Questions tagged [provable-security]

A primitive or protocol with provable security is accompanied by a mathematical proof that shows how to reduce the security claims about the protocol to a set of assumptions.

Filter by
Sorted by
Tagged with
-1
votes
1answer
65 views

Does the following protocol of secure a matrix satisfy one-time-pad?

Problem Definition: Alice wants to send a matrix $MR_A$ which encrypts its original private matrix $M_A$ ($M\times N$ size, all elements in $M_A$ is in {0,1,2,3,4,5}) to Bob without letting Bob knows ...
0
votes
1answer
51 views

On the Acceptability of a Naive Pseudo Random Number Generator

My question is probably both philosophical and technical. Background I was developing a CSPRNG, and I needed to shuffle the bits in one step in the middle of the algorithm - any naive shuffle would ...
0
votes
1answer
56 views

May an adversary be fooled by a random-looking input that in reality is fixed?

I want to prove the EUF-CMA-security of a signature scheme. It is a variation on an established scheme, therefore I would ideally like to reduce the new-scheme-security to the old-scheme-security. the ...
2
votes
0answers
38 views

Secure Protocol

How to show there is no secure protocol to compute OR? I need to know the mathematical proof of this statement. I am understanding this statement using the matrix representation of $f(x,y)$ but unable ...
0
votes
0answers
9 views

Why is Dolev Yao a local Inference System but blind signatures aren't?

I am currently working on this tutorial: https://www.infsec.cs.uni-saarland.de/wp-content/uploads/sites/2/2017/04/CK-fntpl-14.pdf However, I am struggling with the term "local inference system&...
2
votes
0answers
33 views

How are security proofs performed for Certificateless PEKS schemes?

I have been studying several CLPEKS (CertificateLess Public-key Encryption scheme with Keyword Search) schemes and I understand the security assumptions and the several types of security models used ...
0
votes
0answers
60 views

Semantic Security in Formal Security Proofs

I have a trivial question, and I hope someone can help me. I am reading several papers on formal security proofs based on the indistinguishably game. Specifically, the adversary is challenged in an ...
2
votes
1answer
62 views

Difficulty to find the pre-images of a pair of hash result such that given $a,b$, $H(x_1)=aH(x_2)+b$?

Suppose given fix values $a,b$, how difficult to find a pair of sha256 pre-images $x_1,x_2$ such that $H(x_2)=aH(x_1)+b$? How difficult to find 4 hash pre-images $x_1,x_2,x_3,x_4$ such that $\dfrac{H(...
3
votes
0answers
54 views

Multi-users RSA problem

Rivest and Kalisky's RSA problem considers various notions on security of the RSA One-Way Trapdoor Permutation. They do it only from the perspective of a single user. What's the state of the art in ...
5
votes
1answer
129 views

“Reduced to” vs “deduced from”

Assume it's proven: "Security of protocol $\Pi$ can be deduced from hardness of problem $P$". Is it correct to state: "Security of protocol $\Pi$ can be reduced to (hardness of) problem $P$" ? My ...
1
vote
1answer
33 views

Assumption of difficulty of attack in restricted short time

As well known, different assumptions of difficulty of some problems are used in provable security. E.g., if some crypto-scheme is breakable only in case the attacker finds preimages for hash function, ...
3
votes
0answers
71 views

Are there only two ways to prove a cryptographic protocol is secure?

If I want to prove my protocol is secure, can I just use a game based approach and/or a simulator approach? Or are there other common approaches?
1
vote
0answers
39 views

What is the underlying hard problem in the reduction of game-based proofs?

I am confused by how game-based proofs fit in the provable security paradigm. I understand reductions in the style of proving secrecy of RSA reducing it to integer factorization. However, when proving ...
2
votes
0answers
30 views

Balanced Feistel networks: Are there any lower bounds on the computational complexity of breaking a $k$-round Feistel cipher?

