Questions tagged [adversarial-model]
An adversary model formally defines the power of the adversary. It includes specifics whether the adversary is deterministic/randomized, uniform/non-uniform, interactive/non-interactive and how he interacts with the security game.
71
questions
11
votes
1
answer
2k
views
Relation between attack and attack model for signatures
What is the relationship between an attack and an attack model?
For example, let $\Pi$ be the Lamport signature scheme. This signature has its security based on any one-way function. The Grover ...
- 2,621
11
votes
0
answers
222
views
How to build a security model
What are the minimal components to build a security model proof for a protocol?
This question might seem trivial, but having read many papers-- from the IEEE, ACM, etc., that talk about a KMP-- I ...
- 371
9
votes
1
answer
2k
views
What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?
I don't have a proper computer science education, so bear with my misunderstandings.
UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
- 302
8
votes
4
answers
897
views
Automated security protocol verification tool for eCK model
I want a tool that (runs on Win7 and) can perform automated verification of a protocol in the eCK security model as described in Microsoft Research's paper "Stronger Security of Authenticated Key ...
- 1,262
6
votes
1
answer
4k
views
What are the capabilities of passive and active adversaries?
I have trouble understanding what exactly the capabilities of passive and active adversaries are on paper and in the real world.
- 73
6
votes
1
answer
291
views
Difference between Generic Group Models
I'm trying to understand the difference between the (classical) Generic Group Model as it is described by Shoup [Shoup] and the somewhat restricted Generic Group Model as it is described by Schnorr ...
- 369
5
votes
5
answers
414
views
How to rigorously prove that $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$ is CPA secure assuming $\Pi$ is?
Assume $\Pi$ is a CPA secure scheme. Let $\Pi'$ be a derived scheme, such
that the encryption of a message $M$ is as follows:
$Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$, where
$LSB(k)$ is the ...
- 257
5
votes
1
answer
184
views
Parameterizing adversaries with security parameters
In many cryptographic games, the adversary doesn't seem to be parameterized by the security parameter.‡ Are such games equivalent to variants in which the adversary is parameterized by the security ...
- 357
5
votes
0
answers
183
views
Explanation of the term "view" for algorithm or adversary
What is the view of an algorithm/adversary? Is view just a term used to describe the output over a set of inputs for a probabilistic algorithm?
For example:
Consider experiment Mac-forgeA,Π (n). ...
4
votes
1
answer
3k
views
What is adversary's advantage in cryptography and why we use it?
The definition of adversary's advantage seems a bit odd for me and I am wondering why do we use it to measure the power of an adversary rather than just use the probability of a PPT adversary ...
- 437
4
votes
1
answer
3k
views
Comparing stronger vs. weaker assumptions
If I have to argue that an assumption A is stronger than B, should I argue this way:-
An adversary breaking the security of A does not translate to breaking the security of B. But, if an adversary ...
- 177
4
votes
1
answer
66
views
Secret sharing such that all shareholders obtain access to the secret (one shareholder can't just run off with the shares)
Say, using something like Shamir's polynomial scheme, you split a secret $x$ among $n$ people (each given a "share" of the secret) such that you need all $n$ shares to recover the secret.
...
- 335
4
votes
3
answers
393
views
Homomorphic & Functional encryption: Mapping unencrypted outputs to encrypted outputs using existing data
Let's assume I have datapiece A which, after being put through a model or neural network, has a known output X in the unencrypted space. When I move datapiece A into an encrypted space, and put it ...
- 143
3
votes
2
answers
347
views
Things already known to adversary before planning an attack
This is a very basic and practical question. Since I started reading cryptography recently, these things keep bugging me.
What are the things that an adversary is usually aware of before planning an ...
- 65
3
votes
1
answer
182
views
Is there any examples of information-theoretic secure MPC for dishonest majority against malicious adversary?
My research is to propose highly secure MPC protocol with some conditions.
Especially, I want to consider that
security against malicious (active) adversary
dishonest majority setting
information-...
- 33
3
votes
1
answer
174
views
Idiomatic description for an adversary in possesion of a quantum computer?
I was wondering what the "accepted" way is to describe an adversary who:
is in possession of a quantum computer with which they can efficiently run quantum algorithms such as Grover's or Shor's ...
- 187
3
votes
1
answer
442
views
Show G is insecure against adaptive adversaries
Hey crypto SE, i'm having a bit of trouble with this question. Can anyone help me to understand how to go about solving this problem? Any help is appreciated :)
Show G is insecure against adaptive ...
