On the Bit Security of Cryptographic Primitives

Micciancio, Daniele; Walter, Michael

doi:10.1007/978-3-319-78381-9_1

Cited by 33 publications

(47 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…, where for an arbitrary adversary A, T A and A are the resources and attack success probability of the adversary, respectively. Micciancio and Walter defined a new notion of bit security by designing a new concept of a security game [2]. Using their newly devised security game, they redefined the advantage of an adversary in terms of information-theoretic quantities.…”

Section: New Notion Of Bit Securitymentioning

confidence: 99%

“…Definition 1 (Definition 5, [2]). An n-bit security game is played by an adversary A who is interacting with a challenger C. At the beginning of the game, the challenger chooses a secret c, which is represented by a random variable C ∈ {0, 1} n , from a distribution D C .…”

Section: New Notion Of Bit Securitymentioning

confidence: 99%

“…In addition, A may output a special symbol ⊥ such that R(c, ⊥) and R c (c, ⊥) are both false. Definition 3 (Definition 10, [2]). For a search game, the advantage of the adversary A is adv A = α A β A , whereas for a decision game, it is…”

Section: New Notion Of Bit Securitymentioning

confidence: 99%

“…The contributions of this study are as follows: First, we derive tighter security reduction bounds compared with the works by Micciancio and Walter [1], [2]. Second, we propose further generalized versions of both Micciancio and Walter's [1] and Yasunaga's [12] security reductions by relaxing the constraints on the upper measurement bounds, such as λefficient measures and the Hellinger distance.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Bit Security Estimation Using Various Information-Theoretic Measures

Lee

Kim

2021

IEEE Access

View full text Add to dashboard Cite

In this paper, we propose various quantitative information-theoretic bit security reduction measures that correlate the statistical difference between two probability distributions with the security level gap for two cryptographic schemes. We derive tighter relations between information-theoretic measures for quantifying the precision and guarantee the security level of the cryptographic scheme implemented over a precision-restricted environment. Further, the generalized versions of previous security reductions are devised by relaxing the constraints on the upper bounds of the information-theoretic measures. This makes it possible to estimate bit security more reliable and improves the security level. We also estimate the effects on the security level when the κ-bit secure original scheme is implemented on a p-bit precision system. In previous studies, p was fixed as κ 2 ; however, the proposed schemes are generalized such that the security level κ and precision p can vary independently. This results in a significant difference. Moreover, previous results cannot provide the exact lower bound of the security level for p = κ 2 . However, the proposed results can provide the exact lower bound of the estimation value of the security level as long as the precision p satisfies certain conditions. We provide diverse types of security reduction formulas for the six types of information-theoretic measures. The proposed schemes can provide information-theoretic guidelines regarding the difference between the security levels of two identical cryptographic schemes when extracting randomness from two different probability distributions. In particular, the proposed schemes can be used to quantitatively estimate the effect of the statistical difference between the ideal and real distributions on the security level.

show abstract

Section: New Notion Of Bit Securitymentioning

confidence: 99%

Section: New Notion Of Bit Securitymentioning

confidence: 99%

Section: New Notion Of Bit Securitymentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Bit Security Estimation Using Various Information-Theoretic Measures

Lee

Kim

2021

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Since our focus is on the proof technique for TLS 1.3, we chose to consider this simple view on bit security. Alternatively, Micciancio and Walter [58] recently proposed a formal notion for bit security. They try to overcome paradoxical situations occurring with a simple notion of bit security as discussed above.…”

Section: Introductionmentioning

confidence: 99%

On the Tight Security of TLS 1.3: Theoretically Sound Cryptographic Parameters for Real-World Deployments

Diemert

Jager

2021

J Cryptol

View full text Add to dashboard Cite

We consider the theoretically sound selection of cryptographic parameters, such as the size of algebraic groups or RSA keys, for TLS 1.3 in practice. While prior works gave security proofs for TLS 1.3, their security loss is quadratic in the total number of sessions across all users, which due to the pervasive use of TLS is huge. Therefore, in order to deploy TLS 1.3 in a theoretically sound way, it would be necessary to compensate this loss with unreasonably large parameters that would be infeasible for practical use at large scale. Hence, while these previous works show that in principle the design of TLS 1.3 is secure in an asymptotic sense, they do not yet provide any useful concrete security guarantees for real-world parameters used in practice. In this work, we provide a new security proof for the cryptographic core of TLS 1.3 in the random oracle model, which reduces the security of TLS 1.3 tightly (that is, with constant security loss) to the (multi-user) security of its building blocks. For some building blocks, such as the symmetric record layer encryption scheme, we can then rely on prior work to establish tight security. For others, such as the RSA-PSS digital signature scheme currently used in TLS 1.3, we obtain at least a linear loss in the number of users, independent of the number of sessions, which is much easier to compensate with reasonable parameters. Our work also shows that by replacing the RSA-PSS scheme with a tightly secure scheme (e.g., in a future TLS version), one can obtain the first fully tightly secure TLS protocol. Our results enable a theoretically sound selection of parameters for TLS 1.3, even in large-scale settings with many users and sessions per user.

show abstract