Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
115 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

In short, it is more than a belief: there is strong evidence that humans are not good entropy sources. There is a test for this Man vs. Machine. Or, why Man is not a Particularly Good Source of ...
kelalaka's user avatar
  • 48.7k
71 votes

Soft question: Examples where lack of mathematical rigour cause security breaches?

The SSH protocol has a complicated record format with an encrypted message length, variable padding, encrypt-and-MAC, etc. This complicated system, which was designed without any formal analysis ...
Squeamish Ossifrage's user avatar
41 votes

Why does Neumann think cryptography isn't the solution?

That New York Times article actually continues after that quote: Dr. Neumann explained that there are always ways to get around cryptography barriers and that these methods have nothing to do with ...
Maarten Bodewes's user avatar
40 votes
Accepted

Formal verification in cryptography

Disclaimer: I use Coq on daily basis... I have seen in some places that people use formal verification and/or computer-aided verification for cryptography. To my knowledge, there aren't that many ...
Biv's user avatar
  • 9,988
40 votes
Accepted

Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers

I strongly disagree with saying that AES-128 is broken, in any way, shape or form, and likewise ECC with 256-bit keys. Note that even in this answer by @kelaka regarding AES-128, you would need over ...
Yehuda Lindell's user avatar
35 votes
Accepted

What do the signature security abbreviations like EUF-CMA mean?

Notation. Sets are represented using the calligraphic font and algorithms using the straight font. Throughout, $\Sigma:=(\mathsf{K},\mathsf{S},\mathsf{V})$ denotes a signature scheme on a key-space $\...
ckamath's user avatar
  • 5,258
34 votes
Accepted

What are standard cryptographic assumptions?

I am struggling to understand what is meant by "standard cryptographic assumption". ‘Standard assumption’ broadly means an assumption that has withstood the scrutiny of many smart cryptanalysts for a ...
Squeamish Ossifrage's user avatar
31 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

For me, the fraud-related applications of Benford's Law come to mind. When people make up data they tend to create overly uniform data, even when it's not appropriate. There's a definite psychology ...
thesquaregroot's user avatar
22 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Bruce Schneier foresaw your skepticism and directly answered this question in "Applied Cryptography": Known-plaintext attacks and chosen-plaintext attacks are more common than you might think. It ...
Wildcard's user avatar
  • 320
20 votes
Accepted

Why don't we use Blowfish if it hasn't been cracked?

Why don't we use Blowfish if it hasn't been cracked? The reason is well-known, it has 64-bit block size and therefore it is vulnerable to birthday attacks. This is done for HTTPS and for more ...
kelalaka's user avatar
  • 48.7k
19 votes

Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers

As you specifically asked for comparisons of the 128-bit security with concrete things, here is some food for thoughts (to complement the other answers): $2^{61} ≈$ SHA-1 chosen-prefix collision (i.e....
Lery's user avatar
  • 7,699
18 votes
Accepted

Salary Negotiation Problem

Solutions to Yao's Millionaire's Problem should suffice for this computation. In that setup, there are two parties each with an input. The output reveals whose input is larger, and nothing else. So ...
mikeazo's user avatar
  • 38.6k
18 votes
Accepted

Are encryption algorithms with fixed-point free permutations inherently flawed?

Are all encryption algorithms with fixed-point free permutations inherently flawed? Yes - when fixed points, or the lack of them, is knowable and detectable. This is a violation of multiple ...
Natanael's user avatar
  • 369
18 votes

Soft question: Examples where lack of mathematical rigour cause security breaches?

