Questions tagged [terminology]

Questions about the meaning and proper use of specific technical terms or notation within cryptography.

Filter by
Sorted by
Tagged with
68 votes
1 answer
34k views

Easy explanation of "IND-" security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
SEJPM's user avatar
  • 45.9k
32 votes
1 answer
9k views

What do the signature security abbreviations like EUF-CMA mean?

From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes. The most common ones are the *UF-* ...
SEJPM's user avatar
  • 45.9k
172 votes
2 answers
182k views

What is the main difference between a key, an IV and a nonce?

What are the main differences between a nonce, a key and an IV? Without any doubt the key should be kept secret. But what about the nonce and the IV? What's the main difference between them and their ...
curious's user avatar
  • 6,150
54 votes
6 answers
12k views

Kerckhoffs’ principles – Why should I make my cipher public?

As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that A cryptosystem should be secure ...
rath's user avatar
  • 2,548
61 votes
3 answers
57k views

Definition of textbook RSA

What is the definition of textbook or "raw" RSA? What are some of the properties of textbook RSA? How does it differ from other schemes based on RSA?
Bobby S's user avatar
  • 1,943
14 votes
2 answers
2k views

Does GCM (or GHASH) only provide 64-bit security against forgeries?

In a recent comment a doubt was voiced about my answer, which claims GCM to requires $2^{128}$ for a successful forgery. The doubt was that the square root needs to be taken meaning the security would ...
SEJPM's user avatar
  • 45.9k
40 votes
1 answer
41k views

What is Attribute Based Encryption?

Can someone explain what attribute based encryption is? I was searching for a book or something that can help me in this regard but so far I have found none. Google also returns practically nothing ...
Mark's user avatar
  • 403
39 votes
5 answers
31k views

What is the difference between CSPRNG and PRNG?

What is the difference between CSPRNG and PRNG? Is there performance differential between them? For example: We use PRNG for key generation which is very expensive and CSPRNG for IV/nonce in block ...
randomness's user avatar
40 votes
8 answers
55k views

Simply put, what does “perfect secrecy” mean?

I would like to ask for a clear (but maybe not so deep) explanation of what the term "perfect secrecy" means. As far as I have researched and understood, it has to do with probabilities of assuming ...
Emyr's user avatar
  • 551
25 votes
2 answers
3k views

Definition of "pepper" in hash functions

I am confused about the notion of "pepper" in the context of storing hashes of users' passwords. Definition 1: A pepper is a secret key Looking around the Internet, for example here or here, ...
Malte Skoruppa's user avatar
46 votes
1 answer
7k views

What is a "freestart collision"?

In their work on SHA-1 collisions (cf. the EUROCRYPT-2016 paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ...
otus's user avatar
  • 32.1k
34 votes
1 answer
28k views

What is a Pedersen commitment?

I couldn't find any answer providing a high-level overview on what Pedersen commitments are or what they are used for.
Paul Razvan Berg's user avatar
25 votes
4 answers
22k views

The exact difference between a permutation and a substitution

I've noticed confusing definitions about permutation and substitution, preventing me from understanding the difference. A permutation changes the order of distinct elements of a set, but this can be ...
Dingo13's user avatar
  • 2,847
19 votes
3 answers
10k views

What's a cryptographic primitive, really?

The more I encounter the term "cryptographic primitive," the less I feel confident that I truly understand what it means. Is it just me, or is there no universal definition for the term? Or does the ...
Luis Casillas's user avatar
6 votes
1 answer
5k views

What exactly is a “security parameter”?

I often encounter the term “security parameter” when I read crypto related stuff. My basic understanding is that it just denotes some bit-length however, I'm not so sure. For example, when it says ...
SpiderRico's user avatar
46 votes
3 answers
27k views

What are the differences Between “White-Box Cryptography” and “Code Obfuscation”?

I have been reading the question "What is a white-box implementation of a cryptographic algorithm?" and it led to this short article / Q&A which states in question 2: Q2: What is the ...
MByD's user avatar
  • 688
15 votes
8 answers
7k views

Can I say "I have encrypted something" if I hash something?

As I understand it, a hashing algorithm is some kind of encryption, just a specific kind of it. So is it wrong to say "I encrypted this value." if I "only" hash it? I understand that it gives the ...
Johannes Rabauer's user avatar
10 votes
4 answers
3k views

Does a hash function necessarily need to allow arbitrary length input?

I always assumed that a hash function allows input of arbitrary length, since that's what all the hash functions I was aware of did. Wikipedia's definition of a hash function is as follows: A hash ...
MechMK1's user avatar
  • 445
10 votes
1 answer
4k views

What is “Implicit Authentication”?

What is “Implicit Authentication” in the context of authentication methods? I searched the Web but could not find any article that describes this. If anyone can describe it, that would be a great ...
Dilini's user avatar
  • 203
8 votes
2 answers
2k views

What is modulo switching, in a nutshell?

Coupled with the terms bootstrapping and relinearization, the term modulo switching appears a lot in the FHE literature. What is it and how does it relate to the other two?
Daniel's user avatar
  • 3,932
148 votes
1 answer
233k views

What are the differences between .pem, .csr, .key, .crt and other such file extensions?

I'm new to SSL / TLS, and I want to work with the OpenSSL toolkit. What do .pem and .csr stand for? I do know that ...
Richard R. Matthews's user avatar
16 votes
6 answers
3k views

How exactly is "true randomness" defined in the realms of cryptography?

Especially in relation to stream ciphers, I frequently read about (sometimes theoretical, sometimes practical) attacks that are able to "distinguish a ciphertext from a truly random stream". What's ...
e-sushi's user avatar
  • 17.9k
16 votes
2 answers
27k views

SHA-256 "almost unique"?

I have seen numerous references on the internet of people describing SHA-256 as generating an "almost unique" hash. Exhibit A. there are more. Is there some mathematical basis to the almost ...
El Ronnoco's user avatar
10 votes
1 answer
11k views

What is a trapdoor permutation?

Can anyone explain to me what a trapdoor one-way permutation is? Is RSA a trapdoor one-way permutation? Context: I was reading about ring signatures. On page 560, it describes steps to implementing ...
user1812844's user avatar
10 votes
1 answer
1k views

How distinct are the meanings of the terms "CSPRNG," "DRBG" and "stream cipher"?

Are there universal, consensus definitions for the following terms? Cryptographically secure pseudo-random number generator ("CSPRNG") Deterministic random bit generator ("DRBG") Stream cipher This ...
Luis Casillas's user avatar
7 votes
1 answer
3k views

What is a fair exchange scheme?

The Wikipedia entry Fair exchange has only two lines, and the only paper I can find describing such a protocol is extremely complicated. Is this a new field in cryptology or can someone give an ...
Maestro's user avatar
  • 1,069
6 votes
1 answer
8k views

Simulation-based security?

I've been reading Introduction to Modern Cryptography by Katz and Lindell as an introduction to cryptography. The book seems to use the term 'simulator' when it talks about a game like, for instance, ...
evc's user avatar
  • 61
91 votes
3 answers
58k views

What is the difference between a digest and a hash function?

I was wondering about the difference between these two terms... What is the difference between a digest and a hash function?
sekmo's user avatar
  • 1,021
51 votes
1 answer
20k views

What are SNARKs?

What does it mean and what is it used for, I have been hearing this term a lot lately. From the context I've heard it talked about it seems to be connected with zero knowledge?
wi1's user avatar
  • 613
40 votes
1 answer
5k views

What is “Fast Prime”?

In this note, the manufacturer of a RSA key generation gizmo vulnerable to the new ROCA attack (see second section) explains that it is common practice to employ acceleration algorithms in order to ...
fgrieu's user avatar
  • 140k
34 votes
4 answers
7k views

Are checksums essentially non-secure versions of cryptographic hashes?

Are checksums basically toned-down versions of cryptographic hashes? As in: they are supposed to detect errors that occur naturally/randomly as opposed to being designed to prevent a knowledgeable ...
AlanSTACK's user avatar
  • 1,305
30 votes
2 answers
5k views

What does "birational equivalence" mean in a cryptographic context?

In a recent question on using the same curve for signing and ECDH it was noted for the Ed25519 curve and Curve25519: Nitpick: the curves are birationally equivalent, not isomorphic. Now this term ...
SEJPM's user avatar
  • 45.9k
28 votes
2 answers
25k views

Why is Diffie-Hellman considered in the context of public key cryptography?

In all textbooks I used the Diffie-Hellman key exchange is under "public key cryptography". As far as I can see it is a method to exchange a key to be used with a symmetric cryptographic algorithm, ...
Mr_and_Mrs_D's user avatar
26 votes
5 answers
9k views

What is Indistinguishability Obfuscation?

