New answers tagged

1 vote
Accepted

Is there a winning strategy based on this coin-flipping protocol?

There is a subtle distinction here that must be made explicit. We must consider two flavors of security definitions: "Security with Abort": A corrupt party is allowed to see their output, ...
user avatar
  • 10.6k
1 vote

Is there a winning strategy based on this coin-flipping protocol?

Alice chooses a bit $a$ and sends $c = commit(a)$ to Bob. Bob chooses and returns $b$ to Alice. Alice computes $a\oplus b$ and, if it is $0$, she continues the protocol by sending $open(c)$. If it ...
user avatar
  • 101
2 votes

Proving that a protocol is not attackable

Without clearly defined attacker capabilities nor security guarantees of the different components (public-key encryption, hash function, etc). It is not easy to say whether or not this protocol is &...
user avatar
  • 1,237
2 votes

Proving that a protocol is not attackable

I'll assume a lot about the protocol that's not explicit in the question. I state some of that in the second section of this answer. Also I won't make my arguments overly detailed. The desired ...
user avatar
  • 122k
2 votes
Accepted

Version rollback attack prevention in TLS 1.2?

Rollback by tampering the ClientHello/ServerHello exchange is detected and blocked by Finished in all versions of TLS. For plain-RSA keyexchange the client version is additionally 'smuggled' in the ...
user avatar
1 vote

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Your question is essentially: Is it useful to be able to sample a tuple $(Q_1, Q_2, \dots, Q_n) \in E(F)^n$ such that no relation is known among the points, but the tuple is not sampled from the ...
user avatar
  • 4,382
2 votes

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

There is a "hash-to-point" function used in several schemes, where it is necessary to generate an EC point where the discrete log w.r.t. any other EC point is unknown. In particular: A ...
user avatar
  • 2,598
8 votes
Accepted

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Do you know protocols where it is necessary to obtain several "independent" points on the same elliptic curve? One obvious place where this occurs if you are implementing a Pedersen ...
user avatar
  • 131k

Top 50 recent answers are included