Questions tagged [security-definition]
Questions about formal definitions of "security" for various cryptographic schemes (e.g. perfect secrecy, semantic security, ciphertext indistinguishability, etc.)
71
questions with no upvoted or accepted answers
6
votes
0
answers
125
views
About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?
Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$
with
$$p=(p_1, p_2)$$
$$q=(q_1,q_2)$$
$$p_1,q_1 \in [0,s)$$
$$p_2,q_2 \in [0,s^2)$$
We want to find a path in between ...
- 573
5
votes
0
answers
190
views
Explanation of the term "view" for algorithm or adversary
What is the view of an algorithm/adversary? Is view just a term used to describe the output over a set of inputs for a probabilistic algorithm?
For example:
Consider experiment Mac-forgeA,Π (n). ...
4
votes
0
answers
100
views
How to get started with Simulation and UC proofs?
I've been in my PhD program for a few months, and every time I try to understand the simulation and UC proof-paradigms I get so confused.
I feel like what I really need is an easy set of (guided) ...
- 41
4
votes
0
answers
826
views
2 different definitions of Special Soundness
There are 2 different definitions of special soundness in the literature:
(1) can be found in Damgard:
We say that a Sigma-protocol $\Pi$ satisfies special soundness, if there exists a PPT extractor $\...
- 173
4
votes
0
answers
197
views
Differences in definitions of "Computational Special Soundness"
I am looking at Unruh's transform (ePrint 2014/587) and in particular the definition in §2.2 for computational special soundness in sigma protocols. Let $\cal{R} \subset \cal{X} \times \cal{Y}$ be ...
4
votes
0
answers
451
views
Hash Function Properties
What I am trying to understand is shown in all three properties of a secure hash function, I will focus on Preimage attack resistance.
Preimage resistance: given a hash h, it's difficult to find m s.t....
- 165
4
votes
0
answers
870
views
Can a secure MAC break if the adversary is given oracle access to Verify?
In the Mac-forge experiment, the adversary is given access to a tag-generation oracle, which generates a tag for each message given by the adversary. The adversary's task is to generate a valid tag on ...
- 141
4
votes
0
answers
2k
views
What is the difference between mutual authentication and unilateral authentication both ways?
I am currently reading Engineering Security by Peter Gutmann, on page 7 he states:
proper
mutual authentication is quite different from unilateral authentication in both directions
He references ...
3
votes
0
answers
57
views
On the Adaptive Security of MPC Protocols
In adversarial context of MPC, the corruption behavior
refers to the assumptions about the corrupted parties’ deviation level from the protocol
specification. Three main types of corruption behaviors ...
- 538
3
votes
0
answers
47
views
Variant of CCA security for Paillier with blinded decryption oracle
Consider a variant of the Paillier encryption scheme where the message space is restricted to $\mathbb{Z}_q$ such that the RSA modulus $N$ of the Paillier cryptosystem satisfies $N > q + q^2$. I am ...
3
votes
0
answers
99
views
Semantic Security equivalent to Real/Random Semantic Security
I'm reading Boneh and Shoup's book "A Graduate Course in Applied Cryptography." Im doing one of the questions at the end of the stream ciphers chapter. I'm not sure how to do this problem:
...
3
votes
0
answers
160
views
How do adversary models and security types relate [from InfoSec SE]
I have been told to move the question to this forum in order to get a better insight, so here we go:
Reading some questions in this forum I encountered this answer mentioning IND-CPA as a requirement ...
- 63
3
votes
0
answers
392
views
On the Definition of a PRG and a CSPRG
I've been looking at the definition of a PRG, here. This is a broader notion than a cryptographically secure PRG ("CSPRG"), which is described here. I am realizing that I am very confused by this ...
- 193
2
votes
0
answers
144
views
Difference between an authentication scheme and a identification scheme in ZK proofs?
EDIT: I want to specify what I know about schemes security:
Authentication schemes: P can prove V he is P, and nobody else can prove V that they are P.
Identification schemes: P can prove V he is P, ...
- 131
2
votes
0
answers
87
views
Encrypting random coins used for the encryption itself
Circular security notions for PKE schemes capture the security of (PKE) schemes when encrypting the secret decryption key.
Is there an analogous notion but for encrypting the randomness used for the ...
- 141
2
votes
0
answers
161
views
Uniform vs Non-uniform Attackers
There is a concept of attackers gaining some information before attacking a system and those attackers being called non-uniform attackers. How do the security proofs for cryptographic primitives in ...
2
votes
0
answers
388
views
An exercise to show that CBC Chain is insecure
The CBC-Chain mode of operation is a CBC variant in which the IV that is used for
the very first message to be encrypted is randomly selected, whereas the IV used for
each subsequent encrypted message ...
- 41
2
votes
0
answers
49
views
decrypting a one-time-pad that outputs 0,1 in preknown probabilities
assuming a two users want to use a one time pad ciphersystem, and they are using a program that was developed by a third party that was supposed to create random undependable bits, but for some reason ...
- 87
2
votes
0
answers
53
views
Can ideal functionalities share variables
I am trying to define an ideal world for a protocol that requires two functionalities to interact with each other. Lets call them $\mathcal{F}_1$ and $\mathcal{F}_2$.
Now $\mathcal{F}_1$ maintains a ...
- 88
2
votes
0
answers
47
views
Are there any security definitions for DNS?
Given a recent post on the Tor blog and the corresponding discussion on HN I was wondering if there are any security definitions for DNS or similar name systems.
So something similar to ACCE for TLS ...
- 4,883
2
votes
0
answers
65
views
Security aspects of a splitted Pohlig-Hellman system
Given a Polig-Hellman (is that really the name for that?) system with
$$C = M^k \bmod p$$
where $M$ is the message, $C$ is the ciphertext, $k$ is a (secret) key (any integer relatively prime to $p-1$...
- 185
2
votes
0
answers
62
views
Quantifying bit security for smart-vercauteren encryption scheme
I am working on project that requires to compare in terms of security between two encryption schemes, one of them is the SV scheme. However, I dont know what are the steps exactly towards quantifying ...
2
votes
0
answers
697
views
Ideal system for an encryption scheme
What is the ideal system for an encryption scheme? For a pseudorandom permutation the ideal one is a random permutation, for a pseudorandom function the ideal one is a random function. For an ...
- 2,837
2
votes
1
answer
93
views
Defining the random variables $K,M,C$ and Perfect Secrecy
In many books on Cryptography, we refer to probability distributions over the key space $\mathcal{K}$, over the plaintext space $\mathcal{M}$ and over the ciphertext space $\mathcal{C}$.
Then, we let $...
- 206
1
vote
0
answers
48
views
Is the security of output of Skein when using arbitrary output size similar to that of SHAKE?
Let's suppose I have a 1MB high-resolution photo and I want to hash and create a 1536-bits key.
I know that I could just use SHAKE-256 as its a pre-enginered way for doing that.
There is also Skein ...
- 877
1
vote
0
answers
87
views
Clarification for CCA security (or - why is the following not a Rabin CCA attack?)
In three different, highly reputable sources (e.g. "Introduction to Modern Cryptography" by Katz and Lindell, 2007), the definition of CCA attack doesn't allow the adversary to decrypt the ...
- 383
1
vote
0
answers
107
views
Question about sequence length/count/security of $x\mapsto x^\alpha \mod (N=Q\cdot R)$, with $Q=2q_1q_2+1$ and $R=2r_1r_2+1$ and $\alpha = 2q_2r_2$
Given a number $N$ with
$$N=Q\cdot R$$
$$Q=2\cdot q_1 \cdot q_2+1$$
$$R=2\cdot r_1\cdot r_2+1$$
with different primes $P,Q,q_1,q_2,r_1,r_2$.
If we now choose an exponent $\alpha$ containing prime ...
- 573
1
vote
0
answers
83
views
Exact security requirements for extendable output functions (XOF)?
In the FIPS202 document "SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions" an extendable-output functions is defined as:
An extendable-output function (XOF) is a ...
- 347
1
vote
0
answers
60
views
If a different plaintext may produce the same ciphertext, is the system perfectly secure?
Define the injective map $\phi: \Omega\rightarrow \mathbb{N}$, such that $\Omega=\mathcal{A}^n$ denotes the set of all strings of length $n\in\mathbb{N}^*$ from an alphabet $\mathcal{A}$ of elements $...
- 11
1
vote
0
answers
54
views
Prove that secure authenticated encryption system composed with itself is secure
Suppose $(E,D)$ provides authenticated encryption with key space $K$. Define $(E',D')$ with key space $K^2$ as follows:
$$
E'((k_1,k_2),m) = E(k_2,E(k_1,m)) \\
D'((k_1,k_2),c) = \begin{cases}
D(k_1,E(...
- 111
1
vote
0
answers
56
views
Distributional Virtual Black Box security
Can anyone clearly explain the difference between these two notions of obfuscation security: VBB security and D-VBB Security.
VBB Security: An obfuscated program is no better than just a black box ...
- 31
1
vote
0
answers
58
views
How to compare two post quantum digital signature schemes in terms of latency?
I want to compare two digital signature schemes of different nature. One is Hash-based (Winternitz one time signature scheme) and the other is lattice-based (Dilithium Crystals). What about be an ...
1
vote
0
answers
48
views
How to evaluate number of security bits of a signature scheme?
I am trying to evaluate the effective security levels that a digital signature scheme (namely post-quantum digital schemes like WOT-S (Winternitz one time signature scheme) and Dilithium Crystals). ...
