Some classical random oracle reference
This commit is contained in:
Jeffrey Burdges
parent
0359e829f3
commit
2036c42a77
74
doc/paper/ro.bib
Normal file
74
doc/paper/ro.bib
Normal file
@ -0,0 +1,74 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
@inproceedings{BR-RandomOracles,
|
||||||
|
dblp = {DBLP:conf/ccs/BellareR93},
|
||||||
|
author = {Mihir Bellare and
|
||||||
|
Phillip Rogaway},
|
||||||
|
title = {Random Oracles are Practical: {A} Paradigm for Designing Efficient
|
||||||
|
Protocols},
|
||||||
|
booktitle = {{CCS} '93, Proceedings of the 1st {ACM} Conference on Computer and
|
||||||
|
Communications Security, Fairfax, Virginia, USA, November 3-5, 1993.},
|
||||||
|
pages = {62--73},
|
||||||
|
year = {1993},
|
||||||
|
crossref = {DBLP:conf/ccs/1993},
|
||||||
|
url = {http://doi.acm.org/10.1145/168588.168596},
|
||||||
|
doi = {10.1145/168588.168596},
|
||||||
|
timestamp = {Fri, 23 Dec 2011 14:54:25 +0100},
|
||||||
|
biburl = {http://dblp.uni-trier.de/rec/bib/conf/ccs/BellareR93},
|
||||||
|
bibsource = {dblp computer science bibliography, http://dblp.org}
|
||||||
|
}
|
||||||
|
|
||||||
|
@proceedings{DBLP:conf/ccs/1993,
|
||||||
|
editor = {Dorothy E. Denning and
|
||||||
|
Raymond Pyle and
|
||||||
|
Ravi Ganesan and
|
||||||
|
Ravi S. Sandhu and
|
||||||
|
Victoria Ashby},
|
||||||
|
title = {{CCS} '93, Proceedings of the 1st {ACM} Conference on Computer and
|
||||||
|
Communications Security, Fairfax, Virginia, USA, November 3-5, 1993},
|
||||||
|
publisher = {{ACM}},
|
||||||
|
year = {1993},
|
||||||
|
url = {http://dl.acm.org/citation.cfm?id=168588},
|
||||||
|
isbn = {0-89791-629-8},
|
||||||
|
timestamp = {Fri, 09 Dec 2011 14:34:06 +0100},
|
||||||
|
biburl = {http://dblp.uni-trier.de/rec/bib/conf/ccs/1993},
|
||||||
|
bibsource = {dblp computer science bibliography, http://dblp.org}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
@inproceedings{Rudich88,
|
||||||
|
dblp = {DBLP:conf/crypto/ImpagliazzoR88},
|
||||||
|
author = {Russell Impagliazzo and
|
||||||
|
Steven Rudich},
|
||||||
|
title = {Limits on the Provable Consequences of One-way Permutations},
|
||||||
|
booktitle = {Advances in Cryptology - {CRYPTO} '88, 8th Annual International Cryptology
|
||||||
|
Conference, Santa Barbara, California, USA, August 21-25, 1988, Proceedings},
|
||||||
|
pages = {8--26},
|
||||||
|
year = {1988},
|
||||||
|
crossref = {DBLP:conf/crypto/1988},
|
||||||
|
url = {http://dx.doi.org/10.1007/0-387-34799-2_2},
|
||||||
|
doi = {10.1007/0-387-34799-2_2},
|
||||||
|
timestamp = {Fri, 18 Sep 2009 08:51:10 +0200},
|
||||||
|
biburl = {http://dblp.uni-trier.de/rec/bib/conf/crypto/ImpagliazzoR88},
|
||||||
|
bibsource = {dblp computer science bibliography, http://dblp.org}
|
||||||
|
}
|
||||||
|
|
||||||
|
@proceedings{DBLP:conf/crypto/1988,
|
||||||
|
editor = {Shafi Goldwasser},
|
||||||
|
title = {Advances in Cryptology - {CRYPTO} '88, 8th Annual International Cryptology
|
||||||
|
Conference, Santa Barbara, California, USA, August 21-25, 1988, Proceedings},
|
||||||
|
series = {Lecture Notes in Computer Science},
|
||||||
|
volume = {403},
|
||||||
|
publisher = {Springer},
|
||||||
|
year = {1990},
|
||||||
|
isbn = {3-540-97196-3},
|
||||||
|
timestamp = {Thu, 07 Feb 2002 09:41:39 +0100},
|
||||||
|
biburl = {http://dblp.uni-trier.de/rec/bib/conf/crypto/1988},
|
||||||
|
bibsource = {dblp computer science bibliography, http://dblp.org}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
@ -1,90 +0,0 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
\begin{proposition}
|
|
||||||
If there are no refresh operations, then any adversary who links
|
|
||||||
coins can recognize blinding factors.
