# Questions tagged [security-definition]

Questions about formal definitions of "security" for various cryptographic schemes (e.g. perfect secrecy, semantic security, ciphertext indistinguishability, etc.)

195 questions
Filter by
Sorted by
Tagged with
21 views

28 views

### Differences in definitions of “Computational Special Soundness”

I am looking at Unruh's transform (ePrint 2014/587) and in particular the definition in §2.2 for computational special soundness in sigma protocols. Let $\cal{R} \subset \cal{X} \times \cal{Y}$ be ...
200 views

### What does perfect mean within perfect forward secrecy and why do some cryptographers disagree with the term?

In this blog post, Matthew Green says Forward secrecy (usually misnamed “perfect forward secrecy”)... The Wikipedia article on forward secrecy (which the same sentence links to in the blog) says ...
93 views

### ROLLO : security bits parameters

In ROLLO -Rank-Ouroboros, LAKE & LOCKER p.20, it says that "Notice that for 128 security bits parameters, the practical security is rather higher than 128 at about 170 bits." How Can I ...
109 views

### What is the difference between security parameter and $b$-bit security?

In a previous question, I read ... for $b$-bit security meaning $O(2^b)$ work for an attacker to break the system... While in Katz's Introduction to modern Cryptography, I read: The key-generation ...
2k views

### Meaning of “Security can be reduced to a problem”

I'm studying reductions in cryptography and confused about the way people use the word "reduction". My question is almost the same as a past question, but what I want to ask is slightly different. A ...
195 views

### RSA and the strong RSA assumptions

The RSA assumption: Given a randomly generated RSA modulus $n$, exponent $r$ and a random $z \in \mathbb{Z}_n^{*}$, find $y$ such that $y^r=z$. The strong RSA assumption: Given a randomly chosen ...
18 views

### Does multiple substitutions increase security? [duplicate]

Yes, because the attacker must decrypt the cypher text twice No, because it is equivalent to a single substitution Maybe, depending on the complexity of each substitution
66 views

### MAC security game

In the applied cryptography book by Boneh and Shoup, Chapter 6 on MACs, it is stated that one can modify SUF-CMA game by removing verify oracle access to the adversary. Therefore, the two versions are ...
212 views

### Seed/key algorithm security

Currently I'm working on implementing a seed/key algorithm to limit access to a tool for authorized users. My understanding of the algorithm is that its strength is derived from the seed itself. ...
42 views

### Understanding a security proof

I am reading the paper "RingCT 3.0 for Blockchain Confidential Transaction: Shorter Size and Stronger Security" (https://eprint.iacr.org/2019/508.pdf), an improvement to Ring Confidential Transactions....
62 views

### Importance of Backward and forward secrecy

Which security feature is more important in security protocols being used in different applications? Forward Secrecy or Backward Secrecy
54 views

### Research topics related to cryptography and Hamiltonian cycles

I am very interested in pursuing a research where I can show an application of Hamiltonian cycles in Cayley graphs of some group such as reflection groups to the field of cryptography. But currently ...
97 views

### Game-based proofs and semantic security

After reading this question, I understood that "game-based" and "simulation-based" have to do with the way that security properties are postulated. In particular, IND-CPA is a canonical example of ...
185 views

### Is a PRG concatenation using the same input still a PRG?

Suppose we have a secure PRG $G: \{0,1\}^s→ \{0,1\}^n$ and we define a $G'(k)$ as: $$G'(k) = G(k) \| G(k)$$ So if $G(k)=\mathbf{i}$, $G'(k) = \mathbf{i} \| \mathbf{i}$ Is $G'$ still a secure PRG? ...
45 views

### Forward Security of Symmetric Encryption Schemes with LFSR based PRNG

Forward security can be achieved using symmetric encryption schemes by combining with a pseudo-random number generator (PRNG). Does LFSR based PRNG provide forward security in this case?
1k views

### Existential unforgeability vs strong unforgeability

In the article https://crypto.stanford.edu/~dabo/pubs/papers/strongsigs.pdf there are two definitions for the security of a digital signature scheme: existential unforgeability and strong ...
51 views

### Every encryption scheme that is perfectly secret it holds that for every distribution over the message space $M$, every $m, m' ∈ M$, and every $c ∈ C$

Prove or refute: For every encryption scheme that is perfectly secret it holds that for every distribution over the message space $M$, every $m, m'∈ M$, and every $c ∈ C$: Pr[M = m | C = c] = Pr[M = ...
39 views

### Is this simple proposed scheme semantically secure?

Suppose we have two parties, including $P_1$ and $P_2$ using a type of symmetric encryption algorithm, say, AES256. Let's assume the shared key is: $K$. Encryption: Each party generate a key such ...
37 views

### decrypting a one-time-pad that outputs 0,1 in preknown probabilities

assuming a two users want to use a one time pad ciphersystem, and they are using a program that was developed by a third party that was supposed to create random undependable bits, but for some reason ...