2
$\begingroup$

I am really new to cryptography and I have asked a similar question which is about Decisional Diffie-Hellman assumption (What's the meaning of asterisk and PPT in this paper?) and it is already kind of difficult to me.

But this paper Practical Secure Aggregation for Privacy-Preserving Machine Learning (https://eprint.iacr.org/2017/281.pdf) proposes a Two Oracle Diffie-Hellman assumption, which is even more difficult to understand.

enter image description here enter image description here

Could anyone please tell me bow the oracle function is used in the adversary M? I don't even really understand what the oracle is here.

Improve this question
$\endgroup$
3
  • $\begingroup$ If you have trouble understanding the other answer perhaps take a MOOC such as Dan Boneh's to brush up on basics. You also do need understanding of probability and mathematics at least at a first college class level to understand the theoretical approach to probability, which includes things like advantage, randomised protocols, etc. $\endgroup$
    – kodlu
    Commented May 10, 2022 at 11:01
  • 1
    $\begingroup$ @kodlu I understand the math part. $\endgroup$
    – user900476
    Commented May 10, 2022 at 11:07
  • $\begingroup$ I am not sure but I think the oracle is there to account for the the keys that the adversary might have learnt from previous sessions. Since it is a public chosen $X$ attack modeled as an oracle, it can be used to prevent session compromise if it was not actively attacked via DH MiTM because it was authenticated or something, even if other sessions using the same public keys on two sides and the same hash function $H$ was used $\endgroup$
    – Manish Adhikari
    Commented Jun 12, 2022 at 4:15

1 Answer 1

Reset to default
1
$\begingroup$

The oracles are giving the image by $H$ of $X^a$ (for $\mathcal{O}_a$) and $Y^b$ (for $\mathcal{O}_b$) for any $X\neq B$ and $Y\neq B$.

Notice there is a typo in the definition, because $b$ is used for the definition of the bit parameter, and the scalar challenge (Here I'm considering the scalar challenge).

Improve this answer
$\endgroup$
2
  • $\begingroup$ Thank you very much! Could you please tell me how the adversary M uses the oracles to produce b'? $\endgroup$
    – user900476
    Commented May 12, 2022 at 18:18
  • $\begingroup$ We do not know. The principle of a security analysis is to consider we don't know exactly how the adversary computes its output. $\endgroup$
    – Ievgeni
    Commented May 12, 2022 at 22:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.