pseudorandom-function oracle-Diffie-Hellman (PRF-ODH) assumption

最新推荐文章于 2024-06-22 17:15:00 发布

Sherlma_

最新推荐文章于 2024-06-22 17:15:00 发布

阅读量124

点赞数

分类专栏：安全协议文章标签： AKE Cryptography

本文链接：https://blog.csdn.net/weixin_44399975/article/details/133605943

版权

安全协议专栏收录该内容

26 篇文章 1 订阅

订阅专栏

PRF-ODH:

The PRF-ODH assumption basically says that the function value $\color{red}{PRF(g^{uv},x^*)}$ for a DH key $\color{red}{g^{uv}}$ looks random, even if given $\color{red}{g^u}$ and $\color{red}{g^v}$ and if seeing related values $\color{red}{PRF(S^u,x)}$ and/or $\color{red}{PRF(T^v, x)}$ for chosen values $\color{red}{S,T,x}$ .

Active adversary can submit a modified value $\color{red}{S}$ instead of $\color{red}{g^v}$ to the client, then it can obtain a related key $\color{red}{PRF(S^u, ...)}$ on the clients’ side. The server’ session key is still $\color{red}{PRF(g^{uv}, ...)}$ . The PRF-ODH assumption guarantees now that the server’s key is still fresh.

Simple authentication of transmissions cannot remedy the above problem. Since the adversary could use a corrupted server’s key to achieve authenticaiton. Then the Diffie–Hellman keys in the executions would still be non-trivially related. This happens especially if keys are used in multiple sessions.

[CRYPTO 2017] PRF-ODH: Relations, Instantiations, and Impossibility Results