Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [terminology]

Questions about the meaning and proper use of specific technical terms or notation within cryptography.

5
votes
2answers
95 views

What do NM-CPA, and NM-CCA mean?

When I've been researching authenticated encryption, the following terms keep showing up: NM-CPA NM-CCA ....without any definition as to what they mean. I've tried searching the web for their ...
0
votes
1answer
60 views

How should one refer to the smallest remainders generated by a modulus within DH or DLP?

It's my understanding that the integer base and exponents chosen to create the initial public keys in DH are from the remainders of a modulus. For example, if the value of the modulus is $N=11$, a ...
8
votes
2answers
703 views

What is meaning of the term “language”?

I don't have much formal background, and I could not find a suitable explanation for this after searching on Google/Wikipedia. What is the meaning of the term "language" as used in cryptographic ...
13
votes
2answers
358 views

Does GCM (or GHASH) only provide 64-bit security against forgeries?

In a recent comment a doubt was voiced about my answer, which claims GCM to requires $2^{128}$ for a successful forgery. The doubt was that the square root needs to be taken meaning the security would ...
0
votes
1answer
73 views

The meaning of formal and semi-formal in cryptography

The question is about "formal" analysis, proofs, etc... What is a correct definition of a formal proof, or a formal analysis? Is there a good way and a bad way to formally prove something. What is the ...
2
votes
3answers
76 views

Terminology: Is a block cipher in counter mode still considered a block cipher or is it classified as a stream cipher?

I'm confused about what terminology to use. I see people referring to such a cipher-MOO combination using both terms.
1
vote
0answers
78 views

What is meant by the term “hostile environment”? [closed]

I come across many time a term called ”hostile environment” in cryptographic literature. What does “hostile” mean exactly? Is it unknown third parties which are responsible for handling and routing ...
3
votes
2answers
159 views

What does the term “nontrivial rotation” mean?

The paper “Gimli: a cross-platform permutation” contains the following information: Occasionally (after rounds 24, 20, 16, etc.) Gimli adds an asymmetric constant to entry 0 of the first row. ...
15
votes
2answers
2k views

What is the difference between TRNG and CSPRNG?

I understand the output of a TRNG is almost impossible to reproduce, such a flipping a coin 100 times to produce a 100-bit sequence. However, it is also my understanding that a CSPRNG produces an ...
6
votes
1answer
727 views

What does “seed” mean in cryptography?

I have come across "seed" many times, and at each time, it confuses me more and more. I think it has a well-known meaning in cryptography, so what is it? They can usually use the limited number of ...
1
vote
1answer
66 views

Why every access structure is a multipartite access structure?

The set of authorized subsets of participants is called an access structure. In a multipartite access structure, the set of participants is divided into several parts and all participants in the ...
-1
votes
1answer
45 views

Which of these deductions are true about the simulator and the adversary?

Which of these deductions make sense? The simulator is actually being run by the adversary. It makes sense that the adversary initializes the simulator (which is just a program) with the input that ...
1
vote
1answer
76 views

In “Lecture Notes on Cryptography” what does “PTM” mean?

I came across a handbook named "Lecture Notes on Cryptography" from Shafi Goldwasser and Mihir Bellare and I read their definition 3.1 about poly-time indistinguishability: Let $X_n,Y_n$ be ...
2
votes
1answer
56 views

The Collision Differential for MD4 - a question on notation (Wang, et al)

In the paper "Cryptanalysis of the Hash Functions MD4 and RIPEMD" the authors introduce the following notation (paragraph 4.1): $\Delta$$H_0$ = 0 $\xrightarrow{(M_,M')}$ $\Delta$$H$ = 0 What exactly ...
5
votes
1answer
105 views

What kind of information in cryptography is called semantic information?

