CAFL-▇▇▇ Model Sample Clauses

CAFL-▇▇▇ Model. M 1. M makes any sequence of the following queries: – Send(A, B, msg, f ). sends a message msg to party A on behalf of party B and is given the re- sponse according to the protocol specification, along with the leakage f (skA) where skA is the long-term secret key of A and f is a leakage function. – Corrupt(A). This query is the same as the LongtermKeyReveal(A) query in ▇▇▇ secure ex- periment. is given the long-term key of A. – EphemeralKeyReveal(A, B, sid). This query is the same as the EphemeralKeyReveal(A, B, sid) query in ▇▇▇ secure experiment. is given the ephemeral key of A and B in session sid. – Reveal(sid). This query is the same as the Reveal(sid) query in ▇▇▇ secure experiment. is given a session key of a completed session sid. 2. selects a completed session sid and makes the fol- lowing query: – Test(sid). This query is the same as the Test(sid) query in ▇▇▇ secure experiment. is given a challenge C which equals to Reveal(sid) if b = 1 and is a random string if b = 0 for some randomly picked b ∈ {0, 1}. 3. makes queries as in Phase 1. 4. makes the following query and the experiment termi- nates: – Guess(bj). M submits the value of bj. The selected test session is λ-CAFL-▇▇▇-fresh if all the following conditions hold: • did not make Reveal(sid) or Reveal(sid∗) (if sid∗ exists) • sid∗ exists and did not make any set of the following queries: – Corrupt(A) and EphemeralKeyReveal(A, B, sid) – Corrupt(B) and EphemeralKeyReveal(B, A, sid∗) • sid∗ does not exist and did not make any set of the following queries: – Corrupt(A) and EphemeralKeyReveal(A, B, sid) – Corrupt(B) • For each Send(A, B, msg, f ) query, |f (skA)| ≤ λ M wins the CAFL-▇▇▇ security experiment if bj = b and P 2 the test session is λ-CAFL-▇▇▇-fresh. The ▇▇▇ model covers most passive and active attacks but not the side-channel attacks. It allows the attacker to reveal Definition 2 (λ-CAFL-▇▇▇ security): An AKA protocol P is λ-CAFL-▇▇▇-secure if no efficient adversary M wins the CAFL-▇▇▇ security experiment with a nonnegligible advan- tage defined as Advλ−CAF L−▇▇▇(M) = Pr[M wins] − 1 . Let P be an AKA protocol constructed from an AKA proto- col Pj using a leakage-resilient encoding protocol Encodem and a leakage-resilient refreshing protocol Refreshm . The following theorem shows the relation between the CAFL-▇▇▇ security of P and the ▇▇▇ security of Pj [37]. It will be used in the security proof of the proposed Protocol II. Theorem 3: Protocol P is λ-CAFL-▇▇▇-secure if the underlying ...