When choosing curves for use in elliptic curve cryptography, some have suggested using various classes of curves which avoid certain "bad" properties which would make the system vulnerable to attack. ...
Dave's user avatar
  • 281
18 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

Why would a dice rolled be "more random" than simply coming up with a sequence in your head, and then changing some of them? Humans have too many biases regarding what a random sequence is. ...
Jean-Baptiste Yunès's user avatar
17 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

It's not necessary that you encounter a situation like this in the real world to motivate the definition. There are some weaker adversaries that you would like to rule out in your security model, and ...
Daniel's user avatar
  • 3,972
17 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Practical chosen-plaintext attacks have been discovered against modern cryptosystems like TLS/SSL. One noteworthy type of vulnerability can occur when a cryptosystem includes a compression step before ...
nomadictype's user avatar
17 votes
Accepted

Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?

One example is OCB2; Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC by Rogaway. It is standardized in ISO/IEC 19772:2009. The author also provided a proof by ...
kelalaka's user avatar
  • 48.7k
16 votes

What is the "Random Oracle Model" and why is it controversial?

The bear describes a process for choosing and computing a uniform random function involving gnomes in boxes, but this doesn't really explain what the random oracle model is in the context of proving ...
Squeamish Ossifrage's user avatar
16 votes

Are encryption algorithms with fixed-point free permutations inherently flawed?

Are all encryption algorithms with fixed-point free permutations inherently flawed? No, they are not inherently flawed. Consider the following cipher: Let $k_0$ be a key for AES-256, and let $k_1$...
Squeamish Ossifrage's user avatar
15 votes

Uniform vs discrete Gaussian sampling in Ring learning with errors

The TL;DR: From a theoretic point of view, Gaussians are the better choice, both for the easiness of the security proof and its optimality in terms of tightness; In practice, most of the time you can ...
Thomas Prest's user avatar
  • 1,080
15 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

Randomness is a measurable, statistical property of a set of values. It doesn't mean the same as "hard for a human to guess." Your sample string is hard for a human to guess, but it isn't ...
JesseM's user avatar
  • 462
14 votes
Accepted

Is RSA provably secure in the sense of Douglas Stinson's ``provable security''?

Every cryptosystem is "provably secure" under at least one hardness assumption: the assumption that it cannot be broken. Hence, the only question which matters is whether a cryptosystem is provably ...
Geoffroy Couteau's user avatar
14 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

People are not that bad, but we're slow. See How were one-time pads and keys historically generated? In summary, MB's of 100% secure key material were generated for one time pads by people simply key ...
Paul Uszak's user avatar
  • 15.5k
13 votes
Accepted

Proof by reduction vs. hybrid argument

There is actually no difference between what you are describing. One of the issues with writing proofs, is that a separate reduction must be proven for every element of the construction (you cannot ...
Yehuda Lindell's user avatar
13 votes
Accepted

Are DSA and ECDSA provably secure assuming DL security?

(The (EC)DSA algorithm involves two functions: (i) the "conversion function" $f$, which for the case of DSA is a modulo $q$ operation and for ECDSA is the modulo $q$ operation applied to the $x$-...
ckamath's user avatar
  • 5,258
12 votes
Accepted

Explanation and proof of a well-know probabilistic lemma

This is based on an averaging argument (which is also used in the proof of the Goldreich-Levin hardcore bit). First, I assume that when writing $\operatorname{Pr}[A(x,y)=1] \geq \epsilon$, then the ...
Yehuda Lindell's user avatar
12 votes
Accepted

The main differences between Sketch of Proof and Full proof

The answer to this question is not straightforward and has a lot to do with the "conference culture" of computer science. Unlike other fields, the main publication venues for CS are conferences and ...
Yehuda Lindell's user avatar
12 votes
Accepted

Is there a formal language to define a cryptographic protocol?

Disclaimer: I use Coq on daily basis... About the tools As you are looking for a formal verification, I would advise you to take a look at Coq. Even though mainly used by Academics, it provides a ...
Biv's user avatar
  • 9,988
12 votes
Accepted

Is there a cryptography algorithm that will remain safe if P=NP?

Whether P = NP is a question about the asymptotic growth of computational costs of algorithms as functions of input sizes. It may provide hints about concrete computational cost estimates of ...
Squeamish Ossifrage's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible