# Questions tagged [adversarial-model]

An adversary model formally defines the power of the adversary. It includes specifics whether the adversary is deterministic/randomized, uniform/non-uniform, interactive/non-interactive and how he interacts with the security game.

59 questions
Filter by
Sorted by
Tagged with
1answer
60 views

### Difference between Generic Group Models

I'm trying to understand the difference between the (classical) Generic Group Model as it is described by Shoup [Shoup] and the somewhat restricted Generic Group Model as it is described by Schnorr ...
1answer
94 views

### RSA public key identification

Consider a multi party system where public keys of all receivers are known. Server wants to send message to one of them using (textbook?) RSA. Adversary is given ciphertext and even Message to be send,...
0answers
29 views

### Real-ideal world paradigm and adversarial models: how to model an adversary controlling the network only?

When proving the security of a cryptographic protocol using the real-ideal world paradigm (under sequential composability only) I have seen considering corruption of parties only in the adversarial ...
0answers
95 views

### Impossibility of recovering the key of a keyed pseudorandom permutation

I'm currently working on some cryptography homework, but I'm stuck on this particular question. Let $F$ be a pseudorandom permutation with identical key length and block length (both equal to the ...
1answer
327 views

### What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?

I don't have a proper computer science education, so bear with my misunderstandings. UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
2answers
187 views

### What is the advantage of adversary if the random number repeats?

In proof of CPA-security of encryption scheme $(r, F_k(r)\oplus m )$ where: $F_k$ is a keyed function $r\in_R\{0,1\}^n$ is a random number, on page 85 of Introduction to modern cryptography we have ...
0answers
67 views

### Formal proof that the following definitions of perfect secrecy are equivalent

I've seen the following two definitions of perfect secrecy for an encryption scheme (Gen, Enc, Dec). ...
2answers
148 views

### Extended Canetti-Krawczyk - Clean Session Definition

In the extended Canetti-Krawczyk (eCK) model  the adversary $\mathcal{M}$ is allowed to make a sequence of queries, eventually performs a $Test(sid)$ query, receives a value $C$ and at some point ...
1answer
93 views

### Is there any examples of information-theoretic secure MPC for dishonest majority against malicious adversary?

My research is to propose highly secure MPC protocol with some conditions. Especially, I want to consider that security against malicious (active) adversary dishonest majority setting information-...
1answer
78 views

### Proof by reduction for for digital signature scheme $S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$

Let $(Gen,S,V)$ be a secure signature scheme (existentially unforgeable under a chosen message attack) with message space${\{0,1\}}^n$. Generate two signing/verification key ...
1answer
131 views

### Differential Privacy: What is the 'game' between data holder and adversary?

I have been reading the Differential Privacy (DP) literature for some time to get familiar with it. I feel comfortable with the Math and Stats foundations of it, but I am suffering a bit from the '...
0answers
36 views

### Model a dishonest majority controlled by several adversaries in a voting protocol?

In the context of secure multi-party computation protocols, when a dishonest majority is considered, it is assumed the worst case scenario, i.e., all the corrupted parties are controlled by the same ...
2answers
87 views

### How can an adversary request decryption of an unused sector?

The Wikipedia article on Disk Encryption Theory mentions this a powerful adversary can modify an unused sector on the disk and then request its decryption. I understand that an adversary is ...
1answer
62 views

### What does it mean that a semi-honest adversary can look at the internal state of a controlled party?

I have a doubt regarding the definition of (static) semi-honest adversaries. In this tutorial I read: Such an adversary controls one of the parties (statically, and so at the onset of the ...
0answers
36 views

### What does it mean exactly that an adversary can control a polynomial number of parties?

I have an intuitive idea of this, but I am not sure if I am formally interpreting it correctly. In the scenario I am considering, each party is identified by a sequence of $n$ bits and I have $2^{n}$ ...
1answer
90 views

### Computational binding implies Perfect hiding?

Given a commitment scheme which is computationally binding (based on some conjectured hard problem, say), does it also imply that the scheme is unconditionally hiding? My idea was: Since the scheme ...
1answer
257 views

