68 votes
Accepted

Easy explanation of "IND-" security notions?

The ideal encryption scheme $E$ would be one that, for every ciphertext $C=E(K, M)$, if the key remains secret for the adversary, the probability of identifying $M$ is negligible. Since that is not ...
22 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Bruce Schneier foresaw your skepticism and directly answered this question in "Applied Cryptography": Known-plaintext attacks and chosen-plaintext attacks are more common than you might think. It ...
  • 321
17 votes

Why is "semantically secure" important for cryptosystems?

Let me try to answer your second question, and hopefully shed some light on the first one in doing so. When we encrypt a message, it's because we want to keep something about that message secret. ...
17 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

It's not necessary that you encounter a situation like this in the real world to motivate the definition. There are some weaker adversaries that you would like to rule out in your security model, and ...
  • 3,812
17 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Practical chosen-plaintext attacks have been discovered against modern cryptosystems like TLS/SSL. One noteworthy type of vulnerability can occur when a cryptosystem includes a compression step before ...
12 votes
Accepted

Is SHA-1 secure when used to implement a PRNG

I read SHA1 is still a secured hashing function with no collision found as of now. You read an old text, this is not the case anymore since SHA-1 was SHAttered. In Java, we still use SHA1PRNG ...
  • 86.5k
11 votes
Accepted

Decisional Diffie-Hellman: compute Legendre symbol of $g^{ab}$ from $g^a$ and $g^b$?

Because (I assume) $g$ is a generator, it is not a square (prove this), so its Legendre symbol is $-1$. And hence, the Legendre symbols of $g^a$ and $g^b$ leak the parities or $a$ and $b$. Hence they ...
  • 7,944
11 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

There are some interesting examples in section 3.4.2 of Katz-Lindell book. Here is just one of them: During World War II, the British placed mines at certain locations and (intentionally) managed to ...
  • 990
10 votes
Accepted

Proving the semantic security of the One Time pad

The proof for the perfect secrecy property of the one time pad is quite simple. It makes use of basic probabilities and it says that: $$Pr[M=m|C=c]=Pr[M=m]$$ for a probability distribution M$\{0,1\}...
  • 5,942
8 votes

IPSec vs SSL : Similarities and Differences

but do SSL and IPSec use different key schemes and algorithms from another to establish contexts? Well, given that, by IPsec, you mean only AH and ESP (that is, RFC4301-4303), well, the obvious ...
  • 134k
8 votes

Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

The lead up to the Battle of Midway also involved a chosen plaintext attack. The Americans had mostly broken the Japanese code JN-25b, and knew the Japanese were attacking "AF". They guessed that "...
  • 1,541
6 votes

Is elliptic curve point multiplication semantically secure?

If an attacker can choose the points $P_i$, than this system is not semantically secure. For example, they may choose $P_2=2P_1$, and the corresponding encryption $Q_2$ would be equal to $2Q_1$. If ...
5 votes

Who defined semantic security?

The source is the paper by Goldwasser and Micali on probabilistic encryption. The definition is of primary importance even though it is rarely used to prove security of encryption. The reason for this ...
5 votes

How to prove hardness of approximate-GCD problem?

I am stuck at the point where I proved that the complexity is $O(2^\rho)$ using brute-force approach. How shall I proceed? Well, a proof that assumed a specific attack strategy is of limited use, as ...
  • 134k
4 votes
Accepted

Secure blinding factor switching at malicious server-side (Switching in One Time pad)

I'll answer question 2, leaving the first as an exercise to the reader. I'll do this on intuitive grounds, rather than using explicit conditional probabilities. The adversary is free to compute $v_1\...
  • 126k
4 votes
Accepted

Difference between a secure PRG and semantically secure encryption

I consider the SU Cryptography course on Coursera really good, up to certain level is very comprehensive. You should discuss these topics on the Coursera forum, IMHO you will be guided more precisely. ...
  • 1,192
4 votes

How does Signal Messenger's Safety Number Work?

Here is a detailed blog post about the safety numbers: https://signal.org/blog/safety-number-updates/ They are unique per conversation and basically consist of hashes of your and your contact's ...
4 votes
Accepted

semantic security of RSA variant

No it's not. As a reminer: Semantic security is equivalent to IND-CPA. Semantic security is less commonly used, because most of the time proofs are less intuitive and more difficult. In the IND-CPA ...
  • 12.3k
4 votes

Security of stream cipher with a priori knowledge of message

Can we analyze using hypothesis testing (given two messages m1 and m2 with the same distribution and analyze whether ciphertext leaks any information about messages) or using entropy bounds? If the ...
  • 134k
4 votes
Accepted

Indistinguishability versus semantic security?

The definition of semantic security has its origins in the definition of perfect security, where the adversary's information about the message is the same after seeing the ciphertext. Semantic ...
  • 4,467
4 votes
Accepted

Are there any security drawbacks for simply encrypting and MACing my JWS token (JWT)?

[I]f I want the JWS token content to be non-visible, I keep hearing people mention JWE. But is there a security reason why I shouldn't be encrypting them myself? On the contrary, there is a security ...
4 votes

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

What you are doing sounds like piling on complexity of dubious value without a clear understanding of what security the components actually provide, in the hope that enough complexity will render the ...
4 votes
Accepted

Does adding OWF of the private key to encryption scheme hurts security?

It's possible to have a secure encryption scheme that ignores the first half of its key, and a secure OWF that leaks the entire second half of its input. Composing them as in your question results in ...
  • 10.8k
4 votes
Accepted

Are there different definitions of secure two-party computation?

Defining indistinguishability is very tricky. I actually think that the definition in the book by Evans et al. is too weak, but maybe Mike Rosulek will weigh in. If you define security by saying that ...
4 votes
Accepted

How are probabilities combined in the game hopping proof technique?

The three equations you reference are (we'll just take them as truth - their proof can be found in the PDF): $$ \begin{align} |Pr[S_0] - Pr[S_1]| & = \epsilon_{\text{ddh}} & \text{ (1)} \\ |Pr[...
  • 578
4 votes
Accepted

Security definition for IND-CPA of public key encryption

In public-key cryptography, the adversary is indeed able to create encryptions of their chosen messages $m_1$ and $m_2$ on their own. This is why any IND-CPA-secure public-key cryptosystem cannot be ...
  • 578
3 votes
Accepted

Any case that can require to encrypt a certificate revocation list before distribution

No. A CRL is as public as the certificate it revokes; it has to be signed to guarantee authenticity, but not encrypted. There are no optional confidentiality requirements for CRL distribution in RFC ...
3 votes
Accepted

Homemade Randomized RSA

Spartacus: Maybe i came out with the solution, since the cryptosystem described above is not CCA-secure, an adversary A can intercept (A,B) and compute a new ciphertext $$C = 2B\bmod N = 2^er^e \bmod ...
3 votes

Can a shift cipher attain perfect secrecy?

Shift cipher or ceasar cipher attains perfect secrecy only in the special case with the assumption that $26$ keys are used in equal probability in the shift cipher, and to encrypt each symbol we use a ...
3 votes

Designing Secure Multi-Party Computation Sub-Protocols Based on Homomorphic Encryption

Since the keys are fixed from beginning (the sub-protocols input are ciphertexts), isn't it possible to give the secret key to the (non-uniform) distinguisher as an extra advice (the only restrictions ...
  • 37.9k

Only top scored, non community-wiki answers of a minimum length are eligible