We’re rewarding the question askers & reputations are being recalculated! Read more.

New answers tagged

0

Suppose you are a member of a mailing list or of an anonymous cryptographic site. Now suppose there is some "new guy" who just joined and makes bold claims about having broken some cryptosystem. Now of course because you don't know anything about the "new guy" you don't believe them. Naturally they're really insistent, so you agree to challenge their claim ...


29

I am struggling to understand what is meant by "standard cryptographic assumption". ‘Standard assumption’ broadly means an assumption that has withstood the scrutiny of many smart cryptanalysts for a long time. Examples: We think that, for uniform random 1024-bit primes $p$ and $q$, solving $y = x^3 \bmod pq$ for uniform random $x$ is hard given $pq$ and $...


7

There is no formal definition of standard assumption, but we usually say that an assumption is standard if it has already been used in several cryptographic schemes and if it is well-accepted in the crypto community. It usually also implies that several researchers tried to solve the problem and were not able to find efficient ways of doing so, therefore, ...


2

The Gilbert-MacWilliams-Sloane MAC referred to by @SqueamishOssifrage in the comments is information theoretically secure "for single use", at the cost of having hashes that have length $2\ell$ for fixed length messages of length $\ell.$ Poly1305 is not information theoretically secure. It is much more flexible, can take essentially arbitrary length inputs,...


1

You're close. As Mikero noted in the comments, this scheme is CCA-secure as proven in his book. The proof strategy that seems easiest here is to do game-hops and with the IND$-CPA definition: Start with the real case where $c=F_K(r\mathbin\|m)$ is returned Swap out $F_K(\cdot)$ for a random permutation $\pi$, so $c=\pi(r\mathbin\|m)$ is returned, you "lose"...


Top 50 recent answers are included