# Tag Info

15

I hope I got your point and try to answer your question. Actually, if I understand you right, then what you call an attack actually means an adversary acting in a specific attack model. To clarify this, we need to review the security models for digital signature schemes and when we have discussed this we can clarify issues. Basically, we have to discuss ...

7

We begin with the probability $p$ of an adversary answering correctly. For many problems in cryptography, such as factoring or computing discrete logarithms, finding a secret key or decrypting a plaintext, this is useful measure of how good the adversary is. If we have an adversary that can compute discrete logarithms with significant probability, that is ...

7

I think usually companies use very standard and popular schemes that are known already to the cryptographic community since using a totally unknown scheme might have a huge data leakage which the company was not able to discover. Definitely. And remind yourself that implementing cryptography is hard as well. Self made schemes may have side channel attacks, ...

6

As the previous answer says, they are certainly NOT the same. However, there is certainly a connection between them. Specifically, the covert model just says that there is a deterrent parameter $\epsilon$ and the guarantee is that if the adversary tries to cheat then it will be caught with probability at least $\epsilon$. The question that arises is how ...

5

It certainly wouldn't make sense for the challenger to provide the coins. If you are working with non-uniform adversaries, then you can assume that the adversary is deterministic. This is due to the fact that $BPP \subset P/poly$. Intuitively, a non-uniform adversary can receive as "advice" the best random coins that maximize its probability of winning the ...

5

It depends on the situation. In crypto, we tend to think of a passive adversary (Eve) as someone who is able to listen to all communications sent between two parties, (Alice and Bob). So, you create a security goal based on the "power" of your adversary. If all that Eve is doing is listening on communications, then Alice and Bob need to ensure that Eve ...

5

Just wrapping my comment into an answer as it seems to be what you're looking for… CryptoVerif can be used for verification of security against polynomial time adversaries in the computational model. It's available via http://prosecco.gforge.inria.fr/personal/bblanche/cryptoverif/cryptoverifbin.html Related to your "it doesn't work on my computer", here's ...

5

None of the above answers seem to take into account that you apparently want to establish security with respect to the eCK model; the above answers are mostly about tools that verify some (related but different) properties. Afaik, there is current no automatic tool that can give you analysis with respect to the exact eCK model. In the symbolic setting, ...

4

I could add to the list (in alphabetical order): Casper (http://www.cs.ox.ac.uk/gavin.lowe/Security/Casper/) Proverif (proverif.di.ens.fr/index.php) Scyther (http://people.inf.ethz.ch/cremersc/scyther/)

4

I can highly recommend AVISPA, a tool for automated verification of cryptographic protocols. It is available as a web service, so you can upload a description of your protocol to their web server and it will give you a security analysis of it. They have detailed documentation of how to use their system and of their specification language for protocols, so ...

4

The equation $t'=t+n\cdot t_c$ is an estimation to put an upper limit on $t'$. It might be possible that an attacker $A'$ can use a different, more efficient algorithm. But since the attack will work with using $A$, there exists an attacker $A'$ with at most $t'$. This means it's actually not an equation, but an inequality $t' \leq t + n \cdot t_c$. And then ...

4

Advantage and success probability are just words. Their meaning is in practice decided by how the speakers of the language use the words. You have observed that people use the terms advantage and probability in this way. One could probably argue that this is confusing or illogical or something like that, but such is language. About dividing by two: remember,...

4

In the vast majority of cases, the simulator sets the random tape of the adversary simply because it has to (by the definition). So, the simulator sets it in the beginning to be uniform, and this is then ignored from then on. There is one cases that I know of that this is actually really important, and this is non-black-box zero knowledge. Specifically, in ...

4

We want to prove that $\Pi$ is CPA secure $\Rightarrow$ $\Pi'$ is CPA secure. So, let's prove it using the equivalent contrapositive proposition: $\Pi'$ isn't CPA secure $\Rightarrow$ $\Pi$ isn't CPA secure. So, it means we have to suppose that there is an adversary $\mathcal{A'}$ that can win the CPA-game of $\Pi'$ with non negligible probability and ...

4

I think what you are looking for is an adversary that has access to a quantum computer, and is efficient (i.e., runs in polynomial time -> independent of the property it tries to attack). In this case, the common way to model the adversary is just as a polynomial time quantum algorithm. Note, it depends on the security model for the property that the ...

