Questions tagged [security-definition]
Questions about formal definitions of "security" for various cryptographic schemes (e.g. perfect secrecy, semantic security, ciphertext indistinguishability, etc.)
288
questions
5
votes
4
answers
444
views
What does perfect mean within perfect forward secrecy and why do some cryptographers disagree with the term?
In this blog post, Matthew Green says
Forward secrecy (usually misnamed “perfect forward secrecy”)...
The Wikipedia article on forward secrecy (which the same sentence links to in the blog) says
...
user80567
0
votes
0
answers
100
views
ROLLO : security bits parameters
In ROLLO -Rank-Ouroboros, LAKE & LOCKER p.20, it says that "Notice that for 128 security bits parameters, the practical security is rather higher than 128 at about 170 bits." How Can I ...
- 113
4
votes
2
answers
265
views
What is the difference between security parameter and $b$-bit security?
In a previous question, I read
... for $b$-bit security meaning $O(2^b)$ work for an attacker to break the system...
While in Katz's Introduction to modern Cryptography, I read:
The key-generation ...
- 113
13
votes
1
answer
3k
views
Meaning of "Security can be reduced to a problem"
I'm studying reductions in cryptography and confused about the way people use the word "reduction".
My question is almost the same as a past question, but what I want to ask is slightly different.
A ...
- 131
2
votes
1
answer
657
views
RSA and the strong RSA assumptions
The RSA assumption:
Given a randomly generated RSA modulus $n$, exponent $r$ and a random $z \in \mathbb{Z}_n^{*}$, find $y$ such that $y^r=z$.
The strong RSA assumption:
Given a randomly chosen ...
- 35
1
vote
1
answer
396
views
MAC security game
In the applied cryptography book by Boneh and Shoup, Chapter 6 on MACs, it is stated that one can modify SUF-CMA game by removing verify oracle access to the adversary. Therefore, the two versions are ...
- 2,848
1
vote
1
answer
2k
views
Seed/key algorithm security
Currently I'm working on implementing a seed/key algorithm to limit access to a tool for authorized users. My understanding of the algorithm is that its strength is derived from the seed itself. ...
0
votes
0
answers
391
views
Importance of Backward and forward secrecy
Which security feature is more important in security protocols being used in different applications? Forward Secrecy or Backward Secrecy
0
votes
1
answer
95
views
Research topics related to cryptography and Hamiltonian cycles
I am very interested in pursuing a research where I can show an application of Hamiltonian cycles in Cayley graphs of some group such as reflection groups to the field of cryptography.
But currently ...
1
vote
0
answers
532
views
Game-based proofs and semantic security
After reading this question, I understood that "game-based" and "simulation-based" have to do with the way that security properties are postulated. In particular, IND-CPA is a canonical example of ...
- 11
1
vote
3
answers
1k
views
Is a PRG concatenation using the same input still a PRG?
Suppose we have a secure PRG $G: \{0,1\}^s→ \{0,1\}^n$ and we define a $G'(k)$ as:
$$
G'(k) = G(k) \| G(k)
$$
So if $G(k)=\mathbf{i}$, $G'(k) = \mathbf{i} \| \mathbf{i}$
Is $G'$ still a secure PRG?
...
- 119
1
vote
1
answer
139
views
Forward Security of Symmetric Encryption Schemes with LFSR based PRNG
Forward security can be achieved using symmetric encryption schemes by combining with a pseudo-random number generator (PRNG). Does LFSR based PRNG provide forward security in this case?
- 81
10
votes
1
answer
3k
views
Existential unforgeability vs strong unforgeability
In the article https://crypto.stanford.edu/~dabo/pubs/papers/strongsigs.pdf there are two definitions for the security of a digital signature scheme: existential unforgeability and strong ...
- 1,066
0
votes
0
answers
46
views
Is this simple proposed scheme semantically secure?
Suppose we have two parties, including $P_1$ and $P_2$ using a type of symmetric encryption algorithm, say, AES256. Let's assume the shared key is: $K$.
Encryption:
Each party generate a key such ...
2
votes
0
answers
49
views
decrypting a one-time-pad that outputs 0,1 in preknown probabilities
assuming a two users want to use a one time pad ciphersystem, and they are using a program that was developed by a third party that was supposed to create random undependable bits, but for some reason ...
- 87
2
votes
1
answer
351
views
Does an information-theoretically secure hash function exist?
Does an information theoretically secure hash function exist? (By exist I mean is discovered/invented and implemented, not whether it could exist.)