1
vote
0
answers
96
views
How to formally define the security of Random Oblivious Transfer
Assume that there is a protocol $(A,B)$ such that receives no input and satisfies:
$A$ - outputs two random bits $x_0, x_1 \in \{0,1\}$
$B$ - outputs a random bit $b \in \{0,1\}$ and also outputs $x_b$...
- 155
1
vote
0
answers
532
views
Game-based proofs and semantic security
After reading this question, I understood that "game-based" and "simulation-based" have to do with the way that security properties are postulated. In particular, IND-CPA is a canonical example of ...
- 11
1
vote
0
answers
54
views
Precise Definition of 1-out-of-2 Oblivious Transfer
What's the precise definition for 1-out-of-2 OT? and what's the best way to show that it can't be achieved under unconditionally secure setting?
I am reading about it and just couldn't get my head ...
- 19
1
vote
0
answers
157
views
Reduction to security of proof system for proving knowledge
I want to prove security of my system by reduction to the security of an underlying
non-interactive proof system for proving knowledge. I know a game that captures the
desired security property of my ...
- 21
1
vote
0
answers
139
views
How does the offline authentication work?
In these slides, offline and online PUF-based authentication protocols are explained in minute 16:30 and 17:30, respectively. I understand the way the online protocol works. Basically, the server ...
- 263
1
vote
0
answers
202
views
Non-Repudiation vs Identity-Binding
There are 3 properties offered by a cryptographic digital signature scheme:
Integrity guarantee of the message signed.
Authenticity guarantee of the message signed.
Non-repudiation of the message ...
- 9,001
1
vote
0
answers
275
views
Indistinguishable encryptions and CPA-secure example
Let $ F $ be a PRF and $ G$ be a PRG with expansion factor $n \to n +1 $ For the following encryption scheme, decide whether it has indistinguishable encryptions and whether it is CPA-secure.
...
- 63
1
vote
0
answers
156
views
Mersenne Twister's vulnerabilty with small-size distributions
C++ rookie here, trying to wrap his head around (CS)PRNGs.
I (assume that I) already understand the concept of the Mersenne Twister being "broken" (i.e. not cryptographically secure) due to its ...
- 11
1
vote
0
answers
56
views
Proofs of security for anonymity in a multi-party setting
I'm looking for material that proves the anonymity of parties in a non-interactive setting. I would like to know if there are simulation based proofs (UC) and property based proofs (game based) for ...
- 88
1
vote
0
answers
47
views
A qusetion about the security game of Certificateless signatures
Recently I read Certificateless Public Auditing for Data Integrity in the Cloud , I have a question about the security of proposed HOMOMORPHIC AUTHENTICABLE CLS. （Sec. IV）. For the Type-I Adversary, ...
- 11
1
vote
0
answers
392
views
Design flaw in IND-CKA definition of Searchable Symmetric Encryption?
I am a graduate student interested in searchable encryption research. I carefully read the Secure Indexes paper published in 2004, and I was confused about the IND-CKA, the game-based security ...
- 11
1
vote
0
answers
83
views
RIsk mitigation: block cypher vs xor
It sort of looks like to me that there is a kind of risk mitigation in the architecture of block cyphers vs the xor cypher.
In XOR, the risk is entirely in the random number generator. The XOR ...
- 533
1
vote
0
answers
53
views
Homomorphic encryption and approximated GCD 2
This is a further question to the one reached here Homomorphic encryption and approximated GCD.
I am now thinking about a symmetric cipher in which the plaintext set is integers, illustrated as ...
- 65
1
vote
0
answers
573
views
Relationship between "Entropy" and "Security" in crypto functions
There is a lot of confusion between "entropy" and "security" of a cryptographic function.
I like to visualize it as the entropy being the water, and the crypto function being a glass.
So for ...
- 533
1
vote
0
answers
214
views
Privacy-Preserving Protocols and Proofs of Security
While dabbling in privacy-preserving protocols (mainly using Semi-Homomorphic Encryption) and coming up with miscellaneous ideas for comparison tests or other similar primitives, based on obfuscation ...
- 375
1
vote
1
answer
78
views
Can we determine a security parameter in the hybrid argument where the number of hybrids is polynomially bounded but not known?
Let $\lambda$ be a statistical security parameter. Consider a security proof that is based on hybrid argument, where there are polynomially many (say, $n = p(\lambda)$) hybrids, $H_1, ..., H_n$. Any ...
- 414
0
votes
0
answers
68
views
Why is decryption algorithm usyally deterministic?
For security against Chosen Plaintext Attack (CPA), we need randomized algorithms for encryption. But in some schemes (maybe almost all of them) take decryption algorithm deterministic. This procedure ...
- 363