Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security-definition]

Questions about formal definitions of "security" for various cryptographic schemes (e.g. perfect secrecy, semantic security, ciphertext indistinguishability, etc.)

1
vote
0answers
33 views

Indistinguishable encryptions and CPA-secure example

Let $ F $ be a PRF and $ G$ be a PRG with expansion factor $n \to n +1 $ For the following encryption scheme, decide whether it has indistinguishable encryptions and whether it is CPA-secure. ...
1
vote
2answers
58 views

How is n-bit security calculated with nested encryption?

What will the total $n$-bit security be if I encrypt a message with a 128-bit XOR cipher and then take that ciphertext and encrypt it with a 128-bit key. Is the total security level now 256? One ...
0
votes
2answers
67 views

Does encryption using PRP mean indistinguishable encryption against an eavesdropper?

I am a student studying cryptography by reading "Introduction to Modern Cryptography". I have some confusion about encryption using PRP (e.g., AES). Briefly speaking, a keyed deterministic ...
1
vote
1answer
47 views

Difference between eavesdropping and traffic analysis

I was wondering what is the conceptual difference between these two passive attacks on a network. I was reading about them on Wikipedia and they seem quite similar to me. Is there a difference?
0
votes
1answer
40 views

Adaptive vs. Static security model in ABE

From Lewko, I understand the difference between an adaptive and selective model: Adaptive model: the attacker can adaptively query the challenger for private keys. Selective model: the attacker has ...
1
vote
2answers
77 views

identifying Negligible functions

I am having a hard time understanding and applying the formulas that are used to identify a function is negligible or not? One text defines it as; a function $f$ from the natural numbers to the non-...
1
vote
1answer
66 views

Is the simulation-based proof difficult and needed? [closed]

What is the role for simulation-based proof under the semi-honest model without considering malicious adversaries? I agree with that a view of a some party is important to prove that a protocol is ...
3
votes
3answers
235 views

Is it possible to exactly reverse engineer an unknown cipher inside a black box?

Consider the following arrangement:- There is an unknown cipher algorithm operating inside the black box. You can enter infinite key /plain text pairs, and observe all of the outputs. The box might ...
1
vote
0answers
49 views

Key-space analysis of an algorithm

I have an algorithm that requires a set of keys to encrypt a text (image of size N x N). It is an image encryption algorithm for a project. The key can be thought of as a tuple $x_0, \lambda, d, i, ...
3
votes
2answers
196 views

Is the practice of “security through obscurity” violating Kerckhoffs's second principle?

Security through obscurity is the reliance on the secrecy of the design or implementation as the main method of providing security for a system or component of a system. Kerckhoffs's second principle:...
0
votes
1answer
85 views

What does $1^n$ mean? [duplicate]

I often see the notation of powers of 1 in cryptography papers. For example, let $n$ be security parameter, then what does $1^n$ mean?? From high school student perspective, powers of one is always ...
1
vote
0answers
42 views

Mersenne Twister's vulnerabilty with small-size distributions

C++ rookie here, trying to wrap his head around (CS)PRNGs. I (assume that I) already understand the concept of the Mersenne Twister being "broken" (i.e. not cryptographically secure) due to its ...
2
votes
1answer
75 views

How well is it understood mathematically why encryption schemes are hard to crack?

I have read some intro material into cryptography. It mainly goes into the current encryption schemes like AES, but not very deeply into the mathematics of why they are secure. I know that encryption ...
1
vote
0answers
32 views

Proofs of security for anonymity in a multi-party setting

I'm looking for material that proves the anonymity of parties in a non-interactive setting. I would like to know if there are simulation based proofs (UC) and property based proofs (game based) for ...
0
votes
1answer
38 views

Fairness and guaranteed output delivery

Why for achieving the fairness and guaranteed output delivery, less than a half of the parties should be corrupted? ($t < m/2$, where $t$ is the number of corrupted parties and $m$ is the total ...
1
vote
1answer
69 views

Any Arbitrary Function

According to the attached reference, does it mean that the adversary computes $PPT(initial~input)$, $PPT(z)$ and $PPT(f_i(x',y'))$? For example, suppose the corrupted party, in the malicious model, ...
-1
votes
1answer
38 views

Which of these deductions are true about the simulator and the adversary?

