11

In general, that article seems to be referring to the "Another Look At..." line of work. Many of the papers are collated on this website. There are a number of "controversies" you could to attempt to summarize. The main thrust against the notion of "provable security" is that it oversells what it delivers --- provably secure ...


4

$\textrm{Exp}^{\textrm{ind-mode}}_{\mathcal{FE},A}$ is just the name given to the interaction. The "exponent" $\textrm{ind-mode}$ is part of that name. There is not really a standard, universal way of giving names to these kinds of games. But usually the author has to specify: what game is it? what scheme is being attacked? what is the attacker? ...


1

If (with a very small chance) there exist $x_1$ and $x_2$ that $H(x_1) = H(x_2)^2$, then Bob could discover it ... the simulation should always succeed, and should not depend on the input $\{x,y\}$. I agree with your friend that this observation doesn't violate semi-honest security. In the semi-honest model, the inputs are independent of the random oracle. ...


Only top voted, non community-wiki answers of a minimum length are eligible