Timeline for variant of Diffie–Hellman key exchange protocol
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 20, 2015 at 9:45 | history | edited | user2552 | CC BY-SA 3.0 |
added 1069 characters in body
|
| Aug 20, 2015 at 9:21 | comment | added | user2552 | To avoid this becoming an extended chat discussion - can you edit your original question and post the multi-A case on the end? Then I'll edit my reply as I think I have the answer. | |
| Aug 20, 2015 at 9:16 | vote | accept | Yevgeny Rosenthal | ||
| Aug 20, 2015 at 9:09 | comment | added | Yevgeny Rosenthal | In the reduction I mentioned above, if $g_3=g^{xy}$, then the $Transcript$ will be of the correct form. while in the random case, it will be of the form: $(g^{a_1},...,g^x,...,g^{a_T},g^{{a_1}b},...g^z,...,g^{{a_T}b})$ while instead of $g^z$ we should have $g^{xb}$. right? | |
| Aug 20, 2015 at 9:05 | comment | added | Yevgeny Rosenthal | They are all passive, they work according to the protocol. | |
| Aug 20, 2015 at 9:04 | comment | added | user2552 | Is the adversary still passive, or are some of the $A_i$ dishonest too? | |
| Aug 20, 2015 at 9:01 | comment | added | Yevgeny Rosenthal | I thought about the following generalization: choose some $i$ uniformly, let $A_j$ for $j \neq i$ sample $a_j$ uniformly and send $g^{a_j}$ to $B$. while $A_i$ sends $g^x$ (the first element of DDH triple). then $B$ returns $g_2^{a_j}=g^{{a_j}y}$ to $A_j$ for all $j \neq i$, and returns $g_3$ to $A_i$. But I'm not sure this is a correct reduction, because $Transcript$ should be of the form: $(g^{a_1},...,g^{a_T},g^{{a_1}b},...,g^{{a_T}b})$. while in case $g_3 \neq g^{xy}$ (i.e. was random), the output $Transcript$ of the reduction will not be of the form above | |
| Aug 20, 2015 at 8:56 | comment | added | Yevgeny Rosenthal | one more thing. my original question was a general case of the above: I have $A_1,...,A_T$ (T is polynomial), each $A_i$ sends $h_i=g^{a_i}$ to $B$ (for some $a_i$ chosen uniformly), then $B$ returns $h_i^b$ to $A_i$ for each $i$. I started with the case above to try to prove security for the case $T=1$. but I didn't see how to generalize the reduction above. | |
| Aug 20, 2015 at 8:46 | comment | added | Yevgeny Rosenthal | I see. thanks a lot for your answer :). So my first reduction was correct, but your explanation clarified why it is. | |
| Aug 20, 2015 at 8:20 | history | answered | user2552 | CC BY-SA 3.0 |