Which of these deductions make sense? The simulator is actually being run by the adversary. It makes sense that the adversary initializes the simulator (which is just a program) with the input that ...
0
votes
1answer
41 views

Is function Deterministic or Probabilistic in the malicious security definition?

As you see, according to the attached definitions from "Efficient Secure Two-Party Protocols", the definition of the security in the semi-honest world has two cases for $f=(f_1,f_2)$.(deterministic ...
3
votes
1answer
270 views

Strong One-Way Function

In the book "Foundations of cryptography-Oded Goldreich-Page 33", if we use the deterministic polynomial-time algorithm instead of the probabilistic polynomial-time algorithm for case 2 (Hard to ...
1
vote
1answer
50 views

A problem exists with the security proof in the secure AND example in the malicious model [closed]

Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world ...
3
votes
1answer
65 views

The interaction between the malicious Adversary and the Simulator and Real-Ideal' views

This example is from “Efficient Secure Two-Party Protocols-Carmit Hazay-Yehuda Lindell”. And the security proof of the above example is this: I have drawn a picture that is deduced from the above ...
3
votes
1answer
70 views

Security proof in the Malicious Model

According to the above protocol(Efficient Secure Two-Pary Protocols-Hazay-Lindell-page 27), the authors proved the security of this protocol according to the two paragraphs below: We separately ...
1
vote
1answer
55 views

How to use Real-Ideal model in a specific scenario (two party with cloud)

I have designed a two-party protocol where two parties outsource their input to the cloud. For example, Alice and Bob have inputs $X$ and $Y$, respectively, after which Alice and Bob encrypt their ...
0
votes
1answer
32 views

Using the security definition in the malicious model to prove security in the semi honest model

Can I use the security definition in the malicious model in order to prove the security of a two-party protocol which is in the semi-honest model? (I am using IDEAL/REAL Model paradigm) Would you ...
1
vote
1answer
51 views

difference between the uniform and non-uniform probabilistic polynomial algorithms (ppt)

I am reading the book "Efficient Secure Two-Party Protocol". A question came to my mind. why has the author used a probabilistic polynomial time algorithm for security definition of ideal/real model ...
2
votes
1answer
163 views

Difference between semi-honest and malicious adversary using Ideal Real Model Paradigm

Would you please explain to me why in the security definition of ideal/real model paradigm which is described in the efficient secure two-party protocol book(Hazay, Lindell), the simulator tries to ...
11
votes
3answers
1k views

How small is negligible?

When proving theorems in crypto we often make use of the concept of negligible functions or, more simply, negligible parameters. As a rule of thumb, given today (2018) computational power, what is ...
5
votes
1answer
123 views

“Power of one” as input to functions of a cryptosystem

What does $1^\lambda$ mean when you pass it as a parameter to the functions of a cryptosystem. The cryptosystem in question is this and a picture reference is this. I have been told it signifies the ...
1
vote
0answers
33 views

A qusetion about the security game of Certificateless signatures

Recently I read Certificateless Public Auditing for Data Integrity in the Cloud , I have a question about the security of proposed HOMOMORPHIC AUTHENTICABLE CLS. (Sec. IV). For the Type-I Adversary, ...
1
vote
1answer
69 views

In “Lecture Notes on Cryptography” what does “PTM” mean?

I came across a handbook named "Lecture Notes on Cryptography" from Shafi Goldwasser and Mihir Bellare and I read their definition 3.1 about poly-time indistinguishability: Let $X_n,Y_n$ be ...
0
votes
1answer
56 views

Maximum value of negligible probability?

We can see on many papers for cryptography that there are many uses of negligible probability to ensure something (security, correctness, etc). How can we say that some probability is negligible? I ...
4
votes
2answers
104 views

Is there a computational security of public-key encryption which is similar to the one of symmetric key encryption

We say a symmetric key encryption scheme $\Pi_{1} = (\mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec})$ is computational security if for every PPT algorithm $A$ and every $x_{0}, x_{1}$ ($|x_{0}| = |x_{1}|$), ...
2
votes
2answers
114 views

Can the key-generation algorithm always be uniform?

Assume that the encryption uses $n$-bit keys to encrypt $l(n)$-length messages. If a symmetric key encryption scheme is defined as $\Pi_{1} = ( \mathrm{Enc}, \mathrm{Dec} )$, then for every $x_{0}, ...
3
votes
1answer
152 views

security against CPA attack?