I have been studying cognitive cryptography from this article. Its definition of cognitive cryptography is: Cognitive cryptography is a division of cryptography within which any information set ...
2
votes
0answers
53 views

Asymmetric encryption property required in an authentication protocol

We want to choose an asymmetric encryption scheme for use as follows: A device holds its private key, with the corresponding public key known and trusted by all. The device also holds a small $b$-bit ...
19
votes
2answers
5k views

Is there any difference between cryptography and cryptology?

Is there a difference between cryptography and cryptology, if any? An internet search suggests that both terms can be used interchangeably.
14
votes
1answer
2k views

What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?

When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n. Since both point to similar constructions (read: hashing algorithms with the same ...
1
vote
1answer
49 views

What is the name of this method?

Say I have a $26\times 26$ matrix $M$, each column$C_i$ of which contains the numbers from 1 to 26 in a random order. To encrypt a word, I take the first letter (e.g., b), convert it to its index $i$ (...
7
votes
2answers
209 views

Functional difference between stream cipher, XOF, seed expander, KDF, etc

This question is a request for terminology clarification. In a canonical XOF interface, the output can be extended as much as needed, but does input has to be variable-length or can be fixed-length ...
2
votes
0answers
102 views

Formal taxonomy for cryptographic vulnerabilities

There are several areas in which cryptographic vulnerabilities can be introduced. Length extension attacks are inherent to hash functions using Merkle–Damgård. Heartbleed was a vulnerability caused ...
3
votes
1answer
59 views

Is a signature scheme using a hash considered a hybrid cryptosystem?

In Wikipedia there is a page on hybrid cryptosystems. However, although cryptography contains a lot more than just encryption, only hybrid encryption using key encapsulation and data encapsulation is ...
0
votes
1answer
86 views

Discrete Logarithm Notation

Im studying for my final, and some of the practice problems that I have found have discrete logarithms in this notation $L_n(p)$. What does this notation equate to? For example:
4
votes
1answer
126 views

What is the “standard model” for block ciphers?

In this paper and this the authors speak of a "standard model". What is the "standard model"? How does it differ from the "ideal model"? Why does the decision to use it or the "ideal model" impact the ...
1
vote
3answers
146 views

Would this hash functionality fall under pre-image resistance or collision resistance?

I understand that there are three main security requirements for hash functions, pre-image resistance, second pre-image resistance and collision resistance. I need to write about a hash function that ...
3
votes
1answer
913 views

What exactly is a “security parameter”?

I often encounter the term “security parameter” when I read crypto related stuff. My basic understanding is that it just denotes some bit-length however, I'm not so sure. For example, when it says ...
37
votes
1answer
4k views

What is “Fast Prime”?

In this note, the manufacturer of a RSA key generation gizmo vulnerable to the new ROCA attack (see second section) explains that it is common practice to employ acceleration algorithms in order to ...
4
votes
3answers
177 views

Why are processes requiring (almost) as much work as brute force considered an “attack” on a hash function?

In the literature on attacks against hash functions, I frequently come across algorithms requiring $2^n$ work described as being preimage or collision "attacks" on a hash function with only marginally ...
0
votes
2answers
223 views

Components of Cryptanalysis

What are different components of Cryptanalysis. I can't seem to find them. Are they the same as Cryptosystem or is there any difference.
24
votes
2answers
11k views

What is the difference between a digest and a hash function?

I was wondering about the difference between these two terms... What is the difference between a digest and a hash function?
3
votes
1answer
135 views

Idiomatic description for an adversary in possesion of a quantum computer?

I was wondering what the "accepted" way is to describe an adversary who: is in possession of a quantum computer with which they can efficiently run quantum algorithms such as Grover's or Shor's ...
7
votes
4answers
1k views

When is an RNG a CSPRNG, a CSRNG, or a TRNG?

In a recent answer to a question about CSPRNGs, it was stated that… Nondeterministic algorithms where there is no such requirement, and ideally could be replaced by a true random generator. ...
5
votes
1answer
683 views

Key Exchange & key Distribution in symmetric key cryptography

I want to know whether there is a difference between key exchange & key distribution in private key cryptography as well as public key cryptography? or is it the same term?
4
votes
1answer
216 views

What kind of encryption function is also used for decryption?

