Distinguisher’s Resources Sample Clauses

Distinguisher’s Resources. ‌ We consider an information-theoretic distinguisher D that has access to either the real world (KD[p]L , p±) or the ideal world (AIXIF[ro]L , p±), where p is some K K permutation and L some leakage function. Two basic measures to quantify the distinguisher’s resources are its online complexity M and offline complexity N : – M : the number of distinct construction calls, either initialization or duplexing calls; – N : the number of distinct primitive queries. ›→ · ǁ ⊕ ›→ ǁ For each construction call, we define a path path that “registers” the data that got absorbed in the duplex up to the point that the cryptographic primitive (p in the real world and ro in the ideal world) is evaluated. For an initialization call (δ, IV ) ∅, the associated path is defined as path = encode[δ] IV . For each duplexing call (flag,P ) Z, the value [flag ] (Z 0b−r ) M is appended to the path of the previous construction query. Not surprisingly, the definition matches the actual definition of path in the AIXIF[ro]K construction of Algorithm 3, but defining the same thing for the real world will allow us to better reason about the security of the keyed duplex. Note that the value path contains no information that is secret to the distinguisher. In order to reason about duplexing calls, we will also define a subpath of a path, which is the path leading to the particular duplexing call. In other words, for a path path, it subpath is simply path with the last b bits removed. In order to derive a detailed and versatile security bound, that in particular well-specifies how leakage influences the bound, we further parameterize the distinguisher as follows. For initialization calls: – q: the number of initialization calls; – qIV : the maximum number of initialization calls for a single IV ;