- 51
3
votes
1
answer
171
views
About the necessity simulators set adversary random-tape
In the ideal/real proof paradigm we sometimes find simulators with the capacity of set adversary random tape.
My question: when do we have to consider the necessity of simulators set adversary random-...
- 508
3
votes
2
answers
176
views
Correctness of ideal protocol of MPC in presence of malicious adversary
In presence of malicious adversaries in ideal protocol of Multi Party Computation, how can honest parties get the correct output?
i.e., corrupted parties modify their inputs and give to the trusted ...
- 859
3
votes
1
answer
468
views
How does Kerckhoffs's principle apply to Adversarial Neural Cryptography?
Martın Abadi and David G. Andersen recently published a paper on arxiv titled: "LEARNING TO PROTECT COMMUNICATIONS WITH ADVERSARIAL NEURAL CRYPTOGRAPHY" (https://arxiv.org/pdf/1610.06918v1.pdf).
I ...
3
votes
2
answers
288
views
What is the advantage of adversary if the random number repeats?
In proof of CPA-security of encryption scheme $(r, F_k(r)\oplus m )$
where:
$F_k$ is a keyed function
$r\in_R\{0,1\}^n$ is a random number,
on page 85 of Introduction to modern cryptography we have
...
- 151
3
votes
1
answer
106
views
Are semi-honest adversaries specific for MPC?
I know that in multiparty computation we may consider semi-honest or malicious adversaries.
I can find papers that consider malicious adversaries, but the semi-honest term is only mentioned in MPC ...
- 31
3
votes
1
answer
179
views
Differential Privacy: What is the 'game' between data holder and adversary?
I have been reading the Differential Privacy (DP) literature for some time to get familiar with it. I feel comfortable with the Math and Stats foundations of it, but I am suffering a bit from the '...
3
votes
2
answers
450
views
Question about proof of pseudo-random random generators being one way functions
I've been looking over this proposition and proof in the book "Introduction to modern cryptography" and am a little confused. Picture is attached at the bottom).
Why is it that we do not multiply the ...
- 225
3
votes
2
answers
96
views
Why is it allowed to Generate Keys inside the game?
I am studying reductions to prove security of crypto systems. Generally "games" are used for the proofs. For example, the next image was extracted from the page 91 of the book Post-Quantum ...
- 2,621
3
votes
1
answer
183
views
What does the bounded storage model mean?
In the bounded storage model, it assumes the storage of the adversary is bounded or limited, and thus it is possible that we can achieve a kind of cryptography without relying on hardness assumption. ...
- 777
3
votes
0
answers
155
views
How do adversary models and security types relate [from InfoSec SE]
I have been told to move the question to this forum in order to get a better insight, so here we go:
Reading some questions in this forum I encountered this answer mentioning IND-CPA as a requirement ...
- 63
2
votes
2
answers
294
views
Are covert and rational adversaries same?
Aumann and Lindell defined covert adversaries in 2009 which is informally adversaries which have a epsilon-deterrence to cheat. Some authors (for ex. John R. Wallrabenstein) have defined similar ...
- 123
2
votes
1
answer
344
views
Security proof. Adversary source of random coins.
Consider the game-based security proofs, i.e. a game played between the challenger and a PPT adversary.
My question is... what is the source of random coins for the adversary?
Is is valid to say ...
2
votes
2
answers
342
views
Is there any good attack model of HMAC?
Are there any good attack models of HMAC? Like how it can be attacked? If there are any possible attacks of HMAC I would be happy to know about it.
- 21
2
votes
1
answer
1k
views
Definition of cryptographic advantage vs. probability of success
In game-based security definitions, like for example the one defining IND-CPA security, a given cryptosystem is said to be secure if any probabilistic polynomial time adversary has only a negligible ...
- 1,306
2
votes
1
answer
125
views
Breaking CDH also breaks DHI
I am trying to show that by breaking the Computational Diffie-Hellmann (CDH) assumption one also breaks the Diffie-Hellmann inverse assumption. Unfortunately, I am a bit stuck and do not know where to ...
- 159
2
votes
1
answer
218
views
MAC security and adversaries with memory
The usual definition of MAC security is (roughly) that there is no "efficient" adversary that has non-negligible advantage in the "MAC game" where the MAC game is as follows: the challenger chooses a ...
