Questions tagged [provable-security]

A primitive or protocol with provable security is accompanied by a mathematical proof that shows how to reduce the security claims about the protocol to a set of assumptions.

Filter by
Sorted by
Tagged with
1
vote
0answers
9 views

Is it possible to convert a selective secure broadcast encryption scheme to an adaptive secure broadcast encryption scheme?

I was reading the paper, entitled "Multiparty Key Exchange, Efficient Traitor Tracing, and More from Indistinguishability Obfuscation", by Boneh et al. On page 23, the authors have claimed ...
2
votes
1answer
174 views

Practical implications of the switching lemma and the counter mode security bound

I have some trouble with determining how many times a key can be safely used when using counter mode encryption. If we, for example, split the IV into two parts, a message counter (nonce) and a block ...
-1
votes
0answers
26 views

Any video course on provable security

Can someone recommend any complete video course on provable security which gives a more intuitive explanation rather than pure mathematical? I found many books, e.g., Joy of Cryptography but the ...
0
votes
1answer
34 views

May it be possible that the trusted third party knows the parties' private keys in an “ideal model” of a Secure multiparty computation protocol?

May it be possible that the trusted third party knows the parties' private keys in an “ideal model” of a Secure multiparty computation protocol? I wonder if it may be possible that a trusted third ...
0
votes
1answer
33 views

Is it meaningful to allow parties to use a non-uniform random tape in 2-party computation?

Consider a trivial example where two semi-honest parties want to flip a biased coin. Since the sender is semi-honest, the sender can locally flip a biased coin and send it to the receiver. A natural ...
1
vote
5answers
262 views

Is it theoretically possible to create an unbreakable cipher?

I know this question might sound strange, but is it theoretically possible to create an unbreakable cipher if we don't consider bruteforce? Some of us believe that it is possible to create ciphers and ...
12
votes
2answers
3k views

Why don't we use Blowfish if it hasn't been cracked?

Since Blowfish is old, well-audited, and has no published attacks, why are we using AES instead? I know that Bruce Schneier said that Blowfish is insecure and told people to transition to Twofish, but ...
0
votes
0answers
48 views

Cascading encryption with blocks or output

For educational purposes, I'm trying to build a cascading encryption implementation with AES, Twofish, Blowfish, Salsa20, and ChaCha20. First of all, please don't judge my paranoia or choices, this is ...
4
votes
1answer
127 views

Proof by reduction definition in “Serious Cryptography”: Cipher reduced to hardness problem or other way around?

In Serious Cryptography by Jean-Philippe Aumasson on p. 46, paragraph "Provable Security", it says: Provable security is about proving that breaking your crypto scheme is at least as hard as ...
2
votes
1answer
51 views

Not understanding deterministic authenticated encryption (DAE) security definition

I have a question regarding the security definition of deterministic authenticated encryption (DAE) as defined by Bellare and Shrimpton. Their definition is reproduced below, and my question pertains ...
2
votes
2answers
104 views

Sensitivity of probability measure in differential privacy

I know that we need some sort of sensitivity(global, local) to calculate noise that needs to be added for differential privacy. The noise is the maximum difference between two neighboring datasets. ...
0
votes
1answer
75 views

Unconditionally secure block cipher for a finite number of blocks

I am wondering if someone can point me toward a block cipher that provides unconditional security for only a bounded number of encryptions. For example, you can encrypt $h > 1$ length $n>1$ ...
-2
votes
2answers
191 views

Is this a provably secure scheme to encrypt a private key?

I got this idea to use the features of the one-time pad, an encryption technique that provably cannot be cracked, but this time applied to encrypt a private key. A possible application could be to ...
0
votes
1answer
43 views

How to formally prove that random guess is the best attack

How to formally argue that there exists no efficient $A$ who can come up with a $e$ such that $$\begin{align}x&=PRF(e,0) \land \\ y &= PRF(e,1) \land \\ x &= H(y)\end{align}$$ where $H$ is ...
1
vote
0answers
50 views

Solving RLWE modulo a prime ideal

Suppose you have the following set up for RLWE: $K$ is a cyclotomic field of degree $n$ over $\mathbb{Q}$, and $p\in\mathbb{Z}$ is a prime integer that splits as follows in $R = \mathcal{O}_K$: $p\...
1
vote
1answer
53 views

Using Optimal Prime Field in ECC

"Optimal Prime Field is a family of 'low-weight' prime fields that allow for efficient software implementation of all operations requiring a modular reduction, in particular the field-...
1
vote
2answers
91 views

