# Questions tagged [security-definition]

Questions about formal definitions of "security" for various cryptographic schemes (e.g. perfect secrecy, semantic security, ciphertext indistinguishability, etc.)

232 questions
Filter by
Sorted by
Tagged with
80 views

### Is function Deterministic or Probabilistic in the malicious security definition?

As you see, according to the attached definitions from "Efficient Secure Two-Party Protocols", the definition of the security in the semi-honest world has two cases for $f=(f_1,f_2)$.(deterministic ...
528 views

### Strong One-Way Function

In the book "Foundations of cryptography-Oded Goldreich-Page 33", if we use the deterministic polynomial-time algorithm instead of the probabilistic polynomial-time algorithm for case 2 (Hard to ...
91 views

### A problem exists with the security proof in the secure AND example in the malicious model [closed]

Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world ...
186 views

### The interaction between the malicious Adversary and the Simulator and Real-Ideal' views

This example is from “Efficient Secure Two-Party Protocols-Carmit Hazay-Yehuda Lindell”. And the security proof of the above example is this: I have drawn a picture that is deduced from the above ...
148 views

### Security proof in the Malicious Model

According to the above protocol(Efficient Secure Two-Pary Protocols-Hazay-Lindell-page 27), the authors proved the security of this protocol according to the two paragraphs below: We separately ...
150 views

### How to use Real-Ideal model in a specific scenario (two party with cloud)

I have designed a two-party protocol where two parties outsource their input to the cloud. For example, Alice and Bob have inputs $X$ and $Y$, respectively, after which Alice and Bob encrypt their ...
80 views

### Using the security definition in the malicious model to prove security in the semi honest model

Can I use the security definition in the malicious model in order to prove the security of a two-party protocol which is in the semi-honest model? (I am using IDEAL/REAL Model paradigm) Would you ...
357 views

### difference between the uniform and non-uniform probabilistic polynomial algorithms (ppt)

I am reading the book "Efficient Secure Two-Party Protocol". A question came to my mind. why has the author used a probabilistic polynomial time algorithm for security definition of ideal/real model ...
3k views

### Difference between semi-honest and malicious adversary using Ideal Real Model Paradigm

Would you please explain to me why in the security definition of ideal/real model paradigm which is described in the efficient secure two-party protocol book(Hazay, Lindell), the simulator tries to ...
2k views

### How small is negligible?

When proving theorems in crypto we often make use of the concept of negligible functions or, more simply, negligible parameters. As a rule of thumb, given today (2018) computational power, what is ...
272 views

### "Power of one" as input to functions of a cryptosystem

What does $1^\lambda$ mean when you pass it as a parameter to the functions of a cryptosystem. The cryptosystem in question is this and a picture reference is this. I have been told it signifies the ...
43 views

### A qusetion about the security game of Certificateless signatures

Recently I read Certificateless Public Auditing for Data Integrity in the Cloud , I have a question about the security of proposed HOMOMORPHIC AUTHENTICABLE CLS. （Sec. IV）. For the Type-I Adversary, ...
106 views

### In "Lecture Notes on Cryptography" what does "PTM" mean?

I came across a handbook named "Lecture Notes on Cryptography" from Shafi Goldwasser and Mihir Bellare and I read their definition 3.1 about poly-time indistinguishability: Let $X_n,Y_n$ be ...
82 views

### Maximum value of negligible probability?

We can see on many papers for cryptography that there are many uses of negligible probability to ensure something (security, correctness, etc). How can we say that some probability is negligible? I ...
227 views

### Is there a computational security of public-key encryption which is similar to the one of symmetric key encryption

We say a symmetric key encryption scheme $\Pi_{1} = (\mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec})$ is computational security if for every PPT algorithm $A$ and every $x_{0}, x_{1}$ ($|x_{0}| = |x_{1}|$), ...
368 views

