Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [provable-security]

A primitive or protocol with provable security is accompanied by a mathematical proof that shows how to reduce the security claims about the protocol to a set of assumptions.

Filter by
Sorted by
Tagged with
0 votes
0 answers
74 views

DSA Randomness attack on signatures [closed]

I am working on a CTF where i am given the exponent = p-1/q * input that is going to be used to calculate r. What value can i use for "input" in order to cause randomness attack so that i ...
endi__edi's user avatar
0 votes
0 answers
39 views

Can the ability to sign arbitrary messages expose the private key?

Consider a system that consists of a black box (some abstraction layer with perfect sandboxing). The black box contains a private key that cannot be extracted by request, but the black box exposes an ...
The Quantum Physicist's user avatar
1 vote
0 answers
29 views

Is there any possible way to make each party obtain the output in a MPC protocol?

I konw a fact that it is impossible to achieve complete fairness in 2-party protocol from Cleve's paper.But i wonder if it is possible to achieve fairness in multi-party setting when the number of ...
Rui T.'s user avatar
  • 31
2 votes
0 answers
59 views

Inequalities in collision search on the separation between the classical and quantum random oracle (ROM vs QROM)

I'm trying to read the separation between the classical and quantum random oracle through a paper "Random Oracles in a Quantum World" by Dan Boneh, Ozgur Dagdelen, Marc Fischlin, Anja ...
Dai Chi DO's user avatar
0 votes
2 answers
75 views

About IND-CPA security of Homomorphic Encryption

I am trying to understand IND-CPA security in (Partially) Homomorphic Encryption schemes. However, the result of the proofs is usually something stating that a ciphertext does not expose anything ...
Daniel Morales's user avatar
0 votes
1 answer
43 views

How to compute $r \cdot (a+b+c)$ for random $r$ and secret value$a,b,c$ in MPC?

Suppose Alcie,Bob,and Charlie each has a secret value $a,b,c$ respectively. they want to compute a value $r\cdot (a+b+c)$ together. $r$ is a random value, and all parties know nothing about it. I ...
Rui T.'s user avatar
  • 31
5 votes
2 answers
658 views

What is the meaning of asymptotic security proofs in practice?

In Katz & Lindell's Introduction to modern cryptography (3d edition) we have the following statements in chapter 3: A scheme is secure if for every probabilistic polynomial-time adversary $A$ ...
Mr. B's user avatar
  • 129
0 votes
0 answers
40 views

Proving Insecure Hash Function Through Not Collision Resistant

There is a function H : {0, 1}* → {0, 1}^n. On input a message m and two shares of it x, w such that m = x ⊕ w, the function outputs y = H(m) = H(x) ⊕ H(w). How would I find that this NOT a collision ...
sangaCat's user avatar
0 votes
0 answers
19 views

Understanding the Simplified Perspective in OCB Security Proof: Exploring the Role of Collisions and Oracle Models

In the security proof of OCB (Offset Codebook Mode), it appears that only collisions at the input and output of the block cipher are considered. Typically, security proofs for cryptographic modes ...
NogaCS's user avatar
  • 1
0 votes
1 answer
215 views

Prove RSA scheme is insecure [closed]

Im reviewing my crypto and I would like to prove the following: RSA experiment where the adversary is given N, e, and y. The adversary knows p, q. I know the RSA scheme is built on the idea that it is ...
Ahmed Zaidan's user avatar
3 votes
1 answer
231 views

Is Goldreich's proof with polynomial number of hybrid arguments wrong?

