116
votes
Why do some people believe that humans are "bad at" generating random numbers/characters like this?
In short, it is more than a belief: there is strong evidence that humans are not good entropy sources. There is a test for this
Man vs. Machine. Or, why Man is not a Particularly Good Source of ...
- 49.5k
71
votes
Soft question: Examples where lack of mathematical rigour cause security breaches?
The SSH protocol has a complicated record format with an encrypted message length, variable padding, encrypt-and-MAC, etc. This complicated system, which was designed without any formal analysis ...
- 49.5k
41
votes
Accepted
Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers
I strongly disagree with saying that AES-128 is broken, in any way, shape or form, and likewise ECC with 256-bit keys. Note that even in this answer by @kelaka regarding AES-128, you would need over ...
- 28.2k
36
votes
Accepted
What do the signature security abbreviations like EUF-CMA mean?
Notation.
Sets are represented using the calligraphic font and algorithms using the straight font. Throughout, $\Sigma:=(\mathsf{K},\mathsf{S},\mathsf{V})$ denotes a signature scheme on a key-space $\...
- 5,488
34
votes
Accepted
What are standard cryptographic assumptions?
I am struggling to understand what is meant by "standard cryptographic assumption".
‘Standard assumption’ broadly means an assumption that has withstood the scrutiny of many smart cryptanalysts for a ...
- 49.5k
31
votes
Why do some people believe that humans are "bad at" generating random numbers/characters like this?
For me, the fraud-related applications of Benford's Law come to mind. When people make up data they tend to create overly uniform data, even when it's not appropriate. There's a definite psychology ...
- 1,269
22
votes
Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?
Bruce Schneier foresaw your skepticism and directly answered this question in "Applied Cryptography":
Known-plaintext attacks and chosen-plaintext attacks are more common than you might think. It ...
- 320
20
votes
Accepted
Why don't we use Blowfish if it hasn't been cracked?
Why don't we use Blowfish if it hasn't been cracked?
The reason is well-known, it has 64-bit block size and therefore it is vulnerable to birthday attacks. This is done for HTTPS and for more ...
- 49.5k
19
votes
What is the "Random Oracle Model" and why is it controversial?
The bear describes a process for choosing and computing a uniform random function involving gnomes in boxes, but this doesn't really explain what the random oracle model is in the context of proving ...
- 49.5k
19
votes
Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers
As you specifically asked for comparisons of the 128-bit security with concrete things, here is some food for thoughts (to complement the other answers):
$2^{61} ≈$ SHA-1 chosen-prefix collision (i.e....
- 7,789
18
votes
Accepted
Salary Negotiation Problem
Solutions to Yao's Millionaire's Problem should suffice for this computation. In that setup, there are two parties each with an input. The output reveals whose input is larger, and nothing else.
So ...
- 38.9k
18
votes
Accepted
Are encryption algorithms with fixed-point free permutations inherently flawed?
Are all encryption algorithms with fixed-point free permutations inherently flawed?
Yes - when fixed points, or the lack of them, is knowable and detectable.
This is a violation of multiple ...
- 369
18
votes
Soft question: Examples where lack of mathematical rigour cause security breaches?
When choosing curves for use in elliptic curve cryptography, some have suggested using various classes of curves which avoid certain "bad" properties which would make the system vulnerable to attack.
...
- 281
18
votes
Why do some people believe that humans are "bad at" generating random numbers/characters like this?
Why would a dice rolled be "more random" than simply coming up with a
sequence in your head, and then changing some of them?
Humans have too many biases regarding what a random sequence is. ...
18
votes
Accepted
Is there any famous protocol that were proven secure but whose proof was wrong and lead to real world attacks?
One example is OCB2;
Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC by Rogaway. It is standardized in ISO/IEC 19772:2009. The author also provided a proof by ...
- 49.5k
17
votes
Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?
It's not necessary that you encounter a situation like this in the real world to motivate the definition.
There are some weaker adversaries that you would like to rule out in your security model, and ...
- 4,062
17
votes
Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?
Practical chosen-plaintext attacks have been discovered against modern cryptosystems like TLS/SSL. One noteworthy type of vulnerability can occur when a cryptosystem includes a compression step before ...
- 271
16
votes
Are encryption algorithms with fixed-point free permutations inherently flawed?
Are all encryption algorithms with fixed-point free permutations inherently flawed?
No, they are not inherently flawed.
Consider the following cipher: Let $k_0$ be a key for AES-256, and let $k_1$...
- 49.5k
15
votes
Uniform vs discrete Gaussian sampling in Ring learning with errors
The TL;DR:
From a theoretic point of view, Gaussians are the better choice, both for the easiness of the security proof and its optimality in terms of tightness;
In practice, most of the time you can ...
- 1,080
15
votes
Why do some people believe that humans are "bad at" generating random numbers/characters like this?
Randomness is a measurable, statistical property of a set of values. It doesn't mean the same as "hard for a human to guess."
Your sample string is hard for a human to guess, but it isn't ...
- 472
14
votes
Accepted
Is RSA provably secure in the sense of Douglas Stinson's ``provable security''?
Every cryptosystem is "provably secure" under at least one hardness assumption: the assumption that it cannot be broken. Hence, the only question which matters is whether a cryptosystem is provably ...
- 21.3k
14
votes
Why do some people believe that humans are "bad at" generating random numbers/characters like this?
People are not that bad, but we're slow. See How were one-time pads and keys historically generated? In summary, MB's of 100% secure key material were generated for one time pads by people simply key ...
- 15.7k
13
votes
Accepted
Is there a cryptography algorithm that will remain safe if P = NP?
Whether P = NP is a question about the asymptotic growth of computational costs of algorithms as functions of input sizes. It may provide hints about concrete computational cost estimates of ...
- 49.5k
13
votes
Accepted
Could you list all of the security models in cryptography?
What you are asking for is not really a list of security models, but more a list of idealized models (like the ROM), and trust assumptions (like the CRS model). Asking for a list seems a bit off-topic ...
- 21.3k
13
votes
Accepted
Proof by reduction vs. hybrid argument
There is actually no difference between what you are describing. One of the issues with writing proofs, is that a separate reduction must be proven for every element of the construction (you cannot ...
- 28.2k
13
votes
Accepted
Are DSA and ECDSA provably secure assuming DL security?
(The (EC)DSA algorithm involves two functions: (i) the "conversion function" $f$, which for the case of DSA is a modulo $q$ operation and for ECDSA is the modulo $q$ operation applied to the $x$-...
- 5,488
12
votes
Accepted
Is there a formal language to define a cryptographic protocol?
Disclaimer: I use Coq on daily basis...
About the tools
As you are looking for a formal verification, I would advise you to take a look at Coq. Even though mainly used by Academics, it provides a ...
- 10k
12
votes
Accepted
Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?
I know of two lines of work on this question. It is indeed possible to allow malleability but still make some guarantees in the presence of a chosen-ciphertext attack:
Manoj Prabhakaran & Mike ...
- 14.5k
12
votes
Accepted
Are interactive proofs more secure their non-interactive counterpart?
When turning an interactive ZK proof into a non-interactive zero-knowledge argument with the Fiat-Shamir transform, the following security issues must be taken into consideration:
Even if the ...
- 21.3k
11
votes
Accepted
Relation between decisional SIS and leftover hash lemma in lattices
The leftover hash lemma (LHL) says that $(A,u=Ax) \in \mathbb{Z}_q^{(n+1) \times (m+1)}$ is very close to uniformly random. In particular, this implies that for uniformly random $(A,u)$, there exists ...
- 5,883
Only top scored, non community-wiki answers of a minimum length are eligible