4

There is a close connection between covert adversaries and selfish ones. In particular, if you know the utility function of the selfish adversary, then you can compute the deterrent factor that you need for covert adversary. However, it is important to note that the model of covert adversaries considers corrupt and honest parties, where here corrupt would ...

3

(a) Adaptive case: To show that the adversary can get a very large advantage, send an arbitrary query $x$ to the oracle. The left part of the response is the input of the second query. If the oracle is a PRF, the left part of the second response equals the right part of the first response. If the oracle is a random oracle the two parts are not equal with a ...

3

Your understanding is correct. There is no particular significance to $m_1$ being all zeroes, it is just a simple and convenient way to ensure that the inputs to $F_k$ will be all distinct, which is what we need in order to produce a pseudorandom string.

3

If I'm interpreting section 2.2 correctly, the "optimal Eve" $O_E(\theta_A) = argmin_{\theta_E}(L_E(\theta_A, \theta_E))$ is actually allowed to see Alice's parameters $\theta_A$. The training of Alice and Bob is, in plainer (and rougher!) terms, trying to solve this question: what are the best choices of $\theta_A$ and $\theta_B$ such that if: We reveal $\... 3 The adversary should definitely always be "allowed to know" the security parameter. In other words, a security definition should allow the adversary's behavior to depend on the security parameter. This can be accomplished either by quantifying the adversary after the security parameter is chosen, or by letting the security parameter be an explicit input to ... 3 No they are different. A covert adversary is essentially just a relaxation of a regular malicious adversary. Rational cryptography, on other the hand, is a different way of analyzing a cryptographic scheme using game theory. Here the parties of a protocol are seen as rational in a game theoretic sense acting according to some utility. I am not very well ... 3 Memory of the first round can't help the attacker win the second round. If it could: the attacker could simulate the first round on his own (picking his own key, pretending to play the game against himself), and then play the second round against the challenger. So, adversaries like this are not stronger -- not even if they have memory. 3 I believe what you are describing is somewhat orthogonal to typical MPC adversary models. Typically in MPC we let the adversary know all information that corrupt parties know (so if a corrupt party learns the output, the adversary is allowed to learn the output). What we care about in MPC protocols is that the adversary is not able to learn any additional ... 3 For your question: In this case, he will guess the bit b with probability 1/2. // Why?, I guess this is the point of your proof which is making you doubt it? This is simply the probability to guess correctly the value of$b$when you are doing it completely at random: the bit$b$can only take two values,$0$and$1$, so if you try a "wild guess" you have ... 3 This is not correct. It could be not binding since you can open a commitment into two options. You can quite easily construct such a scheme artificially. For example, take any perfectly binding scheme$C_b$and any perfectly hiding scheme$C_h$. Then, commit to a message$m$by committing to$C_b(m)||C_h(0)$or by committing to$C_b(\overline{m})||C_h(1)$. ... 3 What you are asking for is not possible, not even if you ask for passive security. Here is a sketch of a proof. Suppose for sake of contradiction you have an$n$-party MPC protocol$\Pi$for$f(x_1, \ldots, x_n) = x_1 \land x_n$, where the$x_i$'s are bits. This protocol is secure against a computationally unbounded adversary who can passively corrupt$\ge n/...

2

PFS, or perfect forward secrecy, is a desirable (in many cases) property for cryptographic protocols. It says that even if your long-term secret (or static key in the paper) is revealed at some point, messages sent in the past should still be kept secret. Right after that line you quote, they define their PFS game. I'll reword it here to make it more ...

2

The traditional MPC definition of correctness has no notion of correctness on the inputs. The traditional MPC correctness property deals with the output, i.e., the protocol is correct if $y$ where $y=f(x_1,x_2,\dots,x_n)$ is guaranteed to be output. What the $x_1,\dots,x_n$ values are is completely up to the inputting party. So, if you want to check that ...

2

It means exactly what is written, the advantage of the adversary is a quantity which is defined as the difference between the probability that $b = b'$ and $1/2$. For example if the probability that $b = b'$ is $3/4$, then the advantage of the adversary is $3/4-1/2 = 1/4$.

Only top voted, non community-wiki answers of a minimum length are eligible