_{\mathcal{F} \mathcal{E}, A}^{\text {ind-mode }}(k) \text { :...
- 878
3
votes
1
answer
151
views
Are semi-honest adversaries specific for MPC?
I know that in multiparty computation we may consider semi-honest or malicious adversaries.
I can find papers that consider malicious adversaries, but the semi-honest term is only mentioned in MPC ...
- 31
4
votes
1
answer
71
views
Secret sharing such that all shareholders obtain access to the secret (one shareholder can't just run off with the shares)
Say, using something like Shamir's polynomial scheme, you split a secret $x$ among $n$ people (each given a "share" of the secret) such that you need all $n$ shares to recover the secret.
...
- 335
6
votes
1
answer
406
views
Difference between Generic Group Models
I'm trying to understand the difference between the (classical) Generic Group Model as it is described by Shoup [Shoup] and the somewhat restricted Generic Group Model as it is described by Schnorr ...
- 369
1
vote
1
answer
128
views
RSA public key identification
Consider a multi party system where public keys of all receivers are known. Server wants to send message to one of them using (textbook?) RSA. Adversary is given ciphertext and even Message to be send,...
- 49
1
vote
0
answers
117
views
Impossibility of recovering the key of a keyed pseudorandom permutation
I'm currently working on some cryptography homework, but I'm stuck on this particular question.
Let $F$ be a pseudorandom permutation with identical key length and
block length (both equal to the ...
- 111
12
votes
1
answer
2k
views
What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?
I don't have a proper computer science education, so bear with my misunderstandings.
UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
- 332
3
votes
2
answers
316
views
What is the advantage of adversary if the random number repeats?
In proof of CPA-security of encryption scheme $(r, F_k(r)\oplus m )$
where:
$F_k$ is a keyed function
$r\in_R\{0,1\}^n$ is a random number,
on page 85 of Introduction to modern cryptography we have
...
- 151
0
votes
0
answers
165
views
Formal proof that the following definitions of perfect secrecy are equivalent
I've seen the following two definitions of perfect secrecy for an encryption scheme (Gen, Enc, Dec).
...
- 1
2
votes
1
answer
276
views
Extended Canetti-Krawczyk - Clean Session Definition
In the extended Canetti-Krawczyk (eCK) model [1] the adversary $\mathcal{M}$ is allowed to make a sequence of queries, eventually performs a $Test(sid)$ query, receives a value $C$ and at some point ...
- 45
3
votes
1
answer
258
views
Is there any examples of information-theoretic secure MPC for dishonest majority against malicious adversary?
My research is to propose highly secure MPC protocol with some conditions.
Especially, I want to consider that
security against malicious (active) adversary
dishonest majority setting
information-...
- 33
0
votes
1
answer
190
views
Proof by reduction for for digital signature scheme $S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$
Let $(Gen,S,V)$ be a secure signature scheme (existentially unforgeable under a chosen message attack) with message space${\{0,1\}}^n$. Generate two signing/verification key ...
- 41
3
votes
1
answer
202
views
Differential Privacy: What is the 'game' between data holder and adversary?
I have been reading the Differential Privacy (DP) literature for some time to get familiar with it. I feel comfortable with the Math and Stats foundations of it, but I am suffering a bit from the '...
0
votes
0
answers
76
views
Model a dishonest majority controlled by several adversaries in a voting protocol?
In the context of secure multi-party computation protocols, when a dishonest majority is considered, it is assumed the worst case scenario, i.e., all the corrupted parties are controlled by the same ...
- 139
1
vote
2
answers
96
views
How can an adversary request decryption of an unused sector?
The Wikipedia article on Disk Encryption Theory mentions this
a powerful adversary can modify an unused sector on the disk and then request its decryption.
I understand that an adversary is ...
user80567
0
votes
1
answer
425
views
What does it mean that a semi-honest adversary can look at the internal state of a controlled party?
I have a doubt regarding the definition of (static) semi-honest adversaries. In this tutorial I read:
Such an adversary controls one of the parties (statically, and so at the onset
of the ...
- 139
0
votes
0
answers
44
views
What does it mean exactly that an adversary can control a polynomial number of parties?
I have an intuitive idea of this, but I am not sure if I am formally interpreting it correctly. In the scenario I am considering, each party is identified by a sequence of $n$ bits and I have $2^{n}$ ...
- 139
1
vote
1
answer
309
views
Computational binding implies Perfect hiding?
Given a commitment scheme which is computationally binding (based on some conjectured hard problem, say), does it also imply that the scheme is unconditionally hiding?
My idea was: Since the scheme ...
- 259
1
vote
1
answer
292
views
Adversary model for malicious but selfish adversaries?
Covert adversaries have the property that they may deviate arbitrarily from the protocol specification in an attempt to cheat, but do not wish to be caught doing so.
Does this model includes also the ...
- 139
3
votes
2
answers
351
views
Things already known to adversary before planning an attack
This is a very basic and practical question. Since I started reading cryptography recently, these things keep bugging me.
What are the things that an adversary is usually aware of before planning an ...
- 65
1
vote
0
answers
39
views
How does one ensure that a handshake protocol is secure assuming all underlying cryptography used are secure
Suppose one have to design handshake protocol using known secure cryptographic algorithm. The designer of implementer can assume that crypotography is secure but how would they ensure protocol itself ...