- 317
2
votes
1
answer
313
views
Attacks on code misusing RSA_public_decrypt
I've encountered some code that I'm reviewing that is misusing RSA_public_decrypt to "authenticate" a variable-length response without using any hash. The code ...
- 427
2
votes
1
answer
52
views
Confirming understanding of security protocol modelled in Scyther
In university, I'm currently learning how to use Scyther to model security protocols. Currently I am trying to understand what is happening in an example protocol given to me which is:
...
- 77
2
votes
1
answer
210
views
Extended Canetti-Krawczyk - Clean Session Definition
In the extended Canetti-Krawczyk (eCK) model [1] the adversary $\mathcal{M}$ is allowed to make a sequence of queries, eventually performs a $Test(sid)$ query, receives a value $C$ and at some point ...
- 45
2
votes
1
answer
225
views
Compute maximum PRF advantage
Hello all, I'm new to crypto, I'm not sure if my thought process is correct ? any assistance will be helpful.
How useful is the partial info that A gets from (a), (b), and (c) ; in (c) A can ...
- 21
2
votes
0
answers
87
views
Automated Security Protocol tool that models algebraic operations
Are there any automated security protocol verification tools that model algebraic operations; specifically addition.
I am familiar with AVISPA and Verifpal, and they are both great and user-friendly ...
- 157
1
vote
1
answer
281
views
Adversary model for malicious but selfish adversaries?
Covert adversaries have the property that they may deviate arbitrarily from the protocol specification in an attempt to cheat, but do not wish to be caught doing so.
Does this model includes also the ...
- 67
1
vote
2
answers
116
views
Times of nested algorithms in proofs of security
Proofs of security may be constructed such that an adversary $A$ is used to construct an adversary $A'$.
The reduction/algorithm which uses $A$ has to perform a number of computations in order to ...
- 2,797
1
vote
1
answer
145
views
Superscript vs subscript notation in cryptographic formulation
I'm currently reading this paper [PDF]. On page 4, I bumped into these notations :
\begin{equation}
\text { Experiment } \operatorname{Exp}_{\mathcal{F} \mathcal{E}, A}^{\text {ind-mode }}(k) \text { :...
- 826
1
vote
2
answers
94
views
How can an adversary request decryption of an unused sector?
The Wikipedia article on Disk Encryption Theory mentions this
a powerful adversary can modify an unused sector on the disk and then request its decryption.
I understand that an adversary is ...
user80567
1
vote
2
answers
3k
views
Proof by reduction clarification
If I execute a proof by reduction using a given adversary A as a subroutine to A'. How do I know that using adversary A which can solve a given hard subproblem, is the most efficient subroutine to use ...
1
vote
1
answer
1k
views
Indistinguishable encryptions in the presence of an eavesdropper
I'm trying to understand how the messages $m_0$ and $m_1$ can be distinguished here. I understand the adversary game, so in short: Adv chooses $m_0$ and $m_1$, one them is encrypted and Adv is able to ...
- 507
1
vote
1
answer
308
views
What kind of adversary is a compromised party?
Imagine multiple parties executing a secure multiparty computation protocol to evaluate a function securely. Let Alice be one of the parties who is intended to get all the partial results and combine ...
- 6,084
1
vote
2
answers
448
views
RSA-FDH Signature Scheme EUF-CMA
I am aware of attacks whereby an attacker is able to forge a message IF the hash of the original message is the same hash as their current message. The question is, is it still possible for RSA-FDH to ...
1
vote
1
answer
245
views
Is the simulation-based proof difficult and needed? [closed]
What is the role for simulation-based proof under the semi-honest model without considering malicious adversaries?
I agree with that a view of a some party is important to prove that a protocol is ...
- 1,515
1
vote
1
answer
103
views
What does this advantage statement signify?
In many Attribute Based Encryption papers I see this line...
The advantage of an adversary A in this game is defined as Pr[b' = b] − 1/2.
Can someone explain what it means to me?
I assume it means ...
- 83
1
vote
1
answer
124
views
RSA public key identification
Consider a multi party system where public keys of all receivers are known. Server wants to send message to one of them using (textbook?) RSA. Adversary is given ciphertext and even Message to be send,...
- 49
1
vote
1
answer
344
views
What does non-collusion assumption mean in server-aided protocol based on secret sharing?
Suppose $m$ clients split their own input into $n$ shares using additive secret sharing scheme (mod something).
Then, each of the clients sends each share to each of $n$ external servers.
After ...
- 1,515