Common use of Con dentiality Clause in Contracts

Con dentiality. Finally we consider the con dentiality of message contents. We use SCS1 as an example, as discussions for SCS2 are similar. Given the signcrypted text (c; r; s) of a message m from ▇▇▇▇▇, an attacker can obtain u = (ya gr)s = gx mod p. Thus to the attacker, data related to the signcrypted text of m include: q, p, g, ya = gxa mod p, yb = gxb mod p, u = gx mod p, c = Ek1 (m), r = KHk2 (m), and s = x=(r + xa) mod q. partial information on the message m from the related data listed above. We will achieve our goal by reduction: we will reduce the con dentiality of another encryption scheme to be de ▇▇▇ shortly (called Ckh for convenience) to the con dentiality of SCS1. The encryption scheme Ckh is based on ElGamal encryption scheme. With this encryp- tion scheme, the ciphertext of a message m to be sent to ▇▇▇ is de ▇▇▇ as ( c = Ek1 (m), u = gx mod p, r = KHk (m) ) where (1) x is chosen uniformly at random from [1;::: ;q 1], and (2) (k1; k2) = k = hash(yx mod p), It turns out Ckh is a slightly ▇▇▇▇ ▇▇ version of a scheme that has received special attention in [53, 5]. (See also earlier work [59].) Us- ing a similar argument as that in [53, 5], we can show in the following that for Ckh, it is computationally infeasible for an adaptive attacker to gain any partial information on m. We assume that there is an attacker for SCS1. Call this attacker ASCS1. We show how ASCS1 can be translated into one for Ckh, called ACkh . Recall that for a message m, the input to ASCS1 includes q, p, g, ya = gxa mod p, yb = gxb mod p, u = gx mod p, c = Ek1 (m), r = KHk2 (m). With the attacker ACkh for Ckh, however, its input includes: q, p, g, yb = gxb mod p, u = gx mod p, c = Ek (m), and r = KHk (m). One immediately identi es that two numbers that correspond to ya and s which are needed by ASCS1 as part of its input are currently missing from the input to ACkh . Thus, in order for ACkh to \call" the attacker ASCS1 \as a sub-routine", ACkh has to create two numbers corresponding to ya and s in the input to ASCS1. Call these two yet-to-be-created numbers y0 and s0. y0 s0 have to have the right form so that AC can \fool" ASCS1. It turns out that such y0 s0 can be easily created by AC (1) pick a random number s0 from [1;::: ;q 1]. (2) let y0 = u1=s g r mod p. From the reduction, we see that if there is an attacker that nds any partial information on a message in SCS1, then the attacker can be used to nd partial information on a message in Ckh. As we have already proven the con dentiality of Ckh, we conclude that no attacker for SCS1 can nd any partial information on a message. There are two minor technicalities that remain to be removed, before we can complete our full formal proof of the con dentiality of SCS1. First we have assumed that ASCS1 works for all ya and yb. Namely ASCS1 is universally powerful with respect to ya and yb. This requirement on ASCS1 can be relaxed to that it works for a non-negligible portion of all valid public keys. Second, our discussions on the proof have been informal. This problem can be removed by the use of a standard model for security established in [22], in conjunction with proof techniques used in [59] or [53, 5].

Con dentiality. Finally we consider the con dentiality of message contents. We use SCS1 as an example, as discussions for SCS2 are similar. Given the signcrypted text (c; r; s) of a message m from ▇▇▇▇▇, an attacker can obtain u = (ya gr)s = gx mod p. Thus to the attacker, data related to the signcrypted text of m include: q, p, g, ya = gxa mod p, yb = gxb mod p, u = gx mod p, c = Ek1 (m), r = KHk2 (m), and s = x=(r + xa) mod q. partial information on the message m from the related data listed above. We will achieve our goal by reduction: we will reduce the con dentiality of another encryption scheme to be de ▇▇▇ shortly (called Ckh for convenience) to the con dentiality of SCS1. The encryption scheme Ckh is based on ElGamal encryption scheme. With this encryp- tion scheme, the ciphertext of a message m to be sent to ▇▇▇ Bob is de ▇▇▇ as ( c = Ek1 (m), u = gx mod p, r = KHk (m) ) where (1) x is chosen uniformly at random from [1;::; : ;: : ; q 1], and (2) (k1; k2) = k = hash(yx mod p), It turns out Ckh is a slightly ▇▇▇▇ ▇▇ version of a scheme that has received special attention in [53, 5]. (See also earlier work [59].) Us- ing a similar argument as that in [53, 5], we can show in the following that for Ckh, it is computationally infeasible for an adaptive attacker to gain any partial information on m. We assume that there is an attacker for SCS1. Call this attacker ASCS1. We show how ASCS1 can be translated into one for Ckh, called ACkh . Recall that for a message m, the input to ASCS1 includes q, p, g, ya = gxa mod p, yb = gxb mod p, u = gx mod p, c = Ek1 (m), r = KHk2 (m). With the attacker ACkh for Ckh, however, its input includes: q, p, g, yb = gxb mod p, u = gx mod p, c = Ek (m), and r = KHk (m). One immediately identi es that two numbers that correspond to ya and s which are needed by ASCS1 as part of its input are currently missing from the input to ACkh . Thus, in order for ACkh to \call" the attacker ASCS1 \as a sub-routine", ACkh has to create two numbers corresponding to ya and s in the input to ASCS1. Call these two yet-to-be-created numbers y0 and s0. y0 s0 have to have the right form so that AC can \fool" ASCS1. It turns out that such y0 s0 can be easily created by AC (1) pick a random number s0 from [1;::; : ;: : ; q 1]. (2) let y0 = u1=s g r mod p. From the reduction, we see that if there is an attacker that nds any partial information on a message in SCS1, then the attacker can be used to nd partial information on a message in Ckh. As we have already proven the con dentiality of Ckh, we conclude that no attacker for SCS1 can nd any partial information on a message. There are two minor technicalities that remain to be removed, before we can complete our full formal proof of the con dentiality of SCS1. First we have assumed that ASCS1 works for all ya and yb. Namely ASCS1 is universally powerful with respect to ya and yb. This requirement on ASCS1 can be relaxed to that it works for a non-negligible portion of all valid public keys. Second, our discussions on the proof have been informal. This problem can be removed by the use of a standard model for security established in [22], in conjunction with proof techniques used in [59] or [53, 5].