115
votes
Why do some people believe that humans are "bad at" generating random numbers/characters like this?
In short, it is more than a belief: there is strong evidence that humans are not good entropy sources. There is a test for this
Man vs. Machine. Or, why Man is not a Particularly Good Source of ...
- 47.6k
71
votes
Soft question: Examples where lack of mathematical rigour cause security breaches?
The SSH protocol has a complicated record format with an encrypted message length, variable padding, encrypt-and-MAC, etc. This complicated system, which was designed without any formal analysis ...
- 47.9k
41
votes
Why does Neumann think cryptography isn't the solution?
That New York Times article actually continues after that quote:
Dr. Neumann explained that there are always ways to get around cryptography barriers and that these methods have nothing to do with ...
- 91.9k
39
votes
Accepted
Formal verification in cryptography
Disclaimer: I use Coq on daily basis...
I have seen in some places that people use formal verification and/or computer-aided verification for cryptography.
To my knowledge, there aren't that many ...
- 9,969
39
votes
Accepted
Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers
I strongly disagree with saying that AES-128 is broken, in any way, shape or form, and likewise ECC with 256-bit keys. Note that even in this answer by @kelaka regarding AES-128, you would need over ...
- 27.7k
34
votes
Accepted
What do the signature security abbreviations like EUF-CMA mean?
Notation.
Sets are represented using the calligraphic font and algorithms using the straight font. Throughout, $\Sigma:=(\mathsf{K},\mathsf{S},\mathsf{V})$ denotes a signature scheme on a key-space $\...
- 5,133
33
votes
Accepted
What are standard cryptographic assumptions?
I am struggling to understand what is meant by "standard cryptographic assumption".
‘Standard assumption’ broadly means an assumption that has withstood the scrutiny of many smart cryptanalysts for a ...
- 47.9k
31
votes
Why do some people believe that humans are "bad at" generating random numbers/characters like this?
For me, the fraud-related applications of Benford's Law come to mind. When people make up data they tend to create overly uniform data, even when it's not appropriate. There's a definite psychology ...
- 1,229
28
votes
Accepted
What are the differences between proofs based on simulation and proofs based on games?
As the other answers already state here, game-based definitions are easier to write proofs for, but simulation-based definitions are often clearer in terms of the security guarantee that you get. The ...
- 27.7k
22
votes
Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?
Bruce Schneier foresaw your skepticism and directly answered this question in "Applied Cryptography":
Known-plaintext attacks and chosen-plaintext attacks are more common than you might think. It ...
- 320
20
votes
Accepted
Simulation-based proofs and universal composability proofs
What does this mean, exactly?
The purpose of the environment is to model "everything else happening in the universe" besides the protocol execution. In the UC model, the adversary is allowed to talk ...
- 12k
20
votes
Accepted
Why don't we use Blowfish if it hasn't been cracked?
Why don't we use Blowfish if it hasn't been cracked?
The reason is well-known, it has 64-bit block size and therefore it is vulnerable to birthday attacks. This is done for HTTPS and for more ...
- 47.6k
19
votes
Why is "semantically secure" important for cryptosystems?
Let me try to answer your second question, and hopefully shed some light on the first one in doing so.
When we encrypt a message, it's because we want to keep something about that message secret. ...
- 45.9k
19
votes
Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers
As you specifically asked for comparisons of the 128-bit security with concrete things, here is some food for thoughts (to complement the other answers):
$2^{61} ≈$ SHA-1 chosen-prefix collision (i.e....
- 7,629
18
votes
Accepted
Salary Negotiation Problem
Solutions to Yao's Millionaire's Problem should suffice for this computation. In that setup, there are two parties each with an input. The output reveals whose input is larger, and nothing else.
So ...
- 38.5k
18
votes
Accepted
Are encryption algorithms with fixed-point free permutations inherently flawed?
Are all encryption algorithms with fixed-point free permutations inherently flawed?
Yes - when fixed points, or the lack of them, is knowable and detectable.
This is a violation of multiple ...
- 369
18
votes
Soft question: Examples where lack of mathematical rigour cause security breaches?
When choosing curves for use in elliptic curve cryptography, some have suggested using various classes of curves which avoid certain "bad" properties which would make the system vulnerable to attack.
...
- 281
18
votes
Why do some people believe that humans are "bad at" generating random numbers/characters like this?
Why would a dice rolled be "more random" than simply coming up with a
sequence in your head, and then changing some of them?
Humans have too many biases regarding what a random sequence is. ...
17
votes
Simulation based proofs: Simple examples
I have written a tutorial on how to write simulation-based proofs. I think that it should be helpful.
- 27.7k
17
votes
Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?
It's not necessary that you encounter a situation like this in the real world to motivate the definition.
There are some weaker adversaries that you would like to rule out in your security model, and ...
- 3,922
17
votes
Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?
Practical chosen-plaintext attacks have been discovered against modern cryptosystems like TLS/SSL. One noteworthy type of vulnerability can occur when a cryptosystem includes a compression step before ...
- 271
17
votes
Accepted
Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?
One example is OCB2;
Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC by Rogaway. It is standardized in ISO/IEC 19772:2009. The author also provided a proof by ...
- 47.6k
16
votes
Uniform vs discrete Gaussian sampling in Ring learning with errors
The TL;DR:
From a theoretic point of view, Gaussians are the better choice, both for the easiness of the security proof and its optimality in terms of tightness;
In practice, most of the time you can ...
- 1,082
16
votes
Are encryption algorithms with fixed-point free permutations inherently flawed?
Are all encryption algorithms with fixed-point free permutations inherently flawed?
No, they are not inherently flawed.
Consider the following cipher: Let $k_0$ be a key for AES-256, and let $k_1$...
- 47.9k
15
votes
What is the "Random Oracle Model" and why is it controversial?
The bear describes a process for choosing and computing a uniform random function involving gnomes in boxes, but this doesn't really explain what the random oracle model is in the context of proving ...
- 47.9k
15
votes
Why do some people believe that humans are "bad at" generating random numbers/characters like this?
Randomness is a measurable, statistical property of a set of values. It doesn't mean the same as "hard for a human to guess."
Your sample string is hard for a human to guess, but it isn't ...
- 462
14
votes
Accepted
Is RSA provably secure in the sense of Douglas Stinson's ``provable security''?
Every cryptosystem is "provably secure" under at least one hardness assumption: the assumption that it cannot be broken. Hence, the only question which matters is whether a cryptosystem is provably ...
- 19.2k
14
votes
Why do some people believe that humans are "bad at" generating random numbers/characters like this?
People are not that bad, but we're slow. See How were one-time pads and keys historically generated? In summary, MB's of 100% secure key material were generated for one time pads by people simply key ...
- 15.2k
13
votes
Accepted
Are DSA and ECDSA provably secure assuming DL security?
(The (EC)DSA algorithm involves two functions: (i) the "conversion function" $f$, which for the case of DSA is a modulo $q$ operation and for ECDSA is the modulo $q$ operation applied to the $x$-...
- 5,133
12
votes
Accepted
Explanation and proof of a well-know probabilistic lemma
This is based on an averaging argument (which is also used in the proof of the Goldreich-Levin hardcore bit).
First, I assume that when writing $\operatorname{Pr}[A(x,y)=1] \geq \epsilon$, then the ...
- 27.7k
Only top scored, non community-wiki answers of a minimum length are eligible