|
|
||||||
\end{proposition}
|
|
||||||
|
|
||||||
\begin{proof}
|
|
||||||
In effect, coin withdrawal transcripts consist of numbers $b m^d \mod n$
|
|
||||||
|
|
||||||
The blinding factor is created with a full domain hash
|
|
||||||
\end{proof}
|
|
||||||
|
|
||||||
|
|
||||||
We say a blind signature
|
|
||||||
linkable if some probabilistic polynomial
|
|
||||||
time (PPT) adversary has a non-negligible advantage indentifying
|
|
||||||
the
|
|
||||||
|
|
||||||
|
|
||||||
, given some withdrawal and refresh
|
|
||||||
transcripts
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
We say a coin $C_0$ is {\em linkable} to the withdrawal or refresh
|
|
||||||
operation in which it was created if some probabilistic polynomial
|
|
||||||
time (PPT) adversary has a non-negligible advantage in guessing
|
|
||||||
which of $\{ C_0, C_1 \}$ were created in that operation,
|
|
||||||
where $C_1$ is an unrelated third coin.
|
|
||||||
|
|
||||||
% TODO: Compare this definition with some from the literature
|
|
||||||
% TODO: Should this definition be broadened?
|
|
||||||
|
|
||||||
.. reference literate about withdrawal ..
|
|
||||||
|
|
||||||
\begin{proposition}
|
|
||||||
In the random oracle model,
|
|
||||||
if a coin created by refresh is linkable to the refresh operation
|
|
||||||
that created it, then some PPT adversary has a non-negligible
|
|
||||||
advantage in determining the shared secret of an eliptic curve
|
|
||||||
Diffie-Hellman key exchange on curve25519.
|
|
||||||
\end{proposition}
|
|
||||||
|
|
||||||
% Intuitively this follows from \cite{Rudich88}[Theorem 4.1], but
|
|
||||||
% we provide slightly more formality.
|
|
||||||
|
|
||||||
\begin{proof}
|
|
||||||
Assume a PPT adversary $A$ has a non-negligible advantage in solving
|
|
||||||
the linking problem.
|
|
||||||
|
|
||||||
We have two curve points $C = c G$ and $T = t G$ for which
|
|
||||||
we wish to compute the shared secret $c t G$.
|
|
||||||
|
|
||||||
We make $C$ into a coin by singing it with a denomination key
|
|
||||||
invented for this purpose. We let $T^{(1)}$ denote $T$ and
|
|
||||||
invent $\kappa-1$ linking keys $T^{(2)},\ldots,T^{(\kappa)}$.
|
|
||||||
|
|
||||||
We shall extract the shared secret by constructing an algorithm
|
|
||||||
that runs the refresh protocol and then runs $A$ using the natural
|
|
||||||
simulation of a random oracle, namely answering new queries with
|
|
||||||
random bits, yet recording the answers in a database so as to
|
|
||||||
provide idendical answers to identical queries.
|
|
||||||
|
|
||||||
We may take $\gamma=1$ by restarting the exchange with a clean
|
|
||||||
database. As a result, the exchange never checks the commitment
|
|
||||||
covering $T^{(1)}$, but this alone does not suffice to discount
|
|
||||||
the any information contained in the commitment.
|
|
||||||
|
|
||||||
Instead, we observe that our commitments consist of random oracle
|
|
||||||
queries distinct from anything else in the protocol, so they contain
|
|
||||||
no information of use to $A$, and can safely be omitted.
|
|
||||||
|
|
||||||
We do not know $c t G$ so our simulation cannot run the KDF to
|
|
||||||
derive the new coin that $A$ can link.
|
|
||||||
|
|
||||||
|
|
||||||
... random oracle ..
|
|
||||||
\end{proof}
|
|
||||||
|
|
||||||
In principle, one might worry if coins created in the same withdrawal
|
|
||||||
or refresh opeartion might be linkable to one another without being
|
|
||||||
linkable to the operation, but addressing this concern would take us
|
|
||||||
somewhat far afield and require similar methods.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user