0
$\begingroup$

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in the sense of IND-ATK. Let $B = \left(B_{1}, B_{2} \right)$ be an adversary attacking $\Pi$ in the sense of NM-ATK.

The inputs of $A_{1}$ and $B_{1}$ are both the public key $pk$. The output of $A_{1}$ is $(x_{0}, x_{1}, s_{A} )$ but the one of $B_{1}$ is $(M, s_{B})$.

What makes the outputs different? Why not the output of $B_{1}$ just includes two messages instead of a set of messages?

Actually, $A_{2}$ and $B_{2}$ are both used to compare two messages in some sense.

$\endgroup$
1
$\begingroup$

You say:

Actually, $A_2$ and $B_2$ are both used to decide which one of two messages are encrypted for the challenge.

However, this is not true. The definition of the IND and NM games are different. This difference is summarized in this paragraph from the very same paper [Section 2.3]:

The goal of the adversary, given a ciphertext y, is not (as with indistinguishability) to learn something about its plaintext $x$, but only to output a vector $\mathbf y$ of ciphertexts whose decryption $\mathbf x$ is “meaningfully related” to $x$, meaning that $R(\mathbf x, x)$ holds for some relation $R$.

$\endgroup$
  • $\begingroup$ emm, it seems that I express wrong, I mean $A_2$ is used to decide which one of two is encrypted, and $B_2$ is used to decide which one of two is related. It is enough to give $B_2$ two message, instead of a set $M$. $\endgroup$ – TeamBright Nov 10 '17 at 2:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.