Questions tagged [security-definition]
Questions about formal definitions of "security" for various cryptographic schemes (e.g. perfect secrecy, semantic security, ciphertext indistinguishability, etc.)
288
questions
1
vote
0
answers
52
views
scientific research about what is more secure: biometric authentication vs regular [closed]
I've already posted this question on Stackoverflow, but got downvoted and told to post here instead. So here we go.
I am searching for citeable sources / papers that research about what is more ...
- 111
32
votes
1
answer
9k
views
What do the signature security abbreviations like EUF-CMA mean?
From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes.
The most common ones are the *UF-* ...
- 45.7k
1
vote
0
answers
573
views
Relationship between "Entropy" and "Security" in crypto functions
There is a lot of confusion between "entropy" and "security" of a cryptographic function.
I like to visualize it as the entropy being the water, and the crypto function being a glass.
So for ...
- 533
5
votes
1
answer
2k
views
IND-CPA security of CTR mode
Let's suppose CTR mode is instantiated such that the input to the block-cipher is $\langle \mathrm{IV}+\mathrm{ctr}\rangle$ instead of $\mathrm{IV}\mathbin\|\langle \mathrm{ctr}\rangle$, where $\...
- 53
1
vote
1
answer
993
views
random oracle model vs standard model vs selective model
Can someone clearly outline the main difference between each of the three security models:
random oracle model
standard model
selective model
This post What is the "Random Oracle Model" ...
- 39
2
votes
0
answers
65
views
Security aspects of a splitted Pohlig-Hellman system
Given a Polig-Hellman (is that really the name for that?) system with
$$C = M^k \bmod p$$
where $M$ is the message, $C$ is the ciphertext, $k$ is a (secret) key (any integer relatively prime to $p-1$...
- 185
5
votes
0
answers
190
views
Explanation of the term "view" for algorithm or adversary
What is the view of an algorithm/adversary? Is view just a term used to describe the output over a set of inputs for a probabilistic algorithm?
For example:
Consider experiment Mac-forgeA,Π (n). ...
1
vote
2
answers
467
views
Why don't we have 256-bit security level digital signature schemes (in common use)?
Recently (2016) I've been researching on post-quantum digital signature schemes, and read about BLISS, BLZZRD, REBLISS schemes. What I've noticed about them is that they lack a parameter set for 256-...
- 9,001
4
votes
1
answer
674
views
Can you help me understand indistinguishably as described in the CPA security definition?
When I read the definition of the CPA indistinguishably encryption scheme, I see that the adversary can use an oracle as many times (to get as many encryptions of any messages it choose). An the end ...
- 373
31
votes
1
answer
2k
views
Uniform vs discrete Gaussian sampling in Ring learning with errors
The Wikipedia article on RLWE mentions two methods of sampling "small" polynomials namely uniform sampling and discrete Gaussian sampling. Uniform sampling is clearly the simplest, involving simply ...
- 589
12
votes
2
answers
8k
views
Definitions of secrecy
I found terms like "forward secrecy", "future secrecy", "backwards secrecy" and "perfect forward secrecy" and I would like to know their definitions and to understand the differences among them.
I ...
- 1,248
8
votes
1
answer
166
views
Definition of secure computation with more that two parties
In Definition of secure computation in m-party case with respect to semi-honest adversary (Definition 7.5.1 in Foundations of Cryptography: Volume 2, Basic Applications by Oded Goldriech) we say ...
- 398
1
vote
2
answers
1k
views
What is the non-programmable random oracle model?
I would like to know the difference between the random oracle model and
the non-programmable random oracle model. What is the difference?
5
votes
1
answer
190
views
Parameterizing adversaries with security parameters
In many cryptographic games, the adversary doesn't seem to be parameterized by the security parameter.‡ Are such games equivalent to variants in which the adversary is parameterized by the security ...
- 357
2
votes
2
answers
773
views
An example of of an information theoretically secure protocol that is not cryptographically secure
Does there exist a protocol $\pi$ for some functionality $F$ which is information theoretically secure protocol that is not cryptographically secure for some threshold number of corrupt parties? ...
- 540
11
votes
3
answers
2k
views
How to prove the security of block ciphers
I see very often proofs of security for asymmetric crypto algorithms, for instance, using reductions to known hard problems, or game based proofs...
In the field of protocols (like authentication) it ...