### Adversary model for malicious but selfish adversaries?

Covert adversaries have the property that they may deviate arbitrarily from the protocol specification in an attempt to cheat, but do not wish to be caught doing so. Does this model includes also the ...
2answers
330 views

### Things already known to adversary before planning an attack

This is a very basic and practical question. Since I started reading cryptography recently, these things keep bugging me. What are the things that an adversary is usually aware of before planning an ...
0answers
30 views

### How does one ensure that a handshake protocol is secure assuming all underlying cryptography used are secure

Suppose one have to design handshake protocol using known secure cryptographic algorithm. The designer of implementer can assume that crypotography is secure but how would they ensure protocol itself ...
1answer
149 views

### IND-CPA security of mode of operation using triple AES with plaintext || IV+counter

I have found this figure of a mode of operation using a triple AES with m||IV+ctr input: I suppose it's a custom mode of operation since I haven't seen it anywhere else. My question is if it is IND-...
1answer
208 views

### Attacks on code misusing RSA_public_decrypt

I've encountered some code that I'm reviewing that is misusing RSA_public_decrypt to "authenticate" a variable-length response without using any hash. The code ...
1answer
209 views

### What does non-collusion assumption mean in server-aided protocol based on secret sharing?

Suppose $m$ clients split their own input into $n$ shares using additive secret sharing scheme (mod something). Then, each of the clients sends each share to each of $n$ external servers. After ...
1answer
185 views

### AES Threat Model

I've read/skimmed a few documents about the AES family of encryption, but haven't seen anything about what exactly it protects against. There are many ways to "encrypt" things, and not all of them ...
1answer
213 views

### RSA-FDH Signature Scheme EUF-CMA

I am aware of attacks whereby an attacker is able to forge a message IF the hash of the original message is the same hash as their current message. The question is, is it still possible for RSA-FDH to ...
1answer
57 views

### Ensuring correctness property in multi-party protocols

Can you suggest mechanisms to ensure the correctness of the protocol output, against Active Adversaries in multi-party protocols. Specifically for a dishonest majority setting? I would like to have ...
1answer
201 views

### Is the simulation-based proof difficult and needed? [closed]

What is the role for simulation-based proof under the semi-honest model without considering malicious adversaries? I agree with that a view of a some party is important to prove that a protocol is ...
0answers
193 views

### How to build a security model

What are the minimal components to build a security model proof for a protocol? This question might seem trivial, but having read many papers-- from the IEEE, ACM, etc., that talk about a KMP-- I ...
3answers
353 views

### Homomorphic & Functional encryption: Mapping unencrypted outputs to encrypted outputs using existing data

Let's assume I have datapiece A which, after being put through a model or neural network, has a known output X in the unencrypted space. When I move datapiece A into an encrypted space, and put it ...
1answer
2k views

### Comparing stronger vs. weaker assumptions

If I have to argue that an assumption A is stronger than B, should I argue this way:- An adversary breaking the security of A does not translate to breaking the security of B. But, if an adversary ...
1answer
76 views

### The differences between the attackers in the definitions of IND-ATK and NM-ATK

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
0answers
144 views

### How do adversary models and security types relate [from InfoSec SE]

I have been told to move the question to this forum in order to get a better insight, so here we go: Reading some questions in this forum I encountered this answer mentioning IND-CPA as a requirement ...
1answer
162 views

### Idiomatic description for an adversary in possesion of a quantum computer?

I was wondering what the "accepted" way is to describe an adversary who: is in possession of a quantum computer with which they can efficiently run quantum algorithms such as Grover's or Shor's ...
5answers
317 views

### How to rigorously prove that $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$ is CPA secure assuming $\Pi$ is?

