Questions tagged [security-definition]

Questions about formal definitions of "security" for various cryptographic schemes (e.g. perfect secrecy, semantic security, ciphertext indistinguishability, etc.)

Filter by
Sorted by
Tagged with
3
votes
0answers
26 views

Differences in definitions of “Computational Special Soundness”

I am looking at Unruh's transform (ePrint 2014/587) and in particular the definition in §2.2 for computational special soundness in sigma protocols. Let $\cal{R} \subset \cal{X} \times \cal{Y}$ be ...
5
votes
4answers
184 views

What does perfect mean within perfect forward secrecy and why do some cryptographers disagree with the term?

In this blog post, Matthew Green says Forward secrecy (usually misnamed “perfect forward secrecy”)... The Wikipedia article on forward secrecy (which the same sentence links to in the blog) says ...
0
votes
0answers
71 views

ROLLO : security bits parameters

In ROLLO -Rank-Ouroboros, LAKE & LOCKER p.20, it says that "Notice that for 128 security bits parameters, the practical security is rather higher than 128 at about 170 bits." How Can I ...
3
votes
2answers
105 views

What is the difference between security parameter and $b$-bit security?

In a previous question, I read ... for $b$-bit security meaning $O(2^b)$ work for an attacker to break the system... While in Katz's Introduction to modern Cryptography, I read: The key-generation ...
11
votes
1answer
2k views

Meaning of “Security can be reduced to a problem”

I'm studying reductions in cryptography and confused about the way people use the word "reduction". My question is almost the same as a past question, but what I want to ask is slightly different. A ...
2
votes
1answer
178 views

RSA and the strong RSA assumptions

The RSA assumption: Given a randomly generated RSA modulus $n$, exponent $r$ and a random $z \in \mathbb{Z}_n^{*}$, find $y$ such that $y^r=z$. The strong RSA assumption: Given a randomly chosen ...
0
votes
0answers
17 views

Does multiple substitutions increase security? [duplicate]

Yes, because the attacker must decrypt the cypher text twice No, because it is equivalent to a single substitution Maybe, depending on the complexity of each substitution
0
votes
1answer
57 views

MAC security game

In the applied cryptography book by Boneh and Shoup, Chapter 6 on MACs, it is stated that one can modify SUF-CMA game by removing verify oracle access to the adversary. Therefore, the two versions are ...
1
vote
1answer
103 views

Seed/key algorithm security

Currently I'm working on implementing a seed/key algorithm to limit access to a tool for authorized users. My understanding of the algorithm is that its strength is derived from the seed itself. ...
0
votes
0answers
39 views

Understanding a security proof

I am reading the paper "RingCT 3.0 for Blockchain Confidential Transaction: Shorter Size and Stronger Security" (https://eprint.iacr.org/2019/508.pdf), an improvement to Ring Confidential Transactions....
0
votes
0answers
50 views

Importance of Backward and forward secrecy

Which security feature is more important in security protocols being used in different applications? Forward Secrecy or Backward Secrecy
0
votes
1answer
51 views

Research topics related to cryptography and Hamiltonian cycles

I am very interested in pursuing a research where I can show an application of Hamiltonian cycles in Cayley graphs of some group such as reflection groups to the field of cryptography. But currently ...
1
vote
0answers
82 views

Game-based proofs and semantic security

After reading this question, I understood that "game-based" and "simulation-based" have to do with the way that security properties are postulated. In particular, IND-CPA is a canonical example of ...
0
votes
3answers
111 views

Is a PRG concatenation using the same input still a PRG?

Suppose we have a secure PRG $G: \{0,1\}^s→ \{0,1\}^n$ and we define a $G'(k)$ as: $$ G'(k) = G(k) \| G(k) $$ So if $G(k)=\mathbf{i}$, $G'(k) = \mathbf{i} \| \mathbf{i}$ Is $G'$ still a secure PRG? ...
1
vote
1answer
44 views

Forward Security of Symmetric Encryption Schemes with LFSR based PRNG

Forward security can be achieved using symmetric encryption schemes by combining with a pseudo-random number generator (PRNG). Does LFSR based PRNG provide forward security in this case?
8
votes
1answer
1k views

Existential unforgeability vs strong unforgeability

In the article https://crypto.stanford.edu/~dabo/pubs/papers/strongsigs.pdf there are two definitions for the security of a digital signature scheme: existential unforgeability and strong ...
0
votes
0answers
46 views

Every encryption scheme that is perfectly secret it holds that for every distribution over the message space $M$, every $m, m' ∈ M$, and every $c ∈ C$

Prove or refute: For every encryption scheme that is perfectly secret it holds that for every distribution over the message space $M$, every $m, m'∈ M$, and every $c ∈ C$: $$Pr[M = m | C = c] = Pr[M = ...
0
votes
0answers
39 views

Is this simple proposed scheme semantically secure?

Suppose we have two parties, including $P_1$ and $P_2$ using a type of symmetric encryption algorithm, say, AES256. Let's assume the shared key is: $K$. Encryption: Each party generate a key such ...
2
votes
0answers
36 views

decrypting a one-time-pad that outputs 0,1 in preknown probabilities

assuming a two users want to use a one time pad ciphersystem, and they are using a program that was developed by a third party that was supposed to create random undependable bits, but for some reason ...
1
vote
1answer
110 views

Does an information-theoretically secure hash function exist?

Does an information theoretically secure hash function exist? (By exist I mean is discovered/invented and implemented, not whether it could exist.)
2
votes
2answers
84 views

Collision resistant functions - definition

Let $f$ be a collision resistant function i.e. it is computationally impossible to find $x_0, x_1$ such that $f(x_0) = f(x_1)$. If a computationally bounded adversary demonstrates that he knows some $...
0
votes
0answers
57 views

DLP instances for given number of congruences

Let $S$ be the set of $k$ congruences of the type $g_{i}^{x_i} \equiv h_i \pmod{n_i}, \quad \forall i,1\leq i \leq k$ What would be the best way to describe such set $S$ with a term in literature. ...
0
votes
0answers
69 views

1-out-of-2 Oblivious Transfer Security

Just started reading Oblivious Transfer. I am searching for a proof of security based on RSA implementation but I can't find anything simple to understand. Can someone direct/show me to an easy to ...
0
votes
1answer
127 views

Security of this PRF [closed]

Given $F$ a secure PRF with input size $\lambda$. Define $F'$ as $F'(k,x||x') = F(k, 0||x)\oplus F(k, 1||x')$ with $x$ and $x'$ of $\lambda-1$ bits. Is $F'$ a secure PRF?
1
vote
1answer
43 views

Looking for a formula for “Given $x_1$, $\ldots$, $x_{n-1}$, the output $F(x_1,\ldots,x_n)$ is dependent of $x_n$ and is of $l$-bits security”

Suppose I have a function $F(x_1,\ldots,x_n)$, where each $x_i$ is of $l$-bits security (suppose each $x_i$ is a binary string of length $l$). At the same time, suppose there are $n$ persons, each one ...
1
vote
0answers
36 views

Precise Definition of 1-out-of-2 Oblivious Transfer

What's the precise definition for 1-out-of-2 OT? and what's the best way to show that it can't be achieved under unconditionally secure setting? I am reading about it and just couldn't get my head ...
1
vote
0answers
131 views

Reduction to security of proof system for proving knowledge

I want to prove security of my system by reduction to the security of an underlying non-interactive proof system for proving knowledge. I know a game that captures the desired security property of my ...
1
vote
2answers
125 views

What is the Knowledge Of Secret Key Assumption (KOSK)

From what I've read it seems to be where an entity must prove that they own the secret key. Which is done by signing a message M using said secret key. Is this ...
1
vote
0answers
54 views

How does the offline authentication work?

In these slides, offline and online PUF-based authentication protocols are explained in minute 16:30 and 17:30, respectively. I understand the way the online protocol works. Basically, the server ...
4
votes
2answers
197 views

What is the security concept in printer cartridge?

Based on this datasheet or this patent, one of the usage of PUF is printer cartridge identification and authentication. I was wondering why printer cartridge needs identification and authentication. ...
2
votes
0answers
42 views

Can ideal functionalities share variables

I am trying to define an ideal world for a protocol that requires two functionalities to interact with each other. Lets call them $\mathcal{F}_1$ and $\mathcal{F}_2$. Now $\mathcal{F}_1$ maintains a ...
0
votes
0answers
117 views

Formal security-definition reference

Is there a reference where all common formal security-definitions are summarized (such as OW-CPA, IND-CPA, IND-CCA1, IND-CCA2, EUF-CMA and so on)? I need a PUBLISHED reference (paper, book) which ...
5
votes
2answers
702 views

What is the difference between information-theoretic and perfect types of security?

