I remember reading a book on cryptography with a section detailing the objectives that modern cryptography must accomplish, one being that even if the algorithm is known, the method remains secure. I.e. the so-called Kerckhoffs's principle. What are the other standards an algorithm must accomplish and why are they necessary?

closed as too broad by Matthew, Adi, Steffen Ullrich, TildalWave, Neil Smithline Mar 13 '16 at 16:56

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


What you are referring to is Kerchoff's Principle. Beside that a couple of formalizations of security criteria (along with very simplified explanations) are:


These roughly say that ciphertexts should not leak information about the plaintext, and that plaintexts should not allow an adversary to infer anything about their corresponding ciphertexts. Some more details here.

MACs and Digital Signatures

  • Strong existential forgery under chosen message attack (SUF-CMA)
  • Weak existential forgery under chosen message attack (WUF-CMA)

See page 11 of this paper. These roughly describe the ability of an adversary to forge a signature for a given message without having knowledge of the signing key.

Hash Functions

These roughly say that given the output of a hash function it should computationally intractable to find the input to the function that produced that output or to find two values that produce the same output when fed through the hash function.

  • To round up puzzlepalace's great answer: yes, there are some broad "mantra recommendations" that one should keep in mind at any moment in crypto ("don't roll your own, don't rely on security through obscurity", etc.). Those are important "common sense" recommendations, but the most strict and important requirements usually depend on what you intend to achieve. Integrity and confidentiality have many instances, and there is little benefit in generalizing rules instead of considering each case specifically. – Sergio Andrés Figueroa Santos Mar 13 '16 at 11:25
  • Your answer has "Strong existential forgery under chosen message attack" twice. ​ ​ – user49075 Mar 13 '16 at 18:00
  • In both WUF-CMA and SUF-CMA we have access to a "tagging oracle" i.e. we can get valid tags for messages we submit to the oracle. in WUF-CMA we can reuse these tags and and try to to create a message for which one of these tags is valid. For SUF-CMA the tag may not be one of the tags that was returned by the oracle. – puzzlepalace Mar 13 '16 at 22:23
  • @puzzlepalace : ​ Your last two sentences have "tag(s)" and "message(s)" backwards. ​ ​ ​ ​ – user49075 Mar 14 '16 at 3:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.