Assume $\Pi$ is a CPA secure scheme. Let $\Pi'$ be a derived scheme, such that the encryption of a message $M$ is as follows: $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$, where $LSB(k)$ is the ...
0answers
150 views

### How to provide security against malicious adversary in Ring LWE homomorphic encryption scheme?

I was reading Ring LWE homomorphic encryption scheme referred in http://www.wisdom.weizmann.ac.il/~zvikab/localpapers/IdealHom.pdf But this encryption scheme provides security mostly in the semi-...
0answers
116 views

### Given the block cipher compute max PRF advantage

Hey all I'm having a bit of problem with this question. Not sure how to approach it. Any help will be appreciated :)
1answer
160 views

### Compute maximum PRF advantage

Hello all, I'm new to crypto, I'm not sure if my thought process is correct ? any assistance will be helpful. How useful is the partial info that A gets from (a), (b), and (c) ; in (c) A can ...
1answer
370 views

### Show G is insecure against adaptive adversaries

Hey crypto SE, i'm having a bit of trouble with this question. Can anyone help me to understand how to go about solving this problem? Any help is appreciated :) Show G is insecure against adaptive ...
1answer
686 views

### Build a scheme that is CCA secure but not authenticated

Trying to understand a solution from this paper: Summary: $E'_K=0||E_K(m)$ and $D'_K(0||c)=D_K(c)$ and $D'_K(1||c)=1$ IND-CCA secure (how?) as $1||c$ and $0||c$ are are easily decryptable Not ...
0answers
160 views

### Explanation of the term “view” for algorithm or adversary

What is the view of an algorithm/adversary? Is view just a term used to describe the output over a set of inputs for a probabilistic algorithm? For example: Consider experiment Mac-forgeA,Π (n). ...
1answer
277 views

### Security proof. Adversary source of random coins.

Consider the game-based security proofs, i.e. a game played between the challenger and a PPT adversary. My question is... what is the source of random coins for the adversary? Is is valid to say ...
2answers
361 views

### Question about proof of pseudo-random random generators being one way functions

I've been looking over this proposition and proof in the book "Introduction to modern cryptography" and am a little confused. Picture is attached at the bottom). Why is it that we do not multiply the ...
2answers
1k views

### Proof by reduction clarification

If I execute a proof by reduction using a given adversary A as a subroutine to A'. How do I know that using adversary A which can solve a given hard subproblem, is the most efficient subroutine to use ...
1answer
879 views

### Indistinguishable encryptions in the presence of an eavesdropper

I'm trying to understand how the messages $m_0$ and $m_1$ can be distinguished here. I understand the adversary game, so in short: Adv chooses $m_0$ and $m_1$, one them is encrypted and Adv is able to ...
1answer
441 views

### How does Kerckhoffs's principle apply to Adversarial Neural Cryptography?

Martın Abadi and David G. Andersen recently published a paper on arxiv titled: "LEARNING TO PROTECT COMMUNICATIONS WITH ADVERSARIAL NEURAL CRYPTOGRAPHY" (https://arxiv.org/pdf/1610.06918v1.pdf). I ...
1answer
159 views

### Parameterizing adversaries with security parameters

In many cryptographic games, the adversary doesn't seem to be parameterized by the security parameter.‡ Are such games equivalent to variants in which the adversary is parameterized by the security ...
1answer
3k views

### What are the capabilities of passive and active adversaries?

I have trouble understanding what exactly the capabilities of passive and active adversaries are on paper and in the real world.
1answer
146 views

### About the necessity simulators set adversary random-tape

In the ideal/real proof paradigm we sometimes find simulators with the capacity of set adversary random tape. My question: when do we have to consider the necessity of simulators set adversary random-...
1answer
94 views

### What does this advantage statement signify?

In many Attribute Based Encryption papers I see this line... The advantage of an adversary A in this game is defined as Pr[b' = b] − 1/2. Can someone explain what it means to me? I assume it means ...
2answers
93 views

### Why is it allowed to Generate Keys inside the game?

I am studying reductions to prove security of crypto systems. Generally "games" are used for the proofs. For example, the next image was extracted from the page 91 of the book Post-Quantum ...
2answers
147 views

### Correctness of ideal protocol of MPC in presence of malicious adversary

In presence of malicious adversaries in ideal protocol of Multi Party Computation, how can honest parties get the correct output? i.e., corrupted parties modify their inputs and give to the trusted ...