Recovery Passphrase Collission for BIP-39 and BIP-44

Referring to the standards of [BIP-39] and [BIP-44]: a 'master password' consisting of 12 words uniformly selected from a 2048-word dictionary corresponds to 128 bits of entropy, that is then used as ...
4
votes
1answer
312 views

Formal Verification of DHKE protocol using ProVerif

I am new to ProVerif and trying to verify a simple DHKE protocol. The attacker is assumed as passive. The specifications are: The attacker cannot obtains the mutual key. Both participants obtain the ...
1
vote
2answers
1k views

Variant of the Decisional Bilinear Diffie Hellman problem

I am working on a cryptographic scheme and I need to rely on the following problem, which I have nicknamed the "Hybrid Decisional Bilinear Diffie Hellman (hDBDH)" problem: Let $e: \mathbb G_1 \...
1
vote
2answers
226 views

Which of those functions are PRFs?

Assume that $F: \{0,1 \}^n \rightarrow \{0,1 \}^n$ is PRF. Examine if the following functions are PRFs: $$ \begin{align} 1. \, F_1(k,x) &= F(k,x) \oplus x \\ 2. \, F_2(k,x) &= F\left(F(k,0^n), ...
1
vote
0answers
18 views

Technological based solution needed for a real world problem of transferring a physical object between two untrusted parties [closed]

Suppose I have a physical object A. Another person also has some rights over the object A. After some litigations, a schedule has been made under which object A will be passed for some time to the ...
1
vote
1answer
74 views

Security proof, Sequence of games

I hope someone can help me with the sequence of games security proof for protocols. Here are my questions: What is the aim of each individual game? i.e. why can't we do this in one indistinguishable ...
5
votes
2answers
230 views

Can a PRF distiguisher invoke the function's algorithm?

The definition of a function $F:\ \{0,1\}^n\times\{0,1\}^n\to\{0,1\}^n$ being a Pseudo Random Function Family (PRF) is that it's implementable by a P.P.T. algorithm $\mathcal F$, and there is no P.P.T....
0
votes
0answers
31 views

Is ORAM security definition adaptive?

Based on the "obliviousness" definition of the access pattern of the ORAM: Given the RAM, after a sequence of read/write operations, the physical addresses accessed will be computationally ...
0
votes
0answers
21 views

Extractability of random oracle in simulation-based proof

I am working on the simulation-based proof, where Random Oracle (RO) is used to extract malicious parties' input. In particular, the RO considered in the proof has a small range (whose size is ...
0
votes
0answers
37 views

Security Proof, Sequence of games and birthday paradox

The sequence of games security proof approach is very confusing. For example, I am trying to understand it in the following paper https://www.dropbox.com/s/dhsgsognxviwacv/Provably%20Secure%...
3
votes
0answers
46 views

Boneh DDH Paper - Sampling Integers in Random Reduction

I've been reading Dan Boneh's DDH paper, in particular section 3.1 which covers DDH randomized reduction. The first two sentences of theorem 3.1 state: Let $\Bbb G = \{G_p\}$ be a family of finite ...
18
votes
2answers
3k views

Simulation-based proofs and universal composability proofs

I recently read Ran Canetti's famous UC paper but I'm still trying to wrap my head around the concepts. I think this answer has me confused a bit, particularly where it says The stand-alone ...
0
votes
0answers
31 views

What is a quantifier in game-based definitions?

I'd like to know what are quantifiers in game-based security definitions (in cryptography) Some relevant examples and sources are also much appreciated. Edit: for example, in a formal definition, we ...
0
votes
1answer
102 views

Is the following non-interactive zero-knowledge set membership protocol provable secure?

Given the following Zero-knowledge set-membership protocol https://infoscience.epfl.ch/record/128718/files/CCS08.pdf]. That is given in the following steps (Please refer to page 9). The Verifier -...
0
votes
0answers
23 views

A combination of game-based and simulation definitions to analyse a protocol security

Consider the case we want to design a crypto protocol: $P_1$, say for verifiable computation. We define the protocol by designing a game and prove its security. Consider that we want to design another ...
1
vote
1answer
29 views

Can we determine a security parameter in the hybrid argument where the number of hybrids is polynomially bounded but not known?