Is there a name for the particular type of encryption algorithm or function which is the same algorithm or function used for decryption? This is a vocabulary question, because I'm largely unfamiliar ...
1
vote
1answer
43 views

What is mac-and-continue?

I've seen the term mentioned in a paper by the Keccak team here, and by Adam Langley here when talking about properly authenticating stream ciphers. What does it actually mean, and how does it work? ...
3
votes
1answer
103 views

What is a nonce-respecting adversary?

The NORX8 paper says It is assumed that adversaries are nonce-respecting. What is a nonce-respecting adversary?
6
votes
1answer
820 views

Boolean Circuits vs Arithmetic Circuits

I am just wondering what's the differences between boolean circuits and arithmetic circuits? I know the basic notions of circuits. My question is their applications in cryptography. For example, why ...
2
votes
1answer
1k views

“128-bit security” or “128 bits of security”?

Maybe a silly question but I am wondering what the correct way to specify a security level is: 128-bit security 128 bits of security Something else entirely
1
vote
1answer
150 views

Impossibility vs implaussiblity

What is the difference between implausibility vs impossibility in the context of Crypto? I came to know that differing input indistinguishability Obfuscation (diO) implausibile but not impossible. Can ...
6
votes
2answers
405 views

What's the difference between word-oriented and byte-oriented ciphers?

I am currently learning about the RC4 cipher and its improved version called Spritz. The paper of Spritz says We do not consider other stream-cipher proposals here, and expect that for many ...
0
votes
0answers
122 views

Why do we always prove cryptographic protocols via completeness and soundness?

Most of the proofs that I have seen for cryptographic protocol include completeness and soundness. Why do we always prove completeness and soundness? Why do we not also see other propertes such as "...
2
votes
1answer
1k views

AES-GCM — what is ICV and what happens if I don't use it

I am interested in using AES-GCM and after hours of reading on Internet I still have a few questions: What will ensure the ICV, is it only Integrity ? If I don't need it on my purpose, can I spare it ...
8
votes
2answers
348 views

What is the official, generally accepted definition of “lightweight crypto”?

I frequently stumble upon the term "lightweight crypto". It tends to be used is a for special algorithms that use less resources, for constrained systems. Yet, it's somewhat unclear to me where to ...
15
votes
1answer
3k views

What do the signature security abbreviations like EUF-CMA mean?

From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes. The most common ones are the *UF-* ...
5
votes
1answer
153 views

Is there a name for encrypting a decimal number using a one time pad?

I asked a question somewhere else on stack exchange and had to put something like "using the numerical one time pad the user can create their encrypted message by hand". Is there a better way of ...
7
votes
2answers
491 views

Why is the polynomial of an LFSR called so?

As far as I understand, the "polynomial" of the LFSR tells us the positions of the register where taps are situated. However, the natural way to look at the positions would be to think of them as $...
8
votes
2answers
987 views

What is a “witness” in zero knowledge proof?

I've seen the term "witness" tossed around when talking about knowledge extractors, but I have no idea what it means. I can't find a definition. What is a “witness” in zero knowledge proof?
9
votes
1answer
1k views

“Seed” vs “seed key”

The FIPS 140-2 Derived Test Requirements has a statement: AS07.09: (Levels 1, 2, 3, and 4) The seed and seed key shall not have the same value. What is the difference between a seed and a "seed ...
18
votes
2answers
2k views

What does “birational equivalence” mean in a cryptographic context?

In a recent question on using the same curve for signing and ECDH it was noted for the Ed25519 curve and Curve25519: Nitpick: the curves are birationally equivalent, not isomorphic. Now this term ...
2
votes
2answers
866 views

Why is ISAAC not a pseudo random number generator?

I have been accused of confusion over the nature of the ISAAC algorithm. The bulk of evidence suggests that it is a cryptographically strong pseudo random number generator. By bulk I mean the number ...