110

In short, it is more than a belief: there is strong evidence that humans are not good entropy sources. There is a test for this Man vs. Machine. Or, why Man is not a Particularly Good Source of Entropy. Try to win! So we don't rely on whether generating a random number from the mind or random keyboard typings and mouse movements that seem like a monkey ...


31

For me, the fraud-related applications of Benford's Law come to mind. When people make up data they tend to create overly uniform data, even when it's not appropriate. There's a definite psychology going on that may cause people to be less random than they are intending to be (Wikipedia links to a paper claiming humans are in fact bad at this). Or perhaps ...


18

Why don't we use Blowfish if it hasn't been cracked? The reason is well-known, it has 64-bit block size and therefore it is vulnerable to birthday attacks. This is done for HTTPS and for more information see sweet32; $$\text{Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN} $$ Is it safe to use Blowfish to encrypt strings of less than ...


18

Why would a dice rolled be "more random" than simply coming up with a sequence in your head, and then changing some of them? Humans have too many biases regarding what a random sequence is. If you ask humans to generate a random sequence, they will probably pay attention not to use the same character in a row, i.e., aa or bb, as they think that ab ...


15

Randomness is a measurable, statistical property of a set of values. It doesn't mean the same as "hard for a human to guess." Your sample string is hard for a human to guess, but it isn't very random. There is a tool called "ent" for most Unix systems that can quantify the randomness, by some measures, of a file. Available here: https://...


14

People are not that bad, but we're slow. See How were one-time pads and keys historically generated? In summary, MB's of 100% secure key material were generated for one time pads by people simply key smashing on type writers. Sufficient to win three world wars. It's just that a human's entropy rate is a little lower than a laser phase based TRNG. ...


11

In general, that article seems to be referring to the "Another Look At..." line of work. Many of the papers are collated on this website. There are a number of "controversies" you could to attempt to summarize. The main thrust against the notion of "provable security" is that it oversells what it delivers --- provably secure ...


9

Evidence suggests that people asked to generate random data will produce repetition in the data substantially less often than random chance would. For example, let's assume you were asked to generate random digits (i.e., just 0 through 9). In purely random data, a sequence like NN (i.e., the same digit twice in a row) happens about 10% of the time. That is, ...


9

Yes, you've raised a flaw, you can contact the authors, they will probably update their proof in the paper. But as you've noticed, it's not a big deal because $2q$ is much smaller than $\frac{3q^2}{2}$ asymptotically. Then both expressions are indeed $\mathcal{O}(\sqrt q)$.


7

The biggest problem is the 64-bit block size already mentioned in kelalaka's answer, but Blowfish has a couple of other issues: It can't be implemented using the hardware AES acceleration found in many modern CPUs. While this is obviously unfair, it's a reality of the world right now and it's a factor in many people's choice of AES. The hardware ...


7

What does existential unforgeability mean in a digital signature scheme? "Existential unforgeability" alone means adversaries can't create signatures that verify for messages they have not already a signature for. Strictly speaking, breaking existential unforgeability may only mean adversaries end up with a message and signature that verify, but ...


5

The point (( also see this answer)) is that the hash calculation is free for everybody and we assume that your methodology is known by Kerckhoffs's principles. Anybody can calculate the hash of any information and this may leak the encrypted message. In Cryptography, we consider the attackers computationally bounded, but not restricted to adapt any method on ...


5

A protocol (and in general, a cryptographic construction) satisfies information-theoretic security if no adversary can break the system, no matter how powerful the adversary is. The term "information-theoretic" is rooted in the idea that the leakage from the interaction can be studied from the perspective of information theory, and it can be ...


4

Some of us believe that it is possible to create ciphers and hash algorithms that are unbreakable (like when people said that we'd never run into an MD5 collision in the lifetime of the universe), but get broken in a couple of decades time (MD5 collision can be created on a modern PC in minutes). MD5 or any other hash function is not proven to be secure. ...


4

The answer given by @kelalaka is 100% correct; this breaks the security of encryption and so shouldn't be used. However, I want to add that this doesn't even guarantee integrity. In particular, integrity should hold even if the attacker knows the message. Assume that the attacker knows $m$ and wishes to change the first bit. This change can be easily made (...


4

There is nothing special about advantage versus probability of success, and they should be used where it makes sense and improves readability. When considering distinguishing games (like for encryption, PRG, and the like) advantage has the benefit of simplifying notation. Also, it "behaves nicely" in the sense of being able to add advantages and ...


