Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [adversarial-model]

An adversary model formally defines the power of the adversary. It includes specifics whether the adversary is deterministic/randomized, uniform/non-uniform, interactive/non-interactive and how he interacts with the security game.

Filter by
Sorted by
Tagged with
2
votes
1answer
71 views

Attacks on code misusing RSA_public_decrypt

I've encountered some code that I'm reviewing that is misusing RSA_public_decrypt to "authenticate" a variable-length response without using any hash. The code ...
1
vote
1answer
36 views

What does non-collusion assumption mean in server-aided protocol based on secret sharing?

Suppose $m$ clients split their own input into $n$ shares using additive secret sharing scheme (mod something). Then, each of the clients sends each share to each of $n$ external servers. After ...
0
votes
1answer
68 views

AES Threat Model

I've read/skimmed a few documents about the AES family of encryption, but haven't seen anything about what exactly it protects against. There are many ways to "encrypt" things, and not all of them ...
1
vote
1answer
55 views

RSA-FDH Signature Scheme EUF-CMA

I am aware of attacks whereby an attacker is able to forge a message IF the hash of the original message is the same hash as their current message. The question is, is it still possible for RSA-FDH to ...
8
votes
0answers
154 views

How to build a security model

What are the minimal components to build a security model proof for a protocol? This question might seem trivial, but having read many papers-- from the IEEE, ACM, etc., that talk about a KMP-- I ...
-1
votes
1answer
44 views

Ensuring correctness property in multi-party protocols

Can you suggest mechanisms to ensure the correctness of the protocol output, against Active Adversaries in multi-party protocols. Specifically for a dishonest majority setting? I would like to have ...
5
votes
1answer
140 views

Parameterizing adversaries with security parameters

In many cryptographic games, the adversary doesn't seem to be parameterized by the security parameter.‡ Are such games equivalent to variants in which the adversary is parameterized by the security ...
1
vote
1answer
121 views

Is the simulation-based proof difficult and needed? [closed]

What is the role for simulation-based proof under the semi-honest model without considering malicious adversaries? I agree with that a view of a some party is important to prove that a protocol is ...
4
votes
3answers
235 views

Homomorphic & Functional encryption: Mapping unencrypted outputs to encrypted outputs using existing data

Let's assume I have datapiece A which, after being put through a model or neural network, has a known output X in the unencrypted space. When I move datapiece A into an encrypted space, and put it ...
1
vote
1answer
414 views

Comparing stronger vs. weaker assumptions

If I have to argue that an assumption A is stronger than B, should I argue this way:- An adversary breaking the security of A does not translate to breaking the security of B. But, if an adversary ...
4
votes
0answers
136 views

Explanation of the term “view” for algorithm or adversary

What is the view of an algorithm/adversary? Is view just a term used to describe the output over a set of inputs for a probabilistic algorithm? For example: Consider experiment Mac-forgeA,Π (n). ...
0
votes
1answer
65 views

The differences between the attackers in the definitions of IND-ATK and NM-ATK

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in ...
3
votes
0answers
127 views

How do adversary models and security types relate [from InfoSec SE]

I have been told to move the question to this forum in order to get a better insight, so here we go: Reading some questions in this forum I encountered this answer mentioning IND-CPA as a requirement ...
3
votes
1answer
140 views

Idiomatic description for an adversary in possesion of a quantum computer?

I was wondering what the "accepted" way is to describe an adversary who: is in possession of a quantum computer with which they can efficiently run quantum algorithms such as Grover's or Shor's ...
5
votes
5answers
271 views

How to rigorously prove that $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$ is CPA secure assuming $\Pi$ is?

Assume $\Pi$ is a CPA secure scheme. Let $\Pi'$ be a derived scheme, such that the encryption of a message $M$ is as follows: $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$, where $LSB(k)$ is the ...
1
vote
0answers
139 views

How to provide security against malicious adversary in Ring LWE homomorphic encryption scheme?

I was reading Ring LWE homomorphic encryption scheme referred in http://www.wisdom.weizmann.ac.il/~zvikab/localpapers/IdealHom.pdf But this encryption scheme provides security mostly in the semi-...
1
vote
0answers
102 views

Given the block cipher compute max PRF advantage

Hey all I'm having a bit of problem with this question. Not sure how to approach it. Any help will be appreciated :)
2
votes
1answer
298 views

Show G is insecure against adaptive adversaries

Hey crypto SE, i'm having a bit of trouble with this question. Can anyone help me to understand how to go about solving this problem? Any help is appreciated :) Show G is insecure against adaptive ...
2
votes
1answer
108 views

Compute maximum PRF advantage

Hello all, I'm new to crypto, I'm not sure if my thought process is correct ? any assistance will be helpful. How useful is the partial info that A gets from (a), (b), and (c) ; in (c) A can ...
0
votes
1answer
405 views

Build a scheme that is CCA secure but not authenticated

Trying to understand a solution from this paper: Summary: $E'_K=0||E_K(m)$ and $D'_K(0||c)=D_K(c)$ and $D'_K(1||c)=1$ IND-CCA secure (how?) as $1||c$ and $0||c$ are are easily decryptable Not ...
1
vote
2answers
461 views

Proof by reduction clarification

If I execute a proof by reduction using a given adversary A as a subroutine to A'. How do I know that using adversary A which can solve a given hard subproblem, is the most efficient subroutine to use ...
2
votes
1answer
231 views

Security proof. Adversary source of random coins.

