We’re rewarding the question askers & reputations are being recalculated! Read more.

# Tag Info

I am struggling to understand what is meant by "standard cryptographic assumption". ‘Standard assumption’ broadly means an assumption that has withstood the scrutiny of many smart cryptanalysts for a long time. Examples: We think that, for uniform random 1024-bit primes $p$ and $q$, solving $y = x^3 \bmod pq$ for uniform random $x$ is hard given $pq$ and $... 7 There is no formal definition of standard assumption, but we usually say that an assumption is standard if it has already been used in several cryptographic schemes and if it is well-accepted in the crypto community. It usually also implies that several researchers tried to solve the problem and were not able to find efficient ways of doing so, therefore, ... 2 The Gilbert-MacWilliams-Sloane MAC referred to by @SqueamishOssifrage in the comments is information theoretically secure "for single use", at the cost of having hashes that have length$2\ell$for fixed length messages of length$\ell.$Poly1305 is not information theoretically secure. It is much more flexible, can take essentially arbitrary length inputs,... 1 You're close. As Mikero noted in the comments, this scheme is CCA-secure as proven in his book. The proof strategy that seems easiest here is to do game-hops and with the IND$-CPA definition: Start with the real case where $c=F_K(r\mathbin\|m)$ is returned Swap out $F_K(\cdot)$ for a random permutation $\pi$, so $c=\pi(r\mathbin\|m)$ is returned, you "lose"...