# Tag Info

9

The general scheme is called Three-pass protocol and works for all commutative ciphers. It is secure for some of them, but xor (and modular addition) are insecure choices. Your scheme: A->B: $c_1 = m \oplus a$ B->A: $c_2 = c_1 \oplus b$ A->B: $c_3 = c_2 \oplus a$ B computes $m = c_3 \oplus b$ an attacker sees all of $c_1$, $c_2$ and $c_3$. So they can ...

9

The name I would use for this protocol is "broken". It is insecure. An eavesdropper gets to observe $Q_0 = P \oplus CM$, $Q_1 = Q_0 \oplus SM = P \oplus CM \oplus SM$, and $Q_2 = Q_1 \oplus CM = P \oplus SM$. Notice that we have the relation $$Q_0 \oplus Q_1 \oplus Q_2 = (P \oplus CM) \oplus (P \oplus CM \oplus SM) \oplus (P \oplus SM) = P.$$ Therefore, ...

3

See malleability and commitment schemes. You are apparently looking for a collusion-preserving implementation of simultaneous broadcast. By letting each processor control at least one player and directing each processor to choose a random bit for each of its players and outputting the xor of all players' random bits, the resulting coin-flipping protocol is ...

1

This is very difficult, if you don't trust anyone, as Ricky Demer explains. You can have each party publish a commitment to their move. However, the main problem is that a malicious party might decide not to open their commitment. For instance, suppose Alice publishes a(non-malleable) commitment to her move, and Bob publishes a commitment to his move. ...

Only top voted, non community-wiki answers of a minimum length are eligible