Consider the game-based security proofs, i.e. a game played between the challenger and a PPT adversary. My question is... what is the source of random coins for the adversary? Is is valid to say ...
3
votes
2answers
270 views

Question about proof of pseudo-random random generators being one way functions

I've been looking over this proposition and proof in the book "Introduction to modern cryptography" and am a little confused. Picture is attached at the bottom). Why is it that we do not multiply the ...
1
vote
1answer
711 views

Indistinguishable encryptions in the presence of an eavesdropper

I'm trying to understand how the messages $m_0$ and $m_1$ can be distinguished here. I understand the adversary game, so in short: Adv chooses $m_0$ and $m_1$, one them is encrypted and Adv is able to ...
3
votes
1answer
413 views

How does Kerckhoffs's principle apply to Adversarial Neural Cryptography?

Martın Abadi and David G. Andersen recently published a paper on arxiv titled: "LEARNING TO PROTECT COMMUNICATIONS WITH ADVERSARIAL NEURAL CRYPTOGRAPHY" (https://arxiv.org/pdf/1610.06918v1.pdf). I ...
1
vote
1answer
82 views

What does this advantage statement signify?

In many Attribute Based Encryption papers I see this line... The advantage of an adversary A in this game is defined as Pr[b' = b] − 1/2. Can someone explain what it means to me? I assume it means ...
4
votes
1answer
2k views

What is adversary's advantage in cryptography and why we use it?

The definition of adversary's advantage seems a bit odd for me and I am wondering why do we use it to measure the power of an adversary rather than just use the probability of a PPT adversary ...
3
votes
2answers
84 views

Why is it allowed to Generate Keys inside the game?

I am studying reductions to prove security of crypto systems. Generally "games" are used for the proofs. For example, the next image was extracted from the page 91 of the book Post-Quantum ...
3
votes
1answer
2k views

Passive adversary and active adversary capability?

I am a newbie of this topic. I have trouble understanding what exactly are the capabilities of passive adversary/active adversary in real world and ideal world.
3
votes
1answer
107 views

About the necessity simulators set adversary random-tape

In the ideal/real proof paradigm we sometimes find simulators with the capacity of set adversary random tape. My question: when do we have to consider the necessity of simulators set adversary random-...
10
votes
1answer
1k views

Relation between attack and attack model for signatures

I would like to know: What is the relationship between an attack and an attack model. For example, let $\Pi$ be the Lamport signature scheme. This signature has its security based on any one-way ...
3
votes
2answers
130 views

Correctness of ideal protocol of MPC in presence of malicious adversary

In presence of malicious adversaries in ideal protocol of Multi Party Computation, how can honest parties get the correct output? i.e., corrupted parties modify their inputs and give to the trusted ...
2
votes
2answers
217 views

Are covert and rational adversaries same?

Aumann and Lindell defined covert adversaries in 2009 which is informally adversaries which have a epsilon-deterrence to cheat. Some authors (for ex. John R. Wallrabenstein) have defined similar ...
1
vote
2answers
302 views

what is PFS game?

when i reading about this paper, in the Setup of SIM section 5.2, it says that "According to the definition of PFS game", i wonder what the definition of PFS game ...
1
vote
2answers
105 views

Times of nested algorithms in proofs of security

Proofs of security may be constructed such that an adversary $A$ is used to construct an adversary $A'$. The reduction/algorithm which uses $A$ has to perform a number of computations in order to ...
2
votes
1answer
138 views

MAC security and adversaries with memory

The usual definition of MAC security is (roughly) that there is no "efficient" adversary that has non-negligible advantage in the "MAC game" where the MAC game is as follows: the challenger chooses a ...
8
votes
4answers
810 views

Automated security protocol verification tool for eCK model

I want a tool that (runs on Win7 and) can perform automated verification of a protocol in the eCK security model as described in Microsoft Research's paper "Stronger Security of Authenticated Key ...
2
votes
1answer
874 views

Definition of cryptographic advantage vs. probability of success

In game-based security definitions, like for example the one defining IND-CPA security, a given cryptosystem is said to be secure if any probabilistic polynomial time adversary has only a negligible ...
1
vote
1answer
283 views

What kind of adversary is a compromised party?

Imagine multiple parties executing a secure multiparty computation protocol to evaluate a function securely. Let Alice be one of the parties who is intended to get all the partial results and combine ...