115 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

In short, it is more than a belief: there is strong evidence that humans are not good entropy sources. There is a test for this Man vs. Machine. Or, why Man is not a Particularly Good Source of ...
kelalaka's user avatar
  • 47.6k
71 votes

Soft question: Examples where lack of mathematical rigour cause security breaches?

The SSH protocol has a complicated record format with an encrypted message length, variable padding, encrypt-and-MAC, etc. This complicated system, which was designed without any formal analysis ...
Squeamish Ossifrage's user avatar
41 votes

Why does Neumann think cryptography isn't the solution?

That New York Times article actually continues after that quote: Dr. Neumann explained that there are always ways to get around cryptography barriers and that these methods have nothing to do with ...
Maarten Bodewes's user avatar
  • 91.9k
39 votes
Accepted

Formal verification in cryptography

Disclaimer: I use Coq on daily basis... I have seen in some places that people use formal verification and/or computer-aided verification for cryptography. To my knowledge, there aren't that many ...
Biv's user avatar
  • 9,969
39 votes
Accepted

Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers

I strongly disagree with saying that AES-128 is broken, in any way, shape or form, and likewise ECC with 256-bit keys. Note that even in this answer by @kelaka regarding AES-128, you would need over ...
Yehuda Lindell's user avatar
34 votes
Accepted

What do the signature security abbreviations like EUF-CMA mean?

Notation. Sets are represented using the calligraphic font and algorithms using the straight font. Throughout, $\Sigma:=(\mathsf{K},\mathsf{S},\mathsf{V})$ denotes a signature scheme on a key-space $\...
ckamath's user avatar
  • 5,133
33 votes
Accepted

What are standard cryptographic assumptions?

I am struggling to understand what is meant by "standard cryptographic assumption". ‘Standard assumption’ broadly means an assumption that has withstood the scrutiny of many smart cryptanalysts for a ...
Squeamish Ossifrage's user avatar
31 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

For me, the fraud-related applications of Benford's Law come to mind. When people make up data they tend to create overly uniform data, even when it's not appropriate. There's a definite psychology ...
thesquaregroot's user avatar
28 votes
Accepted

What are the differences between proofs based on simulation and proofs based on games?

As the other answers already state here, game-based definitions are easier to write proofs for, but simulation-based definitions are often clearer in terms of the security guarantee that you get. The ...
Yehuda Lindell's user avatar
22 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Bruce Schneier foresaw your skepticism and directly answered this question in "Applied Cryptography": Known-plaintext attacks and chosen-plaintext attacks are more common than you might think. It ...
Wildcard's user avatar
  • 320
20 votes
Accepted

Simulation-based proofs and universal composability proofs

What does this mean, exactly? The purpose of the environment is to model "everything else happening in the universe" besides the protocol execution. In the UC model, the adversary is allowed to talk ...
Mikero's user avatar
  • 12k
20 votes
Accepted

Why don't we use Blowfish if it hasn't been cracked?

Why don't we use Blowfish if it hasn't been cracked? The reason is well-known, it has 64-bit block size and therefore it is vulnerable to birthday attacks. This is done for HTTPS and for more ...
kelalaka's user avatar
  • 47.6k
19 votes

Why is "semantically secure" important for cryptosystems?

Let me try to answer your second question, and hopefully shed some light on the first one in doing so. When we encrypt a message, it's because we want to keep something about that message secret. ...
Ilmari Karonen's user avatar
19 votes

Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers

As you specifically asked for comparisons of the 128-bit security with concrete things, here is some food for thoughts (to complement the other answers): $2^{61} ≈$ SHA-1 chosen-prefix collision (i.e....
Lery's user avatar
  • 7,629
18 votes
Accepted

Salary Negotiation Problem

Solutions to Yao's Millionaire's Problem should suffice for this computation. In that setup, there are two parties each with an input. The output reveals whose input is larger, and nothing else. So ...
mikeazo's user avatar
  • 38.5k
18 votes
Accepted

Are encryption algorithms with fixed-point free permutations inherently flawed?

Are all encryption algorithms with fixed-point free permutations inherently flawed? Yes - when fixed points, or the lack of them, is knowable and detectable. This is a violation of multiple ...
Natanael's user avatar
  • 369
18 votes

Soft question: Examples where lack of mathematical rigour cause security breaches?

When choosing curves for use in elliptic curve cryptography, some have suggested using various classes of curves which avoid certain "bad" properties which would make the system vulnerable to attack. ...
Dave's user avatar
  • 281
18 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

Why would a dice rolled be "more random" than simply coming up with a sequence in your head, and then changing some of them? Humans have too many biases regarding what a random sequence is. ...
Jean-Baptiste Yunès's user avatar
17 votes

Simulation based proofs: Simple examples

I have written a tutorial on how to write simulation-based proofs. I think that it should be helpful.
Yehuda Lindell's user avatar
17 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

It's not necessary that you encounter a situation like this in the real world to motivate the definition. There are some weaker adversaries that you would like to rule out in your security model, and ...
Daniel's user avatar
  • 3,922
17 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Practical chosen-plaintext attacks have been discovered against modern cryptosystems like TLS/SSL. One noteworthy type of vulnerability can occur when a cryptosystem includes a compression step before ...
nomadictype's user avatar
17 votes
Accepted

Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?

One example is OCB2; Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC by Rogaway. It is standardized in ISO/IEC 19772:2009. The author also provided a proof by ...
kelalaka's user avatar
  • 47.6k
16 votes

Uniform vs discrete Gaussian sampling in Ring learning with errors

The TL;DR: From a theoretic point of view, Gaussians are the better choice, both for the easiness of the security proof and its optimality in terms of tightness; In practice, most of the time you can ...
Thomas Prest's user avatar
  • 1,082
16 votes

Are encryption algorithms with fixed-point free permutations inherently flawed?

Are all encryption algorithms with fixed-point free permutations inherently flawed? No, they are not inherently flawed. Consider the following cipher: Let $k_0$ be a key for AES-256, and let $k_1$...
Squeamish Ossifrage's user avatar
15 votes

What is the "Random Oracle Model" and why is it controversial?

The bear describes a process for choosing and computing a uniform random function involving gnomes in boxes, but this doesn't really explain what the random oracle model is in the context of proving ...
Squeamish Ossifrage's user avatar
15 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

Randomness is a measurable, statistical property of a set of values. It doesn't mean the same as "hard for a human to guess." Your sample string is hard for a human to guess, but it isn't ...
JesseM's user avatar
  • 462
14 votes
Accepted

Is RSA provably secure in the sense of Douglas Stinson's ``provable security''?

Every cryptosystem is "provably secure" under at least one hardness assumption: the assumption that it cannot be broken. Hence, the only question which matters is whether a cryptosystem is provably ...
Geoffroy Couteau's user avatar
14 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

People are not that bad, but we're slow. See How were one-time pads and keys historically generated? In summary, MB's of 100% secure key material were generated for one time pads by people simply key ...
Paul Uszak's user avatar
  • 15.2k
13 votes
Accepted

Are DSA and ECDSA provably secure assuming DL security?

(The (EC)DSA algorithm involves two functions: (i) the "conversion function" $f$, which for the case of DSA is a modulo $q$ operation and for ECDSA is the modulo $q$ operation applied to the $x$-...
ckamath's user avatar
  • 5,133
12 votes
Accepted

Explanation and proof of a well-know probabilistic lemma

This is based on an averaging argument (which is also used in the proof of the Goldreich-Levin hardcore bit). First, I assume that when writing $\operatorname{Pr}[A(x,y)=1] \geq \epsilon$, then the ...
Yehuda Lindell's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible