# Tag Info

## Hot answers tagged semantic-security

68 votes
Accepted

### Easy explanation of "IND-" security notions?

The ideal encryption scheme $E$ would be one that, for every ciphertext $C=E(K, M)$, if the key remains secret for the adversary, the probability of identifying $M$ is negligible. Since that is not ...
• 1,659
22 votes

### Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Bruce Schneier foresaw your skepticism and directly answered this question in "Applied Cryptography": Known-plaintext attacks and chosen-plaintext attacks are more common than you might think. It ...
• 321
17 votes

### Why is "semantically secure" important for cryptosystems?

Let me try to answer your second question, and hopefully shed some light on the first one in doing so. When we encrypt a message, it's because we want to keep something about that message secret. ...
• 44.7k
17 votes

### Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

It's not necessary that you encounter a situation like this in the real world to motivate the definition. There are some weaker adversaries that you would like to rule out in your security model, and ...
• 3,812
17 votes

### Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

Practical chosen-plaintext attacks have been discovered against modern cryptosystems like TLS/SSL. One noteworthy type of vulnerability can occur when a cryptosystem includes a compression step before ...
• 271
12 votes
Accepted

### Is SHA-1 secure when used to implement a PRNG

I read SHA1 is still a secured hashing function with no collision found as of now. You read an old text, this is not the case anymore since SHA-1 was SHAttered. In Java, we still use SHA1PRNG ...
• 86.5k
11 votes
Accepted

### Decisional Diffie-Hellman: compute Legendre symbol of $g^{ab}$ from $g^a$ and $g^b$?

Because (I assume) $g$ is a generator, it is not a square (prove this), so its Legendre symbol is $-1$. And hence, the Legendre symbols of $g^a$ and $g^b$ leak the parities or $a$ and $b$. Hence they ...
• 7,944
11 votes

### Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

There are some interesting examples in section 3.4.2 of Katz-Lindell book. Here is just one of them: During World War II, the British placed mines at certain locations and (intentionally) managed to ...
• 990
10 votes
Accepted

• 126k
4 votes
Accepted

### Difference between a secure PRG and semantically secure encryption

I consider the SU Cryptography course on Coursera really good, up to certain level is very comprehensive. You should discuss these topics on the Coursera forum, IMHO you will be guided more precisely. ...
• 1,192
4 votes

### How does Signal Messenger's Safety Number Work?

Here is a detailed blog post about the safety numbers: https://signal.org/blog/safety-number-updates/ They are unique per conversation and basically consist of hashes of your and your contact's ...
• 244
4 votes
Accepted

### semantic security of RSA variant

No it's not. As a reminer: Semantic security is equivalent to IND-CPA. Semantic security is less commonly used, because most of the time proofs are less intuitive and more difficult. In the IND-CPA ...
• 12.3k
4 votes

### Security of stream cipher with a priori knowledge of message

Can we analyze using hypothesis testing (given two messages m1 and m2 with the same distribution and analyze whether ciphertext leaks any information about messages) or using entropy bounds? If the ...
• 134k
4 votes
Accepted

### Indistinguishability versus semantic security?

The definition of semantic security has its origins in the definition of perfect security, where the adversary's information about the message is the same after seeing the ciphertext. Semantic ...
• 4,467
4 votes
Accepted

### Are there any security drawbacks for simply encrypting and MACing my JWS token (JWT)?

[I]f I want the JWS token content to be non-visible, I keep hearing people mention JWE. But is there a security reason why I shouldn't be encrypting them myself? On the contrary, there is a security ...
• 46.2k
4 votes

### Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

What you are doing sounds like piling on complexity of dubious value without a clear understanding of what security the components actually provide, in the hope that enough complexity will render the ...
• 46.2k
4 votes
Accepted

### Does adding OWF of the private key to encryption scheme hurts security?

It's possible to have a secure encryption scheme that ignores the first half of its key, and a secure OWF that leaks the entire second half of its input. Composing them as in your question results in ...
• 10.8k
4 votes
Accepted

### Are there different definitions of secure two-party computation?

Defining indistinguishability is very tricky. I actually think that the definition in the book by Evans et al. is too weak, but maybe Mike Rosulek will weigh in. If you define security by saying that ...
4 votes
Accepted

3 votes

### Can a shift cipher attain perfect secrecy?

Shift cipher or ceasar cipher attains perfect secrecy only in the special case with the assumption that $26$ keys are used in equal probability in the shift cipher, and to encrypt each symbol we use a ...
3 votes

### Designing Secure Multi-Party Computation Sub-Protocols Based on Homomorphic Encryption

Since the keys are fixed from beginning (the sub-protocols input are ciphertexts), isn't it possible to give the secret key to the (non-uniform) distinguisher as an extra advice (the only restrictions ...
• 37.9k

Only top scored, non community-wiki answers of a minimum length are eligible