I was recently reading this paper on SIKE and there on page 20 I encountered algorithm 2. I understanding line 14 of algorithm 2 in sike but I don't understanding line 17 of algorithm 2. $h (s || (c_0, c_1))$ how to shared key? result s is chosen randomly and is not known by the other party.
$\begingroup$
$\endgroup$
0
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
result s is chosen randomly and is not known by the other party.
That is correct; it is unpredictable to any other party; that's the point.
What line 16 (and lines 11-13 as well) is there for is to handle the case where someone injects an illegal ciphertext. It turns out that, with an unprotected SIDH exchange, someone can deduce your secret by giving you a series bogus ciphertexts (and checking on the resulting keyshare); see this paper for details.
What lines 11-13 do is detect whether the ciphertext was ill-formed or not. If it was generated properly, line 14 will be executed (which computes the shared secret that the legitimate peer has), If the ciphertext was not computed properly, then line 16 will be executed; this will result in an unpredictable (random looking) shared secret; the adversary who generated the ciphertext will have no advantage in deriving our secret value from that.
-
$\begingroup$ thank you! so if line 16 realized , encapsulation does not. $\endgroup$– ozdenCommented Apr 24, 2018 at 20:13
-
$\begingroup$ This is referred to as implicit rejection, mentioned here eprint.iacr.org/2017/604.pdf $\endgroup$ Commented Apr 25, 2018 at 16:50