# Questions tagged [security-definition]

Questions about formal definitions of "security" for various cryptographic schemes (e.g. perfect secrecy, semantic security, ciphertext indistinguishability, etc.)

232 questions
Filter by
Sorted by
Tagged with
63 views

48 views

### Question about game based security

When a game between an adversary $A$ and a challenger $CH$ is used in the security model of a scheme, and oracles are defined, does the adversary only have access to those oracles in the attack or ...
50 views

### How to compare two post quantum digital signature schemes in terms of latency?

I want to compare two digital signature schemes of different nature. One is Hash-based (Winternitz one time signature scheme) and the other is lattice-based (Dilithium Crystals). What about be an ...
36 views

### How to evaluate number of security bits of a signature scheme?

I am trying to evaluate the effective security levels that a digital signature scheme (namely post-quantum digital schemes like WOT-S (Winternitz one time signature scheme) and Dilithium Crystals). ...
35 views

### show that key recovery is not possible in a computationally secure system

(G, E, D) is a computationally secure encryption scheme over the message space $\{0,1\}^n$. Show that the probability that a PPT adversary can recover the key after seeing the encryption of a random (...
41 views

125 views

### How does the security of Elliptic curve compare to normal discrete logarithm?

Intro: EC are often compared with RSA but how about a more safe version of the discrete logarithm? All 3 can be reduced to the problem: $$b = g^a \mod{P}$$ In RSA $P$ is a product of two primes. To ...
56 views

In cryptography, for a polynomial time-bounded adversary $\mathcal{A}$, given a scheme $\Pi$, the success or probability of succeeding $\mathcal{A}$ is the likelihood for $\mathcal{A}$ to break $\Pi$, ...
6k views

### When NIST disallows the use of 1024-bit keys, what effect will that have on SHA-3 (with max. 512 bits)?

Quoting the article Gone in 60 Months or Less: The National Institute of Standards and Technology (NIST) has disallowed the use of 1024-bit keys after 31 December 2013 because they are insecure. ...
1k views

### What is the difference between information-theoretic and perfect types of security?

I'm having a hard time pinning down an exact definition of the difference between information-theoretic and perfect types of security. A rigorous definition seems elusive... A. Wikipedia puts the ...
101 views

### An exercise to show that CBC Chain is insecure

The CBC-Chain mode of operation is a CBC variant in which the IV that is used for the very first message to be encrypted is randomly selected, whereas the IV used for each subsequent encrypted message ...
78 views

1k views

### Difference between eavesdropping and traffic analysis

I was wondering what is the conceptual difference between these two passive attacks on a network. I was reading about them on Wikipedia and they seem quite similar to me. Is there a difference?
452 views

### Difference between a secure PRG and semantically secure encryption

I am taking cryptography course in Coursera from Stanford University. I have following question I have a question why append 0 in G(k) i.e., G'(k) = G(k) || 0 is considered as not secure PRG as 0 in ...
1k views

### Signature based on public key cryptography and forgery

In the definition of existential unforgeability, there is no detail about the following questions. In general, can we suppose that a signer is also a possible adversary? When generating a signature, ...
178 views

### How long would it take all of the supercomputers or cloud computing on Earth to bruteforce a significantly long password?

I was arguing with a colleague who thinks that SHA256 (password + 64 character static salt) is "insecure." My argument is that nothing in cryptography is "secure," it's all a ...
55 views

### How to formally define the security of Random Oblivious Transfer

Assume that there is a protocol $(A,B)$ such that receives no input and satisfies: $A$ - outputs two random bits $x_0, x_1 \in \{0,1\}$ $B$ - outputs a random bit $b \in \{0,1\}$ and also outputs $x_b$...
46 views

### Alternatives to simple bit-measured security for ciphers

For a cryptographic primitive, we usually see the security level measured in bits, where n-bit security means that the attacker would have to perform $2^n$ operations to break it. For key-derivation ...
70 views

### Not understanding deterministic authenticated encryption (DAE) security definition

I have a question regarding the security definition of deterministic authenticated encryption (DAE) as defined by Bellare and Shrimpton. Their definition is reproduced below, and my question pertains ...
128 views

### Bits of security vs collision resistance?

I have been doing some research on security, and I am confused on the bits of security vs collision resistance, and I was wondering if someone could clarify my understanding. For instance, if you have ...
69 views

### What are the “costs” to find a pre-image, weak collision, or strong collision?

For a secure, n-bit hash function, what are the “costs” to find a pre-image, weak collision, or strong collision?