4

The problem is with your statement "There is no overlap and A probability to win is $1/2$, because the PRF is secure." What does that mean? The only way to formalize that is to show that if adversary wins with probability greater than $1/2$ when there is no overlap, then you can break the PRF. That is essentially what the proof does. Note that it ...


4

Yes. Indeed, a "nonce" is a number used once. If you ever reuse a (nonce, key) pair, security breaks catastrophically. For a large chunked file, you can simply use the chunk number as the nonce, as long as you re-key after each file and can keep track of the count. Libsodium's secretstream API does this internally. If possible, use that, as it's ...


4

What is the "unknown attack" the reviewer is referring to? The reviewer did not say "the unknown attack", but "in front of unknown attacks". That refers to no attack in particular. Much like a reviewer of a math paper could tell, without thinking of a particular $y$: "the argument that $p$ is prime is unconvincing, for it ...


4

What you have written is correct and accurate intuition. The adversary indeed cannot distinguish without "guessing" $k$. This can be formalized, and it is this formalization that seems to be missing from your post. Here is a sketch of a traditional game-based proof of security. Without loss of generality, assume the adversary never repeats a query. ...


4

The point that you are missing is as follows. If a protocol is UC secure for specialized simulators, then $\forall A \forall E\exists S$. In particular, this is true for the universal environment $E_u$. Denote this simulator by $S_u$. The argument is that $S_u$ is a simulator for all environments. In particular, $S_u$ working with $E_u$ on input $(\langle E\...


4

Is there any advantage to use $\bmod q$ over naïve method (without using modulo)? If yes, is it security or computational complexity or any other? Yes; doing things $\bmod q$ does have the practical advantage that the shares are bounded length; computing the shares in $\mathbb{Z}$ can potentially have us send rather long values (as the values there don't ...


4

Defining indistinguishability is very tricky. I actually think that the definition in the book by Evans et al. is too weak, but maybe Mike Rosulek will weigh in. If you define security by saying that for every input, the distributions of REAL/IDEAL are indistinguishable, then what you are actually saying is as follows: for every input and every distinguisher ...


4

$\textrm{Exp}^{\textrm{ind-mode}}_{\mathcal{FE},A}$ is just the name given to the interaction. The "exponent" $\textrm{ind-mode}$ is part of that name. There is not really a standard, universal way of giving names to these kinds of games. But usually the author has to specify: what game is it? what scheme is being attacked? what is the attacker? ...


4

Cryptanalysis with adversaries capable of submitting superpositions of inputs and interpreting superpositions of outputs does exist, but is still relatively new with relatively little work. The earliest example that I'm aware of Zhandry's work on quantum-secure pseudo-random functions. I don't think the term "quantum chosen message" was introduced ...


4

The three equations you reference are (we'll just take them as truth - their proof can be found in the PDF): $$ \begin{align} |Pr[S_0] - Pr[S_1]| & = \epsilon_{\text{ddh}} & \text{ (1)} \\ |Pr[S_1] - Pr[S_2]| & = \epsilon_{\text{es}} & \text{ (2)} \\ Pr[S_2] & = \frac{1}{2} & \text{ (3)} \\ \end{align} $$ Then: $$ \begin{align} \...


3

I know that theoretically, the security of the setup when used correctly is at least as secure as the most secure. That's true if they use independent keys. If they use the same key, the security of the cascaded cipher may be much worse. Consider the case where cipher B happens to be the exact inverse of cipher A with the same key. However, that doesn't ...


3

The security proof for a one-time pad only guarantees one specific type of security ( "perfect secrecy" -- that the ciphertext provides no information about the plaintext) when it is used correctly (the key is completely random, as long as the plaintext, never reused, and kept secret). But you're not using it in a way that this proof applies. If ...


3

The PEANUT and WALNUT ciphers are an example of this (see also Vaudenay's decorrelation theory for the theory behind these ciphers). The idea is simple: take a provably secure construction, like the Luby-Rackoff scheme, and instantiate it with random functions that are identical to random up to $h$ invocations. For example, if your block cipher works on $n=...


3

Why is the extra Scheme (cryptosystem) based on a true random function instead of a PRF necessary? I don't have the book in front of me but every time you analyze the security of a PRF-based scheme, you always consider replacing the PRF with a truly random function as a conceptual step in the proof. A PRF is indistinguishable from a truly random function, ...


Only top voted, non community-wiki answers of a minimum length are eligible