- 516
2
votes
2
answers
337
views
Collision resistant functions - definition
Let $f$ be a collision resistant function i.e. it is computationally impossible to find $x_0, x_1$ such that $f(x_0) = f(x_1)$. If a computationally bounded adversary demonstrates that he knows some $...
- 693
0
votes
0
answers
60
views
DLP instances for given number of congruences
Let $S$ be the set of $k$ congruences of the type $g_{i}^{x_i} \equiv h_i \pmod{n_i}, \quad \forall i,1\leq i \leq k$
What would be the best way to describe such set $S$ with a term in literature. ...
- 898
0
votes
0
answers
140
views
1-out-of-2 Oblivious Transfer Security
Just started reading Oblivious Transfer. I am searching for a proof of security based on RSA implementation but I can't find anything simple to understand. Can someone direct/show me to an easy to ...
- 19
0
votes
1
answer
444
views
Security of this PRF [closed]
Given $F$ a secure PRF with input size $\lambda$. Define $F'$ as
$F'(k,x||x') = F(k, 0||x)\oplus F(k, 1||x')$
with $x$ and $x'$ of $\lambda-1$ bits.
Is $F'$ a secure PRF?
- 111
1
vote
1
answer
47
views
Looking for a formula for "Given $x_1$, $\ldots$, $x_{n-1}$, the output $F(x_1,\ldots,x_n)$ is dependent of $x_n$ and is of $l$-bits security"
Suppose I have a function $F(x_1,\ldots,x_n)$, where each $x_i$ is of $l$-bits security (suppose each $x_i$ is a binary string of length $l$). At the same time, suppose there are $n$ persons, each one ...
- 325
1
vote
0
answers
54
views
Precise Definition of 1-out-of-2 Oblivious Transfer
What's the precise definition for 1-out-of-2 OT? and what's the best way to show that it can't be achieved under unconditionally secure setting?
I am reading about it and just couldn't get my head ...
- 19
1
vote
0
answers
157
views
Reduction to security of proof system for proving knowledge
I want to prove security of my system by reduction to the security of an underlying
non-interactive proof system for proving knowledge. I know a game that captures the
desired security property of my ...
- 21
1
vote
2
answers
366
views
What is the Knowledge Of Secret Key Assumption (KOSK)
From what I've read it seems to be where an entity must prove that they own the secret key. Which is done by signing a message M using said secret key.
Is this ...
- 1,303
1
vote
0
answers
139
views
How does the offline authentication work?
In these slides, offline and online PUF-based authentication protocols are explained in minute 16:30 and 17:30, respectively. I understand the way the online protocol works. Basically, the server ...
- 263
4
votes
2
answers
638
views
What is the security concept in printer cartridge?
Based on this datasheet or this patent, one of the usage of PUF is printer cartridge identification and authentication. I was wondering why printer cartridge needs identification and authentication. ...
- 263
2
votes
0
answers
53
views
Can ideal functionalities share variables
I am trying to define an ideal world for a protocol that requires two functionalities to interact with each other. Lets call them $\mathcal{F}_1$ and $\mathcal{F}_2$.
Now $\mathcal{F}_1$ maintains a ...
- 88
0
votes
0
answers
211
views
Formal security-definition reference
Is there a reference where all common formal security-definitions are summarized (such as OW-CPA, IND-CPA, IND-CCA1, IND-CCA2, EUF-CMA and so on)? I need a PUBLISHED reference (paper, book) which ...
- 123
7
votes
2
answers
3k
views
What is the difference between information-theoretic and perfect types of security?
I'm having a hard time pinning down an exact definition of the difference between information-theoretic and perfect types of security. A rigorous definition seems elusive...
A. Wikipedia puts the ...
- 15.1k
2
votes
2
answers
1k
views
Why the definition in $\epsilon$-differential privacy is multiplicative rather than additive？
According to its mathematical definition, a random algorithm $M: D\rightarrow R$ satisfies $\epsilon$-differential privacy if the adjacent datasets $x, y \in D$ where $D$ is a whole dataset and ...
- 53
3
votes
2
answers
690
views
Comparison of security definitions for signatures
The two main security definitions for signatures are EUF-CMA and the strong version of it sEUF-CMA.
What I see that their difference is that in EUF-CMA experiment, the adversary needs to produce a ...
user4936
1
vote
1
answer
184
views
Codes of "SAS und Chiffrierdienst"
The german site "SAS und Chiffrierdienst der DDR"
http://scz.bplaced.net
has some interesting content under point 11.3 in the category "manuelle Verfahren" I found ciphers named from A to D. But I ...
- 107
2
votes
1
answer
592
views
Formal definition of collision resistance for hash function
In my cryptography class, the professor said that collision resistance for a fixed hash function is not a "precise" definition. The reason is since a fixed hash function is a single instance of a ...