This paper by Patarin presents an attack (section 9) on balanced Feistel networks with $k$ rounds, where the input is a bit-string is of length $2n$. (Since it is balanced, this means each PRF takes ...
0
votes
1answer
58 views

MAC security game

In the applied cryptography book by Boneh and Shoup, Chapter 6 on MACs, it is stated that one can modify SUF-CMA game by removing verify oracle access to the adversary. Therefore, the two versions are ...
4
votes
0answers
98 views

The security of blind RSA signatures with modular exponentiation as padding

It is known that (blind) RSA signature implementations should apply some sort of padding to messages before signing or blinding them. Does blind RSA signature with modular exponentiation as a padding ...
1
vote
2answers
356 views

Using RSA encryption to encrypt large files

The following post discusses the use of RSA for file encryption: https://medium.com/@ismailakkila/black-hat-python-encrypt-and-decrypt-with-rsa-cryptography-bd6df84d65bc The file encrypted is a JPEG ...
3
votes
1answer
59 views

Time cost of security reduction

The following theorem is the description of one-more unforgeability in the paper lattice based blind signatures. I want to ask if the time $t^{'}$ is an exponential time since the $q_{H}$ and $q_{...
1
vote
0answers
34 views

Abstract Cryptography: why local simulators?

In the paper that introduced Abstract Crypto [MauRen11], the Theorem 2 page 15 states that, basically, if there exists some local simulators that can be pluged on a resource $S$ such that this new ...
0
votes
2answers
57 views

LOR implies unpredictability?

It should be true that classical LOR(Left or Right)-indistinguishability of some mode of operation implies unpredictability. However I've got stuck with the proof of this fact. LOR-...
0
votes
0answers
21 views

Related-key impossible differential search on SIMECK via MILP?

What should be the objective function , constraints and bounds for the model for Related-key impossible differential search on simeck cipher using mixed integer linear programming (MILP)?
3
votes
1answer
102 views

Proof by reduction definition in “Serious Cryptography”: Cipher reduced to hardness problem or other way around?

In Serious Cryptography by Jean-Philippe Aumasson on p. 46, paragraph "Provable Security", it says: Provable security is about proving that breaking your crypto scheme is at least as hard as ...
1
vote
0answers
38 views

Proofs that NM-CPA implies IND-Cpa and $\text{IND-CCA} \leftrightarrow \text{NM-CCA}$

I am looking for a proof for the following two claims from "Serious Cryptography" by Aumasson. NM-CPA implies IND-CPA. [...] IND-CCA and NM-CCA are equivalent notions that imply the presence of the ...
3
votes
0answers
64 views

Provably secure way of expanding permutations

Gimli is a 384-bit permutation that makes use of an internal 96-bit permutation which works on columns. Every 4 rounds starting from the 1st a "small swap" is performed and every 4 rounds ...
1
vote
0answers
36 views

Regarding security of blind signature schemes

I'm new to blind signatures, trying to understand security notions of it: blindness and one-more unforgeability. I found out that in the security game for blindness property, the adversary $\mathcal{...
0
votes
0answers
41 views

Understanding a security proof

I am reading the paper "RingCT 3.0 for Blockchain Confidential Transaction: Shorter Size and Stronger Security" (https://eprint.iacr.org/2019/508.pdf), an improvement to Ring Confidential Transactions....
2
votes
0answers
50 views

Why does the random oracle receive much more criticism than the ideal cipher?

The random oracle model seems to be criticized a lot as lacking practical relevance, making wrong predictions, being programmable, etc. However, I have never heard such criticism about the ideal ...
2
votes
1answer
98 views

Is the EdDSA signature scheme provable security?

The EdDSA signature scheme is a deterministic scheme. So could it be proven provable security in Random oracle model?
1
vote
0answers
86 views

Game-based proofs and semantic security

After reading this question, I understood that "game-based" and "simulation-based" have to do with the way that security properties are postulated. In particular, IND-CPA is a canonical example of ...
1
vote
0answers
106 views

Are there any hash functions that are commutative yet secure for ordered lists?

I'm looking for a hashing function that can combine random numbers together in any order yet still find the same value. But it needs to be secure against hackers. The idea is if I'm hashing together: ...
0
votes
0answers
32 views

Simulation-based proof in a particular scenario

Suppose we have a two-party protocol in the semi-honest model, which is based on an additive homomorphic cryptosystem like Paillier.(P2 will generate the public and private key and publish the public ...
1
vote
0answers
31 views

Simulation-based proof in the semi-honest model when a party is corrupted

Full paper Would you mind telling me based on the attached file, why in case 3(corrupted client B), the authors did not use the real input which is $S_B$ and instead they have generated $S'_B$? In ...
20
votes
3answers
10k views

Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers

Given that much of our ECC crypto primitives provide “only” 128-bit security when defined over a 256-bit curve due to pollard-rho, is it then still safe in 2020 to consider 128-bit security safe for ...
2
votes
0answers
48 views

Need help in proving of disproving security of generic partially-blind-signature construction

I have a project where I need to use a linear partially blind signature scheme. I looked at Abe-Okamoto, but I can't easily make it linear. So I looked at Okamoto-Schnorr blind signatures (here and ...
0
votes
0answers
24 views

How to intuitively realize the Diverse Group System in the Hash Proof System(HPS)?

