Introduction Shoup's lemma Secrecy OEKE Conclusion

Bruno Blanchet

Description

Introduction Shoup's lemma Secrecy OEKE Conclusion A second look at Shoup's lemma Bruno Blanchet INRIA, Ecole Normale Superieure, CNRS, Paris partly supported by ANR ProSe (decision 2010-VERS-004-01) June 2011 Bruno Blanchet (INRIA, ENS, CNRS) A second look at Shoup's lemma June 2011 1 / 18

• introduction shoup's lemma


• password per


• factors can


• ?? pn


• shoup's lemma


• breaks secrecy


• secrecy oeke


• ecole normale

Sujets

• Blanchet
• École normale

Informations

• Publié par: pefav
• Nombre de lectures: 10
• Langue: English

Extrait

IntroductionShopus’elmmSaceerycKEOEncCosiluon nuBorBA,ENINRIhet(lancoldnocesA)SRNC,Smaemslp’ouShatok

Bruno Blanchet [e-mail]

´ INRIA,EcoleNormaleSupe´rieure,CNRS,Paris

neJu1120181/

partly supported by ANR ProSe (decision 2010-VERS-004-01)

June 2011

A second look at Shoup’ le s mma

nIrtdocuitnoCEKEOyceoisulcnoslp’ouShcrSemaemn S)As,CNR,ENSNRIAteI(nahconlBBur1/8

Improve probability bounds in proofs by sequences of games: Shoup’s lemma introduces constant factors in probabilities of success of attacks. We show that these constant factors can be eliminated. The definition of secrecy introduces a factor 2 in the probability that an adversary breaks secrecy. We show that this factor can sometimes be partly eliminated.

Introduction

Improvements implemented in CryptoVerif.

Application to the password-based protocol OEKE (One-Encryption Key Exchange) . We show that the adversary can test at most one password per session of the client or of the server (instead of 3 passwords per interaction with the client or server in the initial paper).

e2un1201le’saJmmStakpuohnoceoold