Let $\lambda$ be a statistical security parameter. Consider a security proof that is based on hybrid argument, where there are polynomially many (say, $n = p(\lambda)$) hybrids, $H_1, ..., H_n$. Any ...
1
vote
2answers
113 views

Proving security of $\Pi' = E_k(E_k(m))$ knowing $\Pi = E_k(m)$ is secure

I recently started studying cryptography but I am not sure I quite understand the concept of proof by reduction. Question I am trying to solve is as follow: Suppose $\Pi$ is a symmetric encryption ...
1
vote
1answer
77 views

Security of block cipher PRP(k⊕m)⊕k

Let $\mathcal S=\{0,1\}^n$ be the set of bitstrinsg of $n$ bits (for security parameter $n$). Let $P$ be a public Pseudo-Random Permutation of $\mathcal S$, efficiently computable in both directions. ...
0
votes
0answers
36 views

Security analysis of encrypting a matrix after homomorphic encryption by the random mask

Problem Definition Alice has two private matrices $M_A$ ($N*M$), $M_a$, where $M_a$ is the binary matrix of $M_A$ Bob has a private matrix $M_B$($N*M$) Alice and Bob are semi-honest server and ...
3
votes
0answers
51 views

trust-less blind execution environment (thought experiment)

I apologize for the theoretical nature of this question, but It has cost me a lot of sleep over the past months. Querying my immediate peers has so far failed to produce results. I assume this ...
1
vote
1answer
31 views

Guessing the Secret in RLWE Search-to-Decision

In On Ideal Lattices and Learning with Errors over Rings, the authors prove a search-to-decision reduction by guessing the RLWE secret $s$, and using the guess to transform a sample from $\mathfrak{q}...
0
votes
0answers
16 views

Integrated Signatures and Encryption Scheme

Suppose we have a scheme ISE that combines $n$ signature schemes and one encryption scheme, where the same keys are used. It is composed of the following algorithms: Setup, KeyGen, $Sign_1,...,Sign_n, ...
-2
votes
1answer
115 views

Does the following protocol of secure a matrix satisfy one-time-pad?

Problem Definition: Alice wants to send a matrix $MR_A$ which encrypts its original private matrix $M_A$ ($M\times N$ size, all elements in $M_A$ is in {0,1,2,3,4,5}) to Bob without letting Bob knows ...
0
votes
0answers
7 views

Unable to understand coin variable used in hash(H2)function querie

I have some hash function queries representations, which I find it hard to understand. I have searched a lot but didn't found anything helpful. Please help me understand the hash(H2) function query I ...
0
votes
0answers
39 views

Short one-time pad security

I am somewhat new to Cryptography and I'm struggling with this proof I came across in my Intro to Cryptography course. I understand the proof of security for a one-time pad: Pr[M = m | C = c] = Pr[M = ...
0
votes
1answer
60 views

On the Acceptability of a Naive Pseudo Random Number Generator

My question is probably both philosophical and technical. Background I was developing a CSPRNG, and I needed to shuffle the bits in one step in the middle of the algorithm - any naive shuffle would ...
0
votes
1answer
68 views

May an adversary be fooled by a random-looking input that in reality is fixed?

I want to prove the EUF-CMA-security of a signature scheme. It is a variation on an established scheme, therefore I would ideally like to reduce the new-scheme-security to the old-scheme-security. the ...
2
votes
0answers
53 views

Secure Protocol

How to show there is no secure protocol to compute OR? I need to know the mathematical proof of this statement. I am understanding this statement using the matrix representation of $f(x,y)$ but unable ...
1
vote
1answer
525 views

Indistinguishability attack example

I want solve the next exercise. The author defined the experiment for the cryptosystem $\Pi$, the adversary $A$ and the security parameter $n$ as follows $\mathsf{PRIV_{EAV}}(\Pi,A,n)$ The adversary ...
0
votes
0answers
13 views

Why is Dolev Yao a local Inference System but blind signatures aren't?

I am currently working on this tutorial: https://www.infsec.cs.uni-saarland.de/wp-content/uploads/sites/2/2017/04/CK-fntpl-14.pdf However, I am struggling with the term "local inference system&...
2
votes
0answers
33 views

How are security proofs performed for Certificateless PEKS schemes?

I have been studying several CLPEKS (CertificateLess Public-key Encryption scheme with Keyword Search) schemes and I understand the security assumptions and the several types of security models used ...
5
votes
0answers
311 views

ring-LWE: Minkowski Embedding , the Co-Different Ideal, etc

While (trying) to go over the reductions from approx. SVP on ideal lattices to search ring-LWE, [1] and [2], for $K = \mathbb{Q}(\zeta)$ where $\zeta$ is an abstract root of a cyclotomic polynomial, ...
0
votes
0answers
73 views

Semantic Security in Formal Security Proofs

I have a trivial question, and I hope someone can help me. I am reading several papers on formal security proofs based on the indistinguishably game. Specifically, the adversary is challenged in an ...
3
votes
0answers
67 views

Provably secure way of expanding permutations

Gimli is a 384-bit permutation that makes use of an internal 96-bit permutation which works on columns. Every 4 rounds starting from the 1st a "small swap" is performed and every 4 rounds ...

1
2 3 4 5
11