4
votes
2
answers
323
views
On the security definition of password-authenticated key exchange
I found in all PAKE papers, the security is defined as something like this:
Let $Succ(A)$ be the probability that an attacker $A$ successfully distinguished the session key from a random string. Then ...
- 915
1
vote
1
answer
741
views
Are the definitions of IND-CCA secure and of IND-CCA secure under standard model identical?
Suppose there is a public key cryptosystem based on the discrete logarithm problem and let this cryptosystem be IND-CCA secure under standard model. Does this statement mean that the given ...
2
votes
0
answers
62
views
Quantifying bit security for smart-vercauteren encryption scheme
I am working on project that requires to compare in terms of security between two encryption schemes, one of them is the SV scheme. However, I dont know what are the steps exactly towards quantifying ...
7
votes
2
answers
215
views
Confusion about definition of homomorphic encryption
I am trying to better understand homomorphic encryption, but I feel like I keep getting inconsistent information in the papers that I am reading.
One of the papers I am reading says the following:
...
- 173
4
votes
1
answer
177
views
Is there an example of a “robust, yet not private” SMC protocol?
I have been trying to understand the interplay between robustness and privacy of an SMC protocol. It is easy to come up with a protocol that is private but not robust.
Can someone provide an example ...
- 540
0
votes
0
answers
31
views
Value of security through amiguity?
Let's say that you have a symmetric cipher which takes in an 8 bit plain text value and a key, and generates cipher text which can be decoded using the key to get the original plain text value.
Since ...
- 530
2
votes
1
answer
173
views
"Security" of SHA functions (Wikipedia), what does it mean?
Wikepedia's table Comparison of SHA functions mentions "Security(bits)" for some SHA functions. From the ratio (Output size (bits): Security(bits)), I feel it is something like "collision resistance". ...
- 318
7
votes
2
answers
4k
views
Difference left-or-right CPA security, IND-CPA security
I am trying to understand the notion of left-or-right-CPA (LOR-CPA) security for private-key encryption schemes introduced in my lecture. If I understood it correctly so far, the only difference to ...
- 391
10
votes
2
answers
5k
views
Example of a PRP that is not a strong PRP
The exact definition of security for a pseudorandom permutation is straightforward - for some encryption scheme $E\,\colon\,\mathcal{K}\times\mathcal{D}\rightarrow\mathcal{D}$, it must be the case ...
- 4,626
4
votes
0
answers
871
views
Can a secure MAC break if the adversary is given oracle access to Verify?
In the Mac-forge experiment, the adversary is given access to a tag-generation oracle, which generates a tag for each message given by the adversary. The adversary's task is to generate a valid tag on ...
- 141
4
votes
0
answers
2k
views
What is the difference between mutual authentication and unilateral authentication both ways?
I am currently reading Engineering Security by Peter Gutmann, on page 7 he states:
proper
mutual authentication is quite different from unilateral authentication in both directions
He references ...
4
votes
1
answer
424
views
What is the relevance of "physical layer security" to cryptography?
I found that there are quite some active research activities in a field named "physical layer security", with in particular some types of codes that apparently are different from those commonly ...
- 1,312
6
votes
1
answer
681
views
What is the difference between RCCA and CCA2?
Well, I know it's easy to tell CCA1 from CCA2, but I failed to find the difference between RCCA and CCA2.
What is the difference?
- 61
1
vote
2
answers
2k
views
Random Coin Flip
Quoting an old question:
Consider the following protocol for two parties A and B to flip a fair
coin (more complicated versions of this might be used for Internet
gambling):
A trusted ...
- 89
3
votes
1
answer
981
views
What is the difference between CPA and IND-CPA?
I am writing a paper and I got comments from the reviewer that I don’t really understand.
Is there any difference between a CPA (Chosen Plaintext Attack) and IND-CPA (Indistinguishability under ...
- 39
4
votes
1
answer
405
views
Do Curtmola et al.'s IND-CKA1/2 security definitions protect against search pattern leakage?
In the
article Searchable Symmetric Encryption:
Improved Definitions and Efficient Constructions, Curtmola et al. propose adaptive and non-adaptive (indistinguishability and simulator-based) security ...
- 71
10
votes
2
answers
1k
views
Key Size for Symmetric Homomorphic Encryption Over the Integers
In the paper Fully Homomorphic Encryption over the Integers, it mentions a symmetric key scheme on page 1 and 2.
Key Generation: Pick a random odd number $p \epsilon [2^{N-1},2^N)$
Encrypt A Bit m: $...