- 2,848
3
votes
2
answers
113
views
Why is the security level defined by $\log _{2} \inf \{ t_{i}/\varepsilon_{i} \mid i \in I \}$
In public-key cryptography, the security level indicates the strength of an adversary in breaking a scheme or solving a problem, which can be seen as the time cost of breaking a scheme or solving a ...
- 1,582
1
vote
1
answer
335
views
What is the security model of the FHE system introduced in Fully Homomorphic Encryption Using Ideal Lattices?
How would one construct a security model to play against the adversary, and define the security of the overall scheme? This is in reference to the scheme introduced in "Fully Homomorphic Encryption ...
- 93
3
votes
1
answer
199
views
Definition of symmetric cipher and definition of asymmetric cipher
So I'm currently taking a cryptography class right now and my professor has told the class that she can't even define symmetric cipher for us without getting into asymmetric ciphers and the textbook ...
- 43
7
votes
3
answers
603
views
Is there a cryptographic approach to availability
Background
Cryptography can be said to provide the tools used to fulfill the goals of information security.
The three pillars of information security are confidentiality, integrity, and ...
- 19.5k
14
votes
2
answers
1k
views
Does GCM (or GHASH) only provide 64-bit security against forgeries?
In a recent comment a doubt was voiced about my answer, which claims GCM to requires $2^{128}$ for a successful forgery. The doubt was that the square root needs to be taken meaning the security would ...
- 45.7k
4
votes
1
answer
1k
views
What's the difference between perfect security and unconditional security?
This paper refers to two distinct security models: perfect security and unconditional security. Until now, I knew of them as the same thing and equivalent to information-theoretic security.
From the ...
- 441
1
vote
0
answers
202
views
Non-Repudiation vs Identity-Binding
There are 3 properties offered by a cryptographic digital signature scheme:
Integrity guarantee of the message signed.
Authenticity guarantee of the message signed.
Non-repudiation of the message ...
- 9,001
1
vote
0
answers
275
views
Indistinguishable encryptions and CPA-secure example
Let $ F $ be a PRF and $ G$ be a PRG with expansion factor $n \to n +1 $ For the following encryption scheme, decide whether it has indistinguishable encryptions and whether it is CPA-secure.
...
- 63
1
vote
2
answers
243
views
How is n-bit security calculated with nested encryption?
What will the total $n$-bit security be if I encrypt a message with a 128-bit XOR cipher and then take that ciphertext and encrypt it with a 128-bit key.
Is the total security level now 256?
One ...
- 11
0
votes
2
answers
511
views
Does encryption using PRP mean indistinguishable encryption against an eavesdropper?
I am a student studying cryptography by reading "Introduction to Modern Cryptography".
I have some confusion about encryption using PRP (e.g., AES).
Briefly speaking, a keyed deterministic ...
- 3
1
vote
1
answer
2k
views
Difference between eavesdropping and traffic analysis
I was wondering what is the conceptual difference between these two passive attacks on a network. I was reading about them on Wikipedia and they seem quite similar to me. Is there a difference?
1
vote
1
answer
293
views
Adaptive vs. Static security model in ABE
From Lewko, I understand the difference between an adaptive and selective model:
Adaptive model: the attacker can adaptively query the challenger for private keys.
Selective model: the attacker has ...
- 35
2
votes
2
answers
2k
views
Identifying negligible functions
I am having a hard time understanding and applying the formulas that are used to identify a function is negligible or not?
One text defines it as; a function $f$ from the natural numbers to the non-...
- 51
1
vote
1
answer
248
views
Is the simulation-based proof difficult and needed? [closed]
What is the role for simulation-based proof under the semi-honest model without considering malicious adversaries?
I agree with that a view of a some party is important to prove that a protocol is ...
- 1,595
4
votes
3
answers
895
views
Is it possible to exactly reverse engineer an unknown cipher inside a black box?
Consider the following arrangement:-
There is an unknown cipher algorithm operating inside the black box. You can enter infinite key /plain text pairs, and observe all of the outputs. The box might ...
- 15.1k
4
votes
1
answer
723
views
Is the practice of "security through obscurity" violating Kerckhoffs's second principle?
Security through obscurity is the reliance on the secrecy of the design or implementation as the main method of providing security for a system or component of a system.
Kerckhoffs's second principle:...
- 6,406
1
vote
1
answer
299
views
What does $1^n$ mean? [duplicate]
I often see the notation of powers of 1 in cryptography papers.
For example, let $n$ be security parameter, then what does $1^n$ mean??
From high school student perspective, powers of one is always ...
- 1,595