taler/exchange
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

More on RSA-KTI

Browse Source
This commit is contained in:
Jeffrey Burdges 2017-06-02 15:55:49 +02:00
parent b217058821
commit 9f7e3bb2bd
No known key found for this signature in database
GPG Key ID: 07D3102EF1A1B9AD
2 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
doc/paper/taler.bib
View File

@ -368,7 +368,7 @@
} }
@inbook{RSA-HDF-KTIvCTI, @inbook{RSA-FDH-KTIvCTI,
author="Bellare, Mihir and Namprempre, Chanathip and Pointcheval, David and Semanko, Michael", author="Bellare, Mihir and Namprempre, Chanathip and Pointcheval, David and Semanko, Michael",
editor="Syverson, Paul", editor="Syverson, Paul",
chapter="The Power of RSA Inversion Oracles and the Security of Chaum's RSA-Based Blind Signature Scheme", chapter="The Power of RSA Inversion Oracles and the Security of Chaum's RSA-Based Blind Signature Scheme",

12
doc/paper/taler.tex
View File

@ -509,7 +509,7 @@ financial reserve. In addition, Taler includes an \emph{auditor} who
assures customers and merchants that the exchange operates correctly. assures customers and merchants that the exchange operates correctly.
%\vspace{-0.3cm} %\vspace{-0.3cm}
\subsection{Security considerations} \subsection{Security considerations}\label{subsec:security_rough}
%\vspace{-0.3cm} %\vspace{-0.3cm}
As a payment system, Taler naturally needs to make sure that coins are As a payment system, Taler naturally needs to make sure that coins are
@ -559,7 +559,7 @@ limiting the exchange's financial liability.
On the cryptographic side, a Taler exchange demands that coins use a On the cryptographic side, a Taler exchange demands that coins use a
full domain hash (FDH) to make so-called ``one-more forgery'' attacks full domain hash (FDH) to make so-called ``one-more forgery'' attacks
provably hard, assuming the RSA known-target inversion problem is provably hard, assuming the RSA known-target inversion problem is
hard~\cite[Theorem 12]{RSA-HDF-KTIvCTI}. For a withdrawn coin, hard~\cite[Theorem 12]{RSA-FDH-KTIvCTI}. For a withdrawn coin,
violating the customers anonymity cryptographically requires recognizing violating the customers anonymity cryptographically requires recognizing
a random blinding factor from a random element of the group of a random blinding factor from a random element of the group of
integers modulo the denomination key's RSA modulus, which appears integers modulo the denomination key's RSA modulus, which appears
@ -1466,6 +1466,14 @@ protocol is never used.
\subsection{Exculpability arguments} \subsection{Exculpability arguments}
In \S\ref{subsec:security_rough},
we quoted \cite[Theorem 12]{RSA-FDH-KTIvCTI} that RSA-FDH blind
signatures are secure against ``one-more forgery'' attacks, assuming
the RSA known-target inversion problem is hard.
We note as well that ``one-more forgery'' attacks cover both the
refresh operation as well as the withdrawal operarion
\cite[Definition 12]{RSA-FDH-KTIvCTI,OneMoreInversion}.
\begin{lemma}\label{lemma:double-spending} \begin{lemma}\label{lemma:double-spending}
The exchange can detect, prevent, and prove double-spending. The exchange can detect, prevent, and prove double-spending.
\end{lemma} \end{lemma}