1
$\begingroup$

It is known that there is a protocol that is secure in the random oracle model, but where any real hash function makes the protocol insecure. The proof is constructive, but I could not understand the protocol in question.

Could someone explain the protocol in language that is easier for a programmer to understand?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

I believe the "simple" examples are of the form

adversary can send honest party arbitrarily-long messages

messages sent by honest parties in that context all start with 0

when an honest party receives a message in that context that starts with 1, if the rest of that message encodes a circuit then:

  • The honest party evaluates that circuit and the oracle at a secret value.
  • If the outputs are equal then the honest party does something obviously insecure.

This paper shows that even Fiat-Shamir can fail.

Improve this answer
$\endgroup$
1
  • $\begingroup$ I can't parse this sentence "when an honest party receives a message in that context that starts with 1, if the rest of it encodes a circuit then..." $\endgroup$
    – Artjom B.
    Commented Feb 21, 2016 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.