Assume that the encryption uses $n$-bit keys to encrypt $l(n)$-length messages. If a symmetric key encryption scheme is defined as $\Pi_{1} = ( \mathrm{Enc}, \mathrm{Dec} )$, then for every $x_{0}, ... 1answer 396 views ### security against CPA attack? Let$\mathcal{E} = (E,D)$be a CPA secure cipher. Let's define$\mathcal{E'} = (E', D')$, where$E'(k,m) = E(k, E(k,m))$. How can I prove that$\mathcal{E'}$will be CPA secure if$\mathcal{E}$is? ... 0answers 292 views ### Design flaw in IND-CKA definition of Searchable Symmetric Encryption? I am a graduate student interested in searchable encryption research. I carefully read the Secure Indexes paper published in 2004, and I was confused about the IND-CKA, the game-based security ... 2answers 399 views ### What is the relationship between entropy conditioning and final output bias in a TRNG? This question concerns the conditioning and output of true random number generators. It refers to NIST Special Publication 800-90C, Recommendation for Random Bit Generator (RBG) Constructions. It ... 1answer 536 views ### Deterministic symmetric indistinguishable encryption Are there any block-cipher modes (or symmetric encryption schemes in general) that are fully-deterministic, meaning same inputs lead to the same outputs (like for all modes with constant IV) and ... 2answers 339 views ### Secure pseudo-random generator Suppose that$G : \{0,1\}^k \rightarrow \{0,1\}^{2k}$is a secure pseudo-random generator. Describe what is wrong with each of the following attempts to build a pseudo-random generator with$k$-bit ... 1answer 402 views ### Hash function composition - security level When using two hash functions, g(x)=SHA-512 and f(x)=MD5 g(x) has 512 bit output (using salt) f(x) has 128 bit output. Let's say that z(x)=f(g(x)) meaning the output is 128 bit long. The Question: ... 3answers 717 views ### What does trust mean in cryptography? Terms like "trustless protocol", "trusted third party", "trusted platform", "trusted server", etc. require a notion of trust. I already wrote The term trust when used in the context of cryptography ... 1answer 331 views ### How to determine the security in bits of a scheme? This may be a stupid question. But how would we determine the security bit of a crypto scheme? For example, SHA2-256 offers 128 bit security due to birthday paradox, so do they measure the security ... 1answer 495 views ### Client Puzzles and Amplification [closed] Any hints or suggestion will be helpful. 1answer 53 views ### What does St denote? I am reading a paper and notice that the term St is used without being defined. I suspect it is a common notation that I am not aware of. It is used in the following paper: https://eprint.iacr.org/... 1answer 3k views ### What exactly is a “security parameter”? I often encounter the term “security parameter” when I read crypto related stuff. My basic understanding is that it just denotes some bit-length however, I'm not so sure. For example, when it says ... 1answer 182 views ### Encryption Scheme & Perfect Secrecy [Katz & Lindell] An encryption scheme consists of the following data a plaintext space$\mathcal M$a ciphertext space$\mathcal C$a key space$\mathcal K$a key generating algorithm Gen encryption and decryption ... 2answers 869 views ### Does information theoretical security definition imply DDH, RSA, QR does not hold? Assuming we are in the information theoretical setting, whereby there is no bound on the computational power of an adversary. Does this mean that the standard definitions for DDH, RSA or QR do no hold ... 0answers 145 views ### How do adversary models and security types relate [from InfoSec SE] I have been told to move the question to this forum in order to get a better insight, so here we go: Reading some questions in this forum I encountered this answer mentioning IND-CPA as a requirement ... 1answer 516 views ### I am not convinced that SHA2/3 or AES256 is secure I have been researching cryptography for the past few weeks to try and make sense of a few things, but is simply not making any sense for me. If I encrypt a message, send it to another computer, how ... 0answers 68 views ### RIsk mitigation: block cypher vs xor It sort of looks like to me that there is a kind of risk mitigation in the architecture of block cyphers vs the xor cypher. In XOR, the risk is entirely in the random number generator. The XOR ... 