I'm having a hard time pinning down an exact definition of the difference between information-theoretic and perfect types of security. A rigorous definition seems elusive... A. Wikipedia puts the ...
2
votes
2answers
919 views

Why the definition in $\epsilon$-differential privacy is multiplicative rather than additive?

According to its mathematical definition, a random algorithm $M: D\rightarrow R$ satisfies $\epsilon$-differential privacy if the adjacent datasets $x, y \in D$ where $D$ is a whole dataset and ...
3
votes
1answer
194 views

Comparison of security definitions for signatures

The two main security definitions for signatures are EUF-CMA and the strong version of it sEUF-CMA. What I see that their difference is that in EUF-CMA experiment, the adversary needs to produce a ...
1
vote
1answer
160 views

Codes of “SAS und Chiffrierdienst”

The german site "SAS und Chiffrierdienst der DDR" http://scz.bplaced.net has some interesting content under point 11.3 in the category "manuelle Verfahren" I found ciphers named from A to D. But I ...
2
votes
1answer
241 views

Formal definition of collision resistance for hash function

In my cryptography class, the professor said that collision resistance for a fixed hash function is not a "precise" definition. The reason is since a fixed hash function is a single instance of a ...
1
vote
1answer
74 views

Why is the security level defined by $\log _{2} \inf \{ t_{i}/\varepsilon_{i} \mid i \in I \}$

In public-key cryptography, the security level indicates the strength of an adversary in breaking a scheme or solving a problem, which can be seen as the time cost of breaking a scheme or solving a ...
1
vote
1answer
106 views

What is the security model of the FHE system introduced in Fully Homomorphic Encryption Using Ideal Lattices?

How would one construct a security model to play against the adversary, and define the security of the overall scheme? This is in reference to the scheme introduced in "Fully Homomorphic Encryption ...
3
votes
1answer
127 views

Definition of symmetric cipher and definition of asymmetric cipher

So I'm currently taking a cryptography class right now and my professor has told the class that she can't even define symmetric cipher for us without getting into asymmetric ciphers and the textbook ...
7
votes
3answers
319 views

Is there a cryptographic approach to availability

Background Cryptography can be said to provide the tools used to fulfill the goals of information security. The three pillars of information security are confidentiality, integrity, and ...
14
votes
2answers
599 views

Does GCM (or GHASH) only provide 64-bit security against forgeries?

In a recent comment a doubt was voiced about my answer, which claims GCM to requires $2^{128}$ for a successful forgery. The doubt was that the square root needs to be taken meaning the security would ...
3
votes
1answer
411 views

What's the difference between perfect security and unconditional security?

This paper refers to two distinct security models: perfect security and unconditional security. Until now, I knew of them as the same thing and equivalent to information-theoretic security. From the ...
1
vote
0answers
86 views

Non-Repudiation vs Identity-Binding

There are 3 properties offered by a cryptographic digital signature scheme: Integrity guarantee of the message signed. Authenticity guarantee of the message signed. Non-repudiation of the message ...
1
vote
0answers
144 views

Indistinguishable encryptions and CPA-secure example

Let $ F $ be a PRF and $ G$ be a PRG with expansion factor $n \to n +1 $ For the following encryption scheme, decide whether it has indistinguishable encryptions and whether it is CPA-secure. ...
1
vote
2answers
147 views

How is n-bit security calculated with nested encryption?

What will the total $n$-bit security be if I encrypt a message with a 128-bit XOR cipher and then take that ciphertext and encrypt it with a 128-bit key. Is the total security level now 256? One ...
0
votes
2answers
165 views

Does encryption using PRP mean indistinguishable encryption against an eavesdropper?

I am a student studying cryptography by reading "Introduction to Modern Cryptography". I have some confusion about encryption using PRP (e.g., AES). Briefly speaking, a keyed deterministic ...
1
vote
1answer
742 views

Difference between eavesdropping and traffic analysis

I was wondering what is the conceptual difference between these two passive attacks on a network. I was reading about them on Wikipedia and they seem quite similar to me. Is there a difference?
0
votes
1answer
173 views

Adaptive vs. Static security model in ABE

From Lewko, I understand the difference between an adaptive and selective model: Adaptive model: the attacker can adaptively query the challenger for private keys. Selective model: the attacker has ...
2
votes
2answers
578 views

Identifying negligible functions

I am having a hard time understanding and applying the formulas that are used to identify a function is negligible or not? One text defines it as; a function $f$ from the natural numbers to the non-...