# Tag Info

1

You can assume CDH assumption. Suppose A's public and private key $g^x$ and $x$. In the same way, B's public and private key $g^y$, $y$. Then shared secret key $g^xy$ will have same concept with $a=e(d_{A},B)$. IF CDH is hard, then no one but A and B can compute $a$

4

The authors describe it that way because the functions operate on different inputs and produce different outputs. In your first example $H$ outputs an $n$ bit string, while in the second $H$ outputs an element of the field $F_q$. Clearly, one can represent an element of a field $F_q$ by a bitstring of size $n$ for some $n$ (using some suitable encoding). ...

2

The eprint version has the following to say (adapted for your notation): Authenticated-decrypt: [...] Check that $s = H_3(\gamma, Msg)$. If not, reject the ciphertext, otherwise output then plaintext $Msg$. In the attackers case, the decryption oracle would try to check if $s = H_3(\gamma', Msg)$ with $\gamma'=\gamma \oplus H_{2}(a,s) \oplus H_{2}(t,... 1 Both are correct, you've just made an error calculating it. Here is a simplification from my answer here: $$\begin{eqnarray} p(n) & = & 1 - \frac{q!}{q^n\left(q-n\right)!}\\ & = & 1 - \frac{\prod^q_{i=q-n+1}i}{q^n}\\ & = & 1 - \prod^q_{i=q-n+1}\frac{i}{q} \end{eqnarray}$$ So,$$\begin{eqnarray} p(2) & = & 1 - \prod^q_{i=q-... 1 "Guessed ID" means ID that the oracle guesses the attacker algorithm$A\$ will attack.

1

If you assume that you can use a one-time-pad they would be equivalent. Otherwise a cipher will always be slower than XOR. The chances that it matters much compared to the other functions required is about zero though.

Top 50 recent answers are included