Oded Goldreich in his book [Foundations of Cryptography, 2004, Section 3.2.3] proves a theorem by polynomial number of hybrids. In rather recent years, Marc Fischlin and Arno Mittelbach published a ...
user1035648's user avatar
3 votes
2 answers
168 views

Quantum attack on CTR

I'm reading the article named "Characterizing the qIND-qCPA (in)security of the CBC, CFB, OFB and CTR modes of operation". An attack on CTR mode is presented in the article. The proof of thm ...
Georgy Firsov's user avatar
0 votes
0 answers
33 views

Implementing Secret Sharing Among Multiple Parties

I'm working on a scenario where a safe has a lock code '42', and this code needs to be shared securely among four individuals. The goal is to set up a system where at least two out of these four ...
Iman Mohammadi's user avatar
1 vote
0 answers
33 views

Bounding the commitment min-entropy of NTRU version of BLISS

I've read [DDLL13] paper and want to understand how the lemma 3.4 is changed for NTRU version of BLISS. In the naive construction of BLISS, the commitment entropy is bounded in Lemma 3.4 as below: $$ \...
dkzlfk12's user avatar
0 votes
0 answers
78 views

Distinguishing between two DDH-like tuples

Given a group generator $g$ (in a group where DDH is hard). Let $X_1=g^{x_1}$ and $X_2=g^{x_2}$ be two public elements, where $x_1$ and $x_2$ are selected randomly and kept secret. Consider a game ...
Doron's user avatar
  • 99
0 votes
0 answers
72 views

Reduction for distinguishing to elements

Given a composite number $n=pq$ of primes $p$ and $q$, a secret random element $r$, and two public random elements $x_1$ and $x_2$. An adversary is given two elements, $y_1= x_1^r \mod n$ and $y_2=x_2^...
Doron's user avatar
  • 99
0 votes
0 answers
52 views

Is using a CPA secure public key encryption twice on two halves of the message with different keys secure?

If $\Pi=(\mathrm{Gen},\mathrm{Enc},\mathrm{Dec})$ is a CPA secure public key encryption protocol, is the following public key encryption CPA secure? $\Pi'$: $\mathrm{Gen'}$: Run $\mathrm{Gen}$ twice ...
Kagura Hitoha's user avatar
3 votes
1 answer
353 views

Is the secret key kept constant in IND-CPA game?

I read the Wikipedia Page on ciphertext indistinguishability. Here it gives the following outline of the IND-CPA game: The challenger generates a key pair PK, SK based on some security parameter k (e....
Riemann's user avatar
  • 221
0 votes
0 answers
29 views

Nature of differentially private Laplace mechanisms

In the Wikipedia page on differential privacy, the section on $\varepsilon$-differential privacy for the Laplace mechanism says that the Laplace mechanism is specified for some output as $\mathcal{T}_{...
Ekene E.'s user avatar
  • 101
1 vote
1 answer
121 views

Unbounded distinguishers and statistical indistinguishability

In constructing a SHVZK simulator for a sigma protocol I am working on I have encountered some fairly basic questions, but ones which are not often discussed in textbooks and papers - consider the two ...
Lev's user avatar
  • 443
3 votes
3 answers
322 views

How big of a threat are *diffusion model* based AIs to cryptographic systems?

The diffusion model, which is used by products like Midjourney and Dall-E, trains AI systems to de-noise (remove added randomness) from data to infer what the original de-noised data is. That would ...
aiootp's user avatar
  • 803
1 vote
1 answer
56 views

Existence of PRGs satisfying the following weaker definition

Consider the following definition. Let $p(n) > n$ be a polynomial, and $G_n: \{0, 1\}^n \rightarrow \{0, 1\}^{p(n)}$ a PRG. Moreover, given $x \leftarrow \{0, 1\}^n$, we say $S$ is a length $n-1$ ...
user918212's user avatar
1 vote
1 answer
141 views

Proving an identification-scheme based on a digital signature is secure

I am trying to prove to myself that an identification scheme derived from a digital signature in a challenge/response manner is secure, based on the security of the digital signature scheme. I've ...
puppet puppet's user avatar
2 votes
0 answers
52 views

self-decryption paradox in identity based encryption

In the paper Dual system encryption: realizing fully secure IBE and HIBE under simple assumption (free PDF), the authors said "there is an apparent paradox in this strategy since it seems that ...
Alex Ideal's user avatar
1 vote
0 answers
34 views

