0
$\begingroup$

In Universally Composable Authentication and Key-Exchange with Global PKI, Canetti et al. proposed a non-deniable authentication functionality as well as a protocol that GUC-emulates it.

My question is that, in the functionality $\mathcal{F}_{cert-auth}$, it seems impossible for a corrupted sender $S$ to change the identity of the receiver $R$ using the command $(\textsf{Corrupt-send}, ...)$, while the change of the message to be delivered is allowed. However, in real world, a corrupted sender $S$ does have the ability to change the receiver as long as its message has not been delivered until corruption. So how does the simulator work in this case?

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.