Let $\mathcal{E} = (E,D)$ be a CPA secure cipher. Let's define $\mathcal{E'} = (E', D')$, where $E'(k,m) = E(k, E(k,m))$. How can I prove that $\mathcal{E'}$ will be CPA secure if $\mathcal{E}$ is? ...
1
vote
0answers
77 views

Design flaw in IND-CKA definition of Searchable Symmetric Encryption?

I am a graduate student interested in searchable encryption research. I carefully read the Secure Indexes paper published in 2004, and I was confused about the IND-CKA, the game-based security ...
4
votes
2answers
127 views

What is the relationship between entropy conditioning and final output bias in a TRNG?

This question concerns the conditioning and output of true random number generators. It refers to NIST Special Publication 800-90C, Recommendation for Random Bit Generator (RBG) Constructions. It ...
1
vote
1answer
124 views

Deterministic symmetric indistinguishable encryption

Are there any block-cipher modes (or symmetric encryption schemes in general) that are fully-deterministic, meaning same inputs lead to the same outputs (like for all modes with constant IV) and ...
-1
votes
2answers
134 views

Secure pseudo-random generator

Suppose that $G : \{0,1\}^k \rightarrow \{0,1\}^{2k}$ is a secure pseudo-random generator. Describe what is wrong with each of the following attempts to build a pseudo-random generator with $k$-bit ...
1
vote
1answer
175 views

Hash function composition - security level

When using two hash functions, g(x)=SHA-512 and f(x)=MD5 g(x) has 512 bit output (using salt) f(x) has 128 bit output. Let's say that z(x)=f(g(x)) meaning the output is 128 bit long. The Question: ...
0
votes
0answers
50 views

On computing probability of some cipher text

One presentation shows how one could compute probability of some cipher text occurring: Which I understand. However, also for computing probability that a plain text occurs given a ciphertext occured,...
1
vote
2answers
107 views

What does trust mean in cryptography?

Terms like "trustless protocol", "trusted third party", "trusted platform", "trusted server", etc. require a notion of trust. I already wrote The term trust when used in the context of cryptography ...
4
votes
1answer
97 views

How to determine the security in bits of a scheme?

This may be a stupid question. But how would we determine the security bit of a crypto scheme? For example, SHA2-256 offers 128 bit security due to birthday paradox, so do they measure the security ...
-5
votes
1answer
271 views

Client Puzzles and Amplification [closed]

Any hints or suggestion will be helpful.
1
vote
1answer
43 views

What does St denote?

I am reading a paper and notice that the term St is used without being defined. I suspect it is a common notation that I am not aware of. It is used in the following paper: https://eprint.iacr.org/...
2
votes
1answer
663 views

What exactly is a “security parameter”?

I often encounter the term “security parameter” when I read crypto related stuff. My basic understanding is that it just denotes some bit-length however, I'm not so sure. For example, when it says ...
2
votes
1answer
128 views

Encryption Scheme & Perfect Secrecy [Katz & Lindell]

An encryption scheme consists of the following data a plaintext space $\mathcal M$ a ciphertext space $\mathcal C$ a key space $\mathcal K$ a key generating algorithm Gen encryption and decryption ...
3
votes
2answers
790 views

Does information theoretical security definition imply DDH, RSA, QR does not hold?

Assuming we are in the information theoretical setting, whereby there is no bound on the computational power of an adversary. Does this mean that the standard definitions for DDH, RSA or QR do no hold ...
3
votes
0answers
93 views

How do adversary models and security types relate [from InfoSec SE]

I have been told to move the question to this forum in order to get a better insight, so here we go: Reading some questions in this forum I encountered this answer mentioning IND-CPA as a requirement ...
-4
votes
1answer
285 views

I am not convinced that SHA2/3 or AES256 is secure

I have been researching cryptography for the past few weeks to try and make sense of a few things, but is simply not making any sense for me. If I encrypt a message, send it to another computer, how ...
1
vote
0answers
51 views

RIsk mitigation: block cypher vs xor

It sort of looks like to me that there is a kind of risk mitigation in the architecture of block cyphers vs the xor cypher. In XOR, the risk is entirely in the random number generator. The XOR ...