- 530
5
votes
1
answer
1k
views
Why is the definition of Special-honest verifier zero-knowledge probabilistic?
Let $P$ be a prover willing to prove to a verifier $V$ that he knows a witness $w$ satisfying $(x,w) \in R$ for some relation $R$ and some common input $x$.
As found in the literature, $P$ can use a $...
- 1,346
3
votes
1
answer
251
views
What does “simulator” and “interactive” mean in a cryptographic credential system's definition of security?
Definition 1 on Page 7 of “An Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation” by Camenisch and Lysyanskaya, uses the term “simulator” in defining the ...
- 155
1
vote
1
answer
8k
views
What is a man-in-the-middle attack (for instance in Diffie-Hellman)?
I'm new to cryptography and I just started learning about the Diffie-Hellman key agreement. I read that this system is vulnerable to a man-in-the-middle attack when used alone. What kind of attack is ...
- 13
12
votes
4
answers
3k
views
Is the one-time-pad a secure system according to modern definitions?
Occasionally I hear people say that one-time pads are "useless" or even "broken".
"modern cryptography knows more security definitions, under some of
which the one-time pad is completely broken."
...
- 5,594
1
vote
1
answer
398
views
Correctness in Multi-party Computation: Real/Ideal Paradigm in Malicious case
I need to know:
1- What does exactly correctness mean in this context?
2- How is correctness implied in malicious model?
3- If the correctness means " the adversary cannot cause the output to be ...
- 805
4
votes
1
answer
787
views
Hard-core predicates: should the adversary be given $1^n$?
In most (all?) classical sources such as the book of Goldreich (2001), hard-core predicated are defined thus:
A polynomial-time computable predicate $b : \{0,1\}^* \to \{0,1\}$ is a hard-core of a ...
- 8,082
0
votes
0
answers
51
views
Outsourced Multiparty computation proof in Ideal world
I need to know in an outsourced two party computation where honst $A$ and $B$ outsource their private and secure data to a malicious server, why we need to design a simulator that interacts with an ...
- 1,573
0
votes
0
answers
68
views
Role of trusted party in the Ideal model in Malicious case
Imagine there is a protocol supporting outosurced multi party computation. There are three parties involved in the protocol: client $A$, client $B$ and a server. Client $A$ and $B$ send their private ...
- 1,573
3
votes
3
answers
3k
views
When is a cipher considered broken?
We've all read how some people claim AES is broken because there was supposedly a way to get the plain text from a cipher text faster than brute-force. But is this the definition?
Is a cipher broken ...
- 966
0
votes
1
answer
857
views
Is adaptive security the same as full security?
This question contains a great answer about adaptive security, but I haven't yet found a proper definition what full security is. Does a stronger security than adaptive security exist or are the two ...
- 2,045
19
votes
3
answers
33k
views
What is the difference between uniformly and at random in crypto definitions?
Very often in the description and analysis of a cryptographic protocol there is a need for a an element $k$ that is sampled
uniformly AND at random.
Is there a redundancy in the definition with ...
- 6,140
0
votes
2
answers
637
views
What would be the best plain text Cryptography method without the use of a computer? [closed]
What would be the best Cryptography method without the use of a computer?
This could be a list of the current options available, that could be used without
the use of a computer system/electronic ...
- 103
3
votes
2
answers
530
views
What, cryptographically speaking, is a "long message"?
I have read about long message attacks on some cryptographic hash functions. However, I don't quite understand what is being referred to as a "long message".
Also, do long message attacks only apply ...
- 101
8
votes
1
answer
3k
views
Understanding Twist Security with respect to short Weierstrass curves
I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves.
That section claims ...
- 6,904
8
votes
2
answers
2k
views
What is a q-type assumption?
I've seen the term "$q$-type assumption" used in a few papers without a definition. A Google search doesn't seem to come up with anything useful either (except the same papers without a definition). ...
- 375
3
votes
1
answer
169
views
Bridging the gap between security proofs and "real-world" security
I've been studying cryptography for a little while. I understand fairly well the nuts and bolts of security proofs, but I'm having trouble reconciling the formal statements of security in these proofs ...
- 4,626
0
votes
1
answer
2k
views
Security properties and Cryptography objectives applied in algorithms
We all know there are five properties of Security. They are:
Confidentiality
Availability
Authorization
Integrity and
Provenance
As Security and Cryptography are co-related these properties also ...
- 597