In the paper Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption by Cramer & Shoup, projective hash family derived from group system can be easily ...
2
votes
1answer
67 views

Help understanding syntax used in security proof

I am looking through this paper and am trying to understand the proofs better. One of the theorems the authors are proving (Theorem 5.1) contains syntax of Adv followed by "cdh" in the superscript and ...
4
votes
0answers
118 views

Security properties of ElGamal encryption variants

I'll use Taher ElGamal's A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms (July 1985 in IEEE Transactions on Information Theory, formerly in proceedings of Crypto 1984) as ...
6
votes
2answers
135 views

Is non-adaptive CPA strictly weaker than standard CPA security?

Today during a cryptography lecture an interesting question came up: Whether non-adaptive CPA security is equivalent to adaptive (FtG / LOR) CPA security. Now for a short description of what this ...
2
votes
0answers
36 views

decrypting a one-time-pad that outputs 0,1 in preknown probabilities

assuming a two users want to use a one time pad ciphersystem, and they are using a program that was developed by a third party that was supposed to create random undependable bits, but for some reason ...
28
votes
2answers
3k views

What are standard cryptographic assumptions?

I am struggling to understand what is meant by "standard cryptographic assumption". The Wikipedia artice on the Goldwasser–Micali system (GM) reads "GM has the distinction of being the first ...
2
votes
1answer
112 views

Does an information-theoretically secure hash function exist?

Does an information theoretically secure hash function exist? (By exist I mean is discovered/invented and implemented, not whether it could exist.)
1
vote
0answers
22 views

Computationally indistinguishably vs Perfect Indistinguishably [duplicate]

I know that perfect security means absolutely no information about the plaintext is leaked to the adversary while computational secrecy is okay with a tiny amount of leak. But, what is the difference ...
1
vote
0answers
31 views

Again on discrete gaussians over lattices [duplicate]

Define $$\rho_{s,c}(x) = exp(-\pi \cdot \frac{\|x - c\|^2}{s^2})$$ and $$\rho_{s,c}(L) = \sum_{x \in L} \rho_{s,c}(x)$$ Then Discrete Gaussian over $L$ with center $c$ and standard deviation $s$ is ...
2
votes
1answer
99 views

The security level of double encryption

Let PKE $\Pi' = (Gen', Enc', Dec')$ and it is secure in the sense of $S'$. Let PKE $\Pi'' = (Gen'', Enc'', Dec'')$ and it is secure in the sense of $S''$. $S'$ and $S''$ may be separation which means ...
6
votes
2answers
546 views

Statistical closeness implies computational indistinguishability

This is so trivial that authors usually don't bother to give an explicit proof. But for me there is some vagueness. We say that two ensembles $X_n$ and $Y_n$ are statistically close, if $$ \Delta(n) ...
2
votes
0answers
86 views

Security of MAC-Then-Encrypt without MAC key authentication

We have the following settings in our system: TLS 1.2 using legacy cipher suite - OFB mode (using 64 bit block cipher) and trunkated CBC-MAC (32 bit). The goal is to achieve authenticated encryption ...
-1
votes
1answer
146 views

1/(2^n)! is negligible function?

By definition $\frac {1} {n}$, $\frac{1}{2^n}$ and $\frac{1}{n!}$ are negligible functions. I have got the function $$f(n) = \frac{1}{(2^n)!}$$ where $n$ is security parameter. I don't understand, ...
0
votes
1answer
252 views

How does the challenger choose the message randomly in the one-wayness security game of PKE?

I have read some papers that give the definition of one-wayness of PKE schemes. Let $\Pi = (G,E,D)$ be a PKE scheme, and the security game of OW-CPA is defined as follow: $$\mathrm{Adv}_{\Pi,\...
1
vote
1answer
45 views

How does the security parameter within a digital locker help prove that it unlocked correctly?

I refer to Canetti et all, "Reusable Fuzzy Extractors for Low-Entropy Distributions", available here. Paraphrasing the relevant part from §3:- The locking algorithm $lock(key,val)$ outputs ...
3
votes
0answers
44 views

Are there any more ways to validate a security proof except peer review?

Are there any ways better than peer review to validate a security proof? Are there any ways to make your security proof easier to validate; using a simulator based proof instead of a game based proof? ...

1
2 3 4 5
10