# Tag Info

9

The general scheme is called Three-pass protocol and works for all commutative ciphers. It is secure for some of them, but xor (and modular addition) are insecure choices. Your scheme: A->B: $c_1 = m \oplus a$ B->A: $c_2 = c_1 \oplus b$ A->B: $c_3 = c_2 \oplus a$ B computes $m = c_3 \oplus b$ an attacker sees all of $c_1$, $c_2$ and $c_3$. So they can ...

9

The name I would use for this protocol is "broken". It is insecure. An eavesdropper gets to observe $Q_0 = P \oplus CM$, $Q_1 = Q_0 \oplus SM = P \oplus CM \oplus SM$, and $Q_2 = Q_1 \oplus CM = P \oplus SM$. Notice that we have the relation $$Q_0 \oplus Q_1 \oplus Q_2 = (P \oplus CM) \oplus (P \oplus CM \oplus SM) \oplus (P \oplus SM) = P.$$ Therefore, ...

3

See malleability and commitment schemes. You are apparently looking for a collusion-preserving implementation of simultaneous broadcast. By letting each processor control at least one player and directing each processor to choose a random bit for each of its players and outputting the xor of all players' random bits, the resulting coin-flipping protocol is ...

1

I suspect that the professor is thinking of Quadratic Residuosity. A value $x$ is a quadratic residue (modulo $p$) if there exists a $y$ such that $y^2 \equiv x \pmod p$. This is important, because: For any value $x$ (and prime $p$), it's easy to determine whether it's a quadratic residue or not. If $e$ is relative prime to $p-1$, then $x^e$ is a ...

1

How many bits long should the prime modulus $M$ be in order to be secure? The modulus $M$ should be long enough to prevent discrete logarithms from being computable. As of 2015 this means 2048 bits length is fine, but for other (official) recommendations you should consult keylength.com Should the $M$ be secret? You can make $M$ secret but making ...

1

This is very difficult, if you don't trust anyone, as Ricky Demer explains. You can have each party publish a commitment to their move. However, the main problem is that a malicious party might decide not to open their commitment. For instance, suppose Alice publishes a(non-malleable) commitment to her move, and Bob publishes a commitment to his move. ...

Only top voted, non community-wiki answers of a minimum length are eligible