New answers tagged

2

The specific attack you describe doesn't seem possible, because, at the point where the fake client would need to commit to a nonce, the server doesn't yet know the other clients' nonces, but only their hashes. Provided that the nonces have sufficient entropy to resist brute force attacks, it should not be possible force the server to learn them just from ...


1

One possibility is the sloth and unicorn approach of this paper. The idea is essentially to use a slow (but quickly verifiable) hash. If the sever publishes a commitment to all the shares within a few seconds of the start of the hash computation (which will start at a agreed-to time), and the hash can't be done in less than an hour, then the server can't ...


2

Yes, this is secure. Even simpler would be to just use XSalsa20-Poly1305 and the long term key directly. You could authenticate any additional data with the Poly1305 just as well as in the case of the ChaCha-based combination. However, if you use e.g. libsodium where the former interface does not support additional data and the latter has a short nonce, ...


2

First, recall that in a chosen-ciphertext attack (CCA) model, the attacker has access to a decryption oracle. A scheme is said CCA-secure if access to a decryption oracle does not give any advantage to the attacker. Knowing this, a very simple CCA attack can be done on BasicIdent. I will use the description of the scheme from Wikipedia. As you can see, ...


4

I have written a tutorial on how to write simulation-based proofs. I think that it should be helpful.



Top 50 recent answers are included