New answers tagged

0

The question is essentially why the line If this record is compromised, or either $P_i$ or $P_j$ is corrupted, then output $(sid, sk)$ to player $P_i$. is used in the ideal functionality, rather than If this record is compromised, $P_i$ is corrupted, or $P_j$ is corrupted and there is a record $(P_j, P_i, pw')$ with $pw' = pw$, then output $(sid, sk)$ to ...


3

You're right that it's not UC-secure, for exactly the reason you say. It allows offline dictionary attacks. Here's how that problem manifests in the UC model: Consider this particular environment: Environment chooses honest party's password $pw$ uniformly from some known polynomial-size dictionary $\mathcal D$ (without loss of generality $\mathcal{D} = \{1,...


Top 50 recent answers are included