1
vote
1
answer
355
views
IND-CPA security of mode of operation using triple AES with plaintext || IV+counter
I have found this figure of a mode of operation using a triple AES with m||IV+ctr input:
I suppose it's a custom mode of operation since I haven't seen it anywhere else. My question is if it is IND-...
2
votes
1
answer
361
views
Attacks on code misusing RSA_public_decrypt
I've encountered some code that I'm reviewing that is misusing RSA_public_decrypt to "authenticate" a variable-length response without using any hash. The code ...
- 427
2
votes
1
answer
422
views
What does non-collusion assumption mean in server-aided protocol based on secret sharing?
Suppose $m$ clients split their own input into $n$ shares using additive secret sharing scheme (mod something).
Then, each of the clients sends each share to each of $n$ external servers.
After ...
- 1,595
1
vote
1
answer
252
views
AES Threat Model
I've read/skimmed a few documents about the AES family of encryption, but haven't seen anything about what exactly it protects against. There are many ways to "encrypt" things, and not all of them ...
- 147
1
vote
2
answers
546
views
RSA-FDH Signature Scheme EUF-CMA
I am aware of attacks whereby an attacker is able to forge a message IF the hash of the original message is the same hash as their current message. The question is, is it still possible for RSA-FDH to ...
-1
votes
1
answer
71
views
Ensuring correctness property in multi-party protocols
Can you suggest mechanisms to ensure the correctness of the protocol output, against Active Adversaries in multi-party protocols. Specifically for a dishonest majority setting?
I would like to have ...
1
vote
1
answer
251
views
Is the simulation-based proof difficult and needed? [closed]
What is the role for simulation-based proof under the semi-honest model without considering malicious adversaries?
I agree with that a view of a some party is important to prove that a protocol is ...
- 1,595
11
votes
0
answers
232
views
How to build a security model
What are the minimal components to build a security model proof for a protocol?
This question might seem trivial, but having read many papers-- from the IEEE, ACM, etc., that talk about a KMP-- I ...
- 381
4
votes
3
answers
408
views
Homomorphic & Functional encryption: Mapping unencrypted outputs to encrypted outputs using existing data
Let's assume I have datapiece A which, after being put through a model or neural network, has a known output X in the unencrypted space. When I move datapiece A into an encrypted space, and put it ...
- 143
4
votes
1
answer
3k
views
Comparing stronger vs. weaker assumptions
If I have to argue that an assumption A is stronger than B, should I argue this way:-
An adversary breaking the security of A does not translate to breaking the security of B. But, if an adversary ...
- 197
0
votes
1
answer
116
views
The differences between the attackers in the definitions of IND-ATK and NM-ATK
I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
- 1,582
3
votes
0
answers
160
views
How do adversary models and security types relate [from InfoSec SE]
I have been told to move the question to this forum in order to get a better insight, so here we go:
Reading some questions in this forum I encountered this answer mentioning IND-CPA as a requirement ...
- 63
3
votes
1
answer
178
views
Idiomatic description for an adversary in possesion of a quantum computer?
I was wondering what the "accepted" way is to describe an adversary who:
is in possession of a quantum computer with which they can efficiently run quantum algorithms such as Grover's or Shor's ...
- 187
5
votes
5
answers
476
views
How to rigorously prove that $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$ is CPA secure assuming $\Pi$ is?
Assume $\Pi$ is a CPA secure scheme. Let $\Pi'$ be a derived scheme, such
that the encryption of a message $M$ is as follows:
$Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$, where
$LSB(k)$ is the ...
- 257
1
vote
0
answers
165
views
How to provide security against malicious adversary in Ring LWE homomorphic encryption scheme?
I was reading Ring LWE homomorphic encryption scheme referred in http://www.wisdom.weizmann.ac.il/~zvikab/localpapers/IdealHom.pdf
But this encryption scheme provides security mostly in the semi-...
- 119
1
vote
0
answers
129
views
Given the block cipher compute max PRF advantage
Hey all I'm having a bit of problem with this question. Not sure how to approach it. Any help will be appreciated :)
- 51
2
votes
1
answer
252
views
Compute maximum PRF advantage
Hello all, I'm new to crypto, I'm not sure if my thought process is correct ? any assistance will be helpful.
How useful is the partial info that A gets from (a), (b), and (c) ; in (c) A can ...
- 21
3
votes
1
answer
459
views
Show G is insecure against adaptive adversaries
Hey crypto SE, i'm having a bit of trouble with this question. Can anyone help me to understand how to go about solving this problem? Any help is appreciated :)
Show G is insecure against adaptive ...
- 51
0
votes
1
answer
1k
views
Build a scheme that is CCA secure but not authenticated
Trying to understand a solution from this paper:
Summary:
$E'_K=0||E_K(m)$ and $D'_K(0||c)=D_K(c)$ and $D'_K(1||c)=1$
IND-CCA secure (how?) as $1||c$ and $0||c$ are are easily decryptable
Not ...
- 507
5
votes
0
answers
190
views
Explanation of the term "view" for algorithm or adversary
What is the view of an algorithm/adversary? Is view just a term used to describe the output over a set of inputs for a probabilistic algorithm?
For example:
Consider experiment Mac-forgeA,Π (n). ...