2answers 989 views ### What are the exceptions to Kerckhoffs's principle? Kerckhoffs's principle: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. Yet the following are three exceptions:- NSA Suite A cryptographic ... 1answer 154 views ### How is the zero-knowledge proof definition violated, here? I'm confused about the definition of an interactive zero-knowledge proof (the simulator-transcript-thingy). Assume the following setup:$P$and$V$do a Diffie-Hellman key exchange to generate the ... 3answers 1k views ### What are the vulnerabilities of XOR in the following scenario? What are the security vulnerabilities of the XOR operator in the following scenario: The Key, The Cyphertext and the Plaintext are the same size in bits. The Key is only used once and it's secret The ... 1answer 58 views ### Formal Information-Theoretic Key Expansion Definition Is there a formal definition for a protocol that expands keys that are pre-shared among 2 or more parties? How about an informal definition? Example: Alice and Bob pre-share a$n$-bit string$k$. ... 1answer 549 views ### PPT vs NP problems The common definition of security (for some cryptographic primitive) is to be secure against any PPT adversary (any probabilistic algorithm which runs in polynomial time). At the same time, we assume ... 1answer 452 views ### Difference between a secure PRG and semantically secure encryption I am taking cryptography course in Coursera from Stanford University. I have following question I have a question why append 0 in G(k) i.e., G'(k) = G(k) || 0 is considered as not secure PRG as 0 in ... 0answers 96 views ### Interpretation of message space distribution in the definition of perfect secrecy of encryption schemes I am a beginner to cryptography, and have started reading Katz and Lindell's book titled "Introduction to Modern Cryptography". I'm unable to understand what the probability distribution over the ... 2answers 716 views ### What does it mean the security parameter for a FHE scheme? FHE schemes claim to use some security parameter$\lambda$for deriving the other parameters of the scheme, the size of the key and the possible circuits that can be evaluated. Like in Fully ... 0answers 427 views ### Hash Function Properties What I am trying to understand is shown in all three properties of a secure hash function, I will focus on Preimage attack resistance. Preimage resistance: given a hash h, it's difficult to find m s.t.... 0answers 51 views ### Homomorphic encryption and approximated GCD 2 This is a further question to the one reached here Homomorphic encryption and approximated GCD. I am now thinking about a symmetric cipher in which the plaintext set is integers, illustrated as ... 1answer 716 views ### The notion of sub-exponential security I have been reading a paper where they construct probabilistic IO (indistinguishability obfuscation) from sub exponential IO. I want to know if the following two notions of sub-exponential security ... 0answers 45 views ### Are there any security definitions for DNS? Given a recent post on the Tor blog and the corresponding discussion on HN I was wondering if there are any security definitions for DNS or similar name systems. So something similar to ACCE for TLS ... 0answers 52 views ### scientific research about what is more secure: biometric authentication vs regular [closed] I've already posted this question on Stackoverflow, but got downvoted and told to post here instead. So here we go. I am searching for citeable sources / papers that research about what is more ... 1answer 5k views ### What do the signature security abbreviations like EUF-CMA mean? From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes. The most common ones are the *UF-* ... 0answers 528 views ### Relationship between "Entropy" and "Security" in crypto functions There is a lot of confusion between "entropy" and "security" of a cryptographic function. I like to visualize it as the entropy being the water, and the crypto function being a glass. So for ... 1answer 1k views ### IND-CPA security of CTR mode Let's suppose CTR mode is instantiated such that the input to the block-cipher is$\langle \mathrm{IV}+\mathrm{ctr}\rangle$instead of$\mathrm{IV}\mathbin\|\langle \mathrm{ctr}\rangle$, where$\...
Given a Polig-Hellman (is that really the name for that?) system with $$C = M^k \bmod p$$ where $M$ is the message, $C$ is the ciphertext, $k$ is a (secret) key (any integer relatively prime to $p-1$...