# Tag Info

1 vote
Accepted

### Is there a winning strategy based on this coin-flipping protocol?

There is a subtle distinction here that must be made explicit. We must consider two flavors of security definitions: "Security with Abort": A corrupt party is allowed to see their output, ...
• 10.6k
1 vote

### Is there a winning strategy based on this coin-flipping protocol?

Alice chooses a bit $a$ and sends $c = commit(a)$ to Bob. Bob chooses and returns $b$ to Alice. Alice computes $a\oplus b$ and, if it is $0$, she continues the protocol by sending $open(c)$. If it ...
• 101

### Proving that a protocol is not attackable

Without clearly defined attacker capabilities nor security guarantees of the different components (public-key encryption, hash function, etc). It is not easy to say whether or not this protocol is &...
• 1,237

### Proving that a protocol is not attackable

I'll assume a lot about the protocol that's not explicit in the question. I state some of that in the second section of this answer. Also I won't make my arguments overly detailed. The desired ...
• 122k
Accepted

### Version rollback attack prevention in TLS 1.2?

Rollback by tampering the ClientHello/ServerHello exchange is detected and blocked by Finished in all versions of TLS. For plain-RSA keyexchange the client version is additionally 'smuggled' in the ...
• 5,401
1 vote

### Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Your question is essentially: Is it useful to be able to sample a tuple $(Q_1, Q_2, \dots, Q_n) \in E(F)^n$ such that no relation is known among the points, but the tuple is not sampled from the ...
• 4,382

### Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

There is a "hash-to-point" function used in several schemes, where it is necessary to generate an EC point where the discrete log w.r.t. any other EC point is unknown. In particular: A ...
• 2,598