Does blockcipher decryption always offer equivalent security as blockcipher encryption? [duplicate]

I'm not sure if anyone explored this area before. Blockcipher encryption definitely fullfills IND-CCA, but what about its inverse? Is there a proof that shows blockcipher decryption is as secure as ...
DannyNiu's user avatar
  • 9,361
4 votes
1 answer
131 views

confusion about the meaning of reduction

I'm learning provable security, and I'm a bit confused with the concept of reduction. So, here's my understanding: to prove a protocol/scheme/generic construction is at some level of security, there ...
Daisy Ding's user avatar
1 vote
1 answer
72 views

Does game-theoretical fairness work in when the goal of one party is randomness

When we take the coin flip in Blum's algorithm in "Coin flipping by telephone a protocol for solving impossible problems", where Alice and Bob both want ownership over the same car, then one ...
Mangudai's user avatar
2 votes
1 answer
163 views

Provably secure cryptography in blockchains

Do you know a blockchain that does not use at all cryptographic primitives standardized by USA or other countries? It is strange to me that the security of many cryptocurrencies is based on ciphers, ...
Dimitri Koshelev's user avatar
2 votes
1 answer
106 views

Is a Pedersen commitment still secure when r is either 0 or 1?

Specifically if we know the $r$ takes values from the set $\{0,1\}$and $c=g^r*h^m$ does the hiding property still hold? I think I already managed to prove that the binding property holds due to the ...
GeorgeT's user avatar
  • 23
2 votes
1 answer
99 views

Security of RLWE encryptions of secret keys

Under which conditions is it secure to publish an encryption of the secret key $s$ under itself in terms of an $RLWE_s(s)$ ciphertext? Because for some schemes this is (repeatedly) used in ...
opag's user avatar
  • 63
2 votes
1 answer
80 views

Replacing the Hash function with messages in the BLS signature scheme, the security degenerates from EUF to SUF?

​I have been thinking about this question: if I directly replace the hash function with the message in the BLS signature, does the security of the BLS degenerate from existential unforgeability(EUF) ...
X.H. Yue's user avatar
  • 370
1 vote
1 answer
88 views

Is it appropriate to prohibit an adversary from querying a specific input in an algorithm in some situation?

There are two algorithms in my framework, $E_1(\cdot)$ and $E_2(\cdot)$. In particular, executing $E_1(\cdot)$ on a specific input $x$ (i.e., $E_1(x)$) is equivalent to executing $E_2(y)$ for some ...
Zi-Yuan Liu's user avatar
2 votes
1 answer
73 views

Reduction from Distinguisher to Indishtinguishability

Content and Informal Problem Suppose a protocol $\pi$ doing an arbitrary task between two users A and B. I only know that $\pi$ relies on a IND-CPA symmetric encryption scheme $\mathcal{E} = $(KeyGen, ...
gamarcad's user avatar
0 votes
0 answers
50 views

Security assumption: Where is an assumption from (who provides and formalizes it)?

Is there a list of all the (most) assumptions (such as RSA and DDH assumptions) used in cryptography and the corresponding properties?
Jeffrey's user avatar
  • 127
7 votes
1 answer
225 views

Are rejected Dilithium commitments secret?

On 6 March, Yi Lee sent over the NIST mailing list an announcement of their submitted paper that found a flaw in the original security proof for Dilithium. In their manuscript, they fix the proof on ...
dusk's user avatar
  • 1,175
2 votes
0 answers
37 views

Stand-alone simulation proof: Ideal functions and leakage collection

Are ideal functions and leakage collections the terms of UC security? Why I often see them in a simulation-based proof under stand-alone model? Some papers use the definition in Lindell's How to ...
Jeffrey's user avatar
  • 127
1 vote
1 answer
47 views

Simulation based proofs: how many simulators should be constructed?

