Equational security proofs of oblivious transfer protocols
B Li, D Micciancio - Public-Key Cryptography–PKC 2018: 21st IACR …, 2018 - Springer
Public-Key Cryptography–PKC 2018: 21st IACR International Conference on …, 2018•Springer
We exemplify and evaluate the use of the equational framework of Micciancio and Tessaro
(ITCS 2013) by analyzing a number of concrete Oblivious Transfer protocols: a classic OT
transformation to increase the message size, and the recent (so called “simplest”) OT
protocol in the random oracle model of Chou and Orlandi (Latincrypt 2015), together with
some simple variants. Our analysis uncovers subtle timing bugs or shortcomings in both
protocols, or the OT definition typically employed when using them. In the case of the OT …
(ITCS 2013) by analyzing a number of concrete Oblivious Transfer protocols: a classic OT
transformation to increase the message size, and the recent (so called “simplest”) OT
protocol in the random oracle model of Chou and Orlandi (Latincrypt 2015), together with
some simple variants. Our analysis uncovers subtle timing bugs or shortcomings in both
protocols, or the OT definition typically employed when using them. In the case of the OT …
Abstract
We exemplify and evaluate the use of the equational framework of Micciancio and Tessaro (ITCS 2013) by analyzing a number of concrete Oblivious Transfer protocols: a classic OT transformation to increase the message size, and the recent (so called “simplest”) OT protocol in the random oracle model of Chou and Orlandi (Latincrypt 2015), together with some simple variants. Our analysis uncovers subtle timing bugs or shortcomings in both protocols, or the OT definition typically employed when using them. In the case of the OT length extension transformation, we show that the protocol can be formally proved secure using a revised OT definition and a simple protocol modification. In the case of the “simplest” OT protocol, we show that it cannot be proved secure according to either the original or revised OT definition, in the sense that for any candidate simulator (expressible in the equational framework) there is an environment that distinguishes the real from the ideal system.
Springer
Showing the best result for this search. See all results