In Universally Composable Authentication and Key-Exchange with Global PKI, Canetti et al. proposed a non-deniable authentication functionality as well as a protocol that GUC-emulates it.

My question is that, in the functionality $\mathcal{F}_{cert-auth}$, it seems impossible for a corrupted sender $S$ to change the identity of the receiver $R$ using the command $(\textsf{Corrupt-send}, ...)$, while the change of the message to be delivered is allowed. However, in real world, a corrupted sender $S$ does have the ability to change the receiver as long as its message has not been delivered until corruption. So how does the simulator work in this case?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.