I've been studying functional encryption. I recently read that a multi-input functional encryption (MIFE) implies indistinguishability obfuscation (IO). Can someone please brief me: what is ...
user avatar
12 votes
2 answers
5k views

What does "circuits" mean in Cryptography?

I am not a hardcore cryptographer so this might be a really stupid question. I am looking through some papers in homomorphic encryption and discovered they describe computation as "circuits", why do ...
Boyu Fang's user avatar
  • 447
12 votes
2 answers
4k views

What does "Worst-case hardness" mean in lattice-based cryptography?

In the wiki page of Lattice-based Cryptography the "Worst-case hardness" is defined as below: Worst-case hardness of lattice problems means that breaking the cryptographic construction (even with ...
Habib's user avatar
  • 951
11 votes
2 answers
2k views

K out of N encryption

A friend just showed me how to combine padlocks to achieve a lock that opens when k out of n people turn their keys. I was ...
Thomas Ahle's user avatar
11 votes
1 answer
2k views

What is Deterministic Authenticated Encryption?

I came across something known as deterministic authenticated encryption in my studies, and a lot of people were associating it with Synthetic IV mode. I am having trouble understanding what exactly ...
winsticknova's user avatar
9 votes
2 answers
534 views

What is the official, generally accepted definition of "lightweight crypto"?

I frequently stumble upon the term "lightweight crypto". It tends to be used is a for special algorithms that use less resources, for constrained systems. Yet, it's somewhat unclear to me ...
e-sushi's user avatar
  • 17.9k
9 votes
1 answer
5k views

What is "Blinding" used for in cryptography?

What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?
tenfish's user avatar
  • 91
9 votes
2 answers
11k views

Definition and meaning of "semantic security"

I'm taking a Coursera cryptography course. The definition of semantic security is hard to understand. I tried to restate it with some slight changes (the word "efficient" was in the original ...
koddo's user avatar
  • 191
7 votes
2 answers
5k views

Non-linearity of a boolean function

What's the definition of non-linearity of a boolean function? Roughly saying it is minimum number of times it equals any affine function. But I don't get it mathematically. For example, if $f = ...
Mahdi Khosravi's user avatar
7 votes
1 answer
2k views

Key Exchange & key Distribution in symmetric key cryptography

I want to know whether there is a difference between key exchange & key distribution in private key cryptography as well as public key cryptography? or is it the same term?
Smita Chaudhari's user avatar
7 votes
2 answers
2k views

zk-SNARKs vs. Zk-STARKs vs. Bulletproofs: definitions

I have become quite familiar with Bulletproofs the last few months. Bulletproofs is the name given to a zero-knowledge proof system for arithmetic circuits, by Benedikt Bünz et al. It is a specific ...
Ruben De Smet's user avatar
6 votes
1 answer
1k views

What is 'key agility' in relation to symmetric-key encryption?

I sometimes see, in discussions of symmetric ciphers, reference to the 'key agility' of a particular algorithm. It seems to be related to the difficulty of switching encryption keys, but I don't ...
pg1989's user avatar
  • 4,636
6 votes
2 answers
24k views

What is the meaning of "trapdoor" in cryptography?

I do not really understand the meaning of a "trapdoor" in cryptography, so here are my questions: What is the meaning of trapdoor and how can I convert a word or string using a trapdoor in ...
shsa's user avatar
  • 71
4 votes
1 answer
3k views

What is adversary's advantage in cryptography and why we use it?

The definition of adversary's advantage seems a bit odd for me and I am wondering why do we use it to measure the power of an adversary rather than just use the probability of a PPT adversary ...
Boyu Fang's user avatar
  • 447
2 votes
1 answer
844 views

What do associated data and message numbers mean?

I'm reading an article about authenticated encryption and don't understand some inputs to an encryption function. They are associated data, public and secret message numbers. Can you explain me their ...
asukaev's user avatar
  • 63
1 vote
1 answer
234 views

One way function existence

Let $x = (x_1, x_2,...,x_n)\in\{0,1\}^n$ for $n\in\mathbb{N}$. Prove that if one-way functions (OWFs) exist, then there exists a one-way function $f$ such that for every bit $i\in[1,n]$ there exists ...
maryam's user avatar
  • 11
-2 votes
2 answers
241 views

Why are there so many stream ciphers out there and even ongoing research?

What make them better than OTP using a CSPRNG initialized with a secret key?
daruma's user avatar
  • 385