People who code: we want your input. Take the Survey
8

Since when decrypting we always want to get the correct message back, there's no reason why we would want to make this ambiguous. It would have no security advantage (if the adversary can guess with any non-negligible probability, you have already lost, so ambiguous decryption can't make that harder). Thus, unlike probabilistic encryption, which is needed ...


6

They are different concepts and have different approaches. AES like any block cipher is a primitive and the encryption is performed by using the block cipher mode of operation. Like ECB,CBC,CTR,GCM,EAX... The pkcs#7 padding or any other padding that is used to fill the last block to the block size with ambiguous remove, not designed for randomization. Even ...


2

Let's look at the definition in the linked thesis: Definition 2.2.2 (probabilistic one-way function). A probabilistic function, $F$ (with randomness domain $R_n$), with a corresponding deterministic verifier, $V_F$ , is called one-way with respect to a well-spread distribution, $\mathbb{X}$, if for any PPT, $A$: $$\Pr\bigl[x \gets X_n, r \gets R_n, V_F\bigl(...


2

But in PKCS#7 people just use the padding size rather than some random bits. Doesn't it make AES deterministic? The padding used for block ciphers is just used to make sure that the plaintext can be split up into message blocks. A few block cipher modes such as ECB and CBC require this due to the way they work. Note that CipherText Stealing (CTS) can be ...


1

Prof. Lindell provides a nice explanation for this fundamental question and gave a nice paper to read about. The paper's conclusion section starts with an indication of probabilistic decryption. We have shown how to eliminate decryption errors in encryption schemes (and even handle nonnegligible success probability of the adversary). It is interesting to ...


1

OK, I did this quickly. Hope it’s correct. When $r*\geq 0,$ the relationship holds as you observed. And when $r^*\leq -1,$ the same expression for both probabilities you want to compare enables a direct proof. Let $r^*\in(-1,0),$ so that $1+r^* \in (0,1).$ Then what you want to show is $$\frac{1}{2} e^{-\epsilon(1+r^*)}\geq e^{-\epsilon}\left(1-\frac{1}{2} e^...


1

The definition of semantic security we see in the Shoup book is better explained in his well-known paper Sequences of Games: A Tool for Taming Complexity in Security Proofs. You must pay the very attention to their words on page 15 of the book: Actually, our attack game for defining semantic security comprises two alternative "sub-games", or "...


Only top voted, non community-wiki answers of a minimum length are eligible