Game G3 definition
Game G3. We now furthermore reject any signed-authenticator that is non-oracle-generated whereas the player is still honest: the adversary does not know the signing key, and thus cannot correctly sign the authenticator. One can easily show that a di erence between G2 and G3 would lead to an attack against the one-time signature scheme.
Game G3. In this game, we abort the protocol runs if the adversary has been lucky in guessing the values k1 and k2 without asking the corresponding random oracle queries. We achieve this aim by adding more steps to processing the Send queries in the simulation. In processing the Send(Ci, ⟨µ, k1⟩) query, the client should check if ⟨2, C, S, m, µ, α, γ', k1⟩ ∈ LA or ⟨⟨C, m⟩, ⟨µ, k1⟩, ∗⟩ ∈ LP just before setting AcceptCi true (that is, right after checking that k1 = k1' ). If both tests fail, the client should terminate without accepting. In pro- cessing the Send(Sj, k2) query, the server should check if ⟨3, C, S, m, µ, β, γ', k2⟩ ∈ LA or ⟨⟨C, m⟩, ⟨µ, k1⟩, k2⟩ ∈ LP just before setting AcceptSj true (that is, right after checking that k2 = k2' ). If both tests fail, the server should terminate without accepting. This modification ensures that k1 and k2 will come, in valid form, from either the simulator that traces pairing or an adversary that has asked correct random oracle queries in all accepted cases. The two games G3 and G2 are perfectly indistinguishable unless the client rejects the valid k1 or the server rejects the valid k2. The rejection may happen only if the adversary has correctly guessed the values k1 and k2 without asking the corresponding random oracle queries. So we have: |Pr[Succ3] − Pr[Succ2]| ≤ O(qse)
Game G3. This game considers a situation where A obtains the correct message transcript luckily without active participation of hash oracles H. The authentication phase of our protocol involves six messages communication mi, (i=1,..
Examples of Game G3 in a sentence
Game G3: F generates a random session key for an interrupted session.
RFE outputs bot as both parties’ keys, since the outputs don’t matter - takes care of outputting appropriate keys as of a few games ago (Game G3 if d(pw0, pw1) δ, and Games G4,G5 otherwise), so this change is not observable by the environment.
More Definitions of Game G3
Game G3. This game is exactly same as the game G2 except that we use an instance (A = ga, B = gb) of CDH problem with its solution C = gab