In simulation based proof of cryptographic scheme, if k parties are invovled in the scheme, then k simulators should be ...
Jeffrey's user avatar
  • 127
2 votes
1 answer
183 views

Expanding stand-alone simulation-based proofs to UC proofs

This is a follow-up question to Mikero’s answer to Simulation-based proofs and universal composability proofs. Let there be some protocol $\pi$ running between two parties $A$ and $B$. Furthermore, ...
Simulator's user avatar
1 vote
2 answers
201 views

Showing that CPA encryption schemes cannot preserve the length of a message

I am self studying "A Graduate Course in Applied Cryptography" by Boneh-Shoup. I am stuck on the following problem. Let $\mathcal{E}$ be be an encryption scheme where messages and ...
cryptolearner's user avatar
0 votes
1 answer
223 views

How many bits of encryption are enforced in WEP (wired equivalent protocol)

I'm currently taking a computer security module in University and as part of a problem have been asked: My thought for the question is that no it does not provide 64 bits of security strength. This ...
hasin's user avatar
  • 77
0 votes
1 answer
185 views

Proof for secure stream cipher implies secure PRG

I am self studying "A Graduate Course in Applied Cryptography" by Boneh-Shoup. I am not sure if my proof for the following problem in the book is correct. The problem asks to prove that if a ...
cryptolearner's user avatar
3 votes
0 answers
118 views

Semantic Security equivalent to Real/Random Semantic Security

I'm reading Boneh and Shoup's book "A Graduate Course in Applied Cryptography." Im doing one of the questions at the end of the stream ciphers chapter. I'm not sure how to do this problem: ...
cryptolearner's user avatar
2 votes
3 answers
282 views

Is exposing hash of private key provably secure?

Let's say we have an IND-CPA secure public key encryption scheme $\Pi = (\text{Gen}, \text{Enc}, \text{Dec})$. Construct a new PKE $\Pi' = (\text{Gen}', \text{Enc}', \text{Dec}')$ that behaves exactly ...
puppet puppet's user avatar
0 votes
1 answer
3k views

Is 7-Zip Encryption really secure? [duplicate]

Is 7-Zip really a good encryption tool? I wonder what kind of encryption is used in 7-zip. I see most people using 7-Zip. Just curious about what extent it is safe.
Bhargav - Retarded Skills's user avatar
2 votes
0 answers
105 views

Automated Security Protocol tool that models algebraic operations

Are there any automated security protocol verification tools that model algebraic operations; specifically addition. I am familiar with AVISPA and Verifpal, and they are both great and user-friendly ...
Mona's user avatar
  • 197
4 votes
1 answer
162 views

Random oracles and the Borel-Cantelli Lemma

I am trying to understand the implication of the Borel-Cantelli Lemma to the random oracle model. I think understanding a special case, say, a random oracle is one-way with probability 1, would be ...
user50394's user avatar
  • 295
2 votes
0 answers
112 views

Composability of state-separable proofs

Brzusk et al. introduced the state-separation proof technique to tame complexity in game-based security proofs. The framework allows for modular, easy to understand, and reusable proofs. It has been ...
Marc Ilunga's user avatar
  • 3,278
2 votes
1 answer
102 views

Alternative definition of security for MAC

In the usual definition of security for message authentication codes, we let an adversary $A$ have access to an oracle for $Mac_k(.)$. However, if we consider that there exists a more powerful type of ...
Caio Nogueira's user avatar
1 vote
1 answer
97 views

Reduction from Real-Or-Random to Left-Or-Right

I am reading the paper A Concrete Security Treatment of Symmetric Encryption and am confused by the reduction from ROR to LOR on page 11. Specifically, when it says: When $\mathcal{O}_2(\cdot)=\...
ax12345's user avatar
  • 13
4 votes
0 answers
283 views

XOR of a secure PRF is modified weakly secure PRF

While reading A Graduate Course in Applied Cryptography by Dan Boneh and Victor Shoup. There was the next exercise (Ex. 4.2 (b)), let $F$ be a secure PRF over $(K,X,Y)$ where $Y := \{0,1\}^n$ and $|X|$...
seanL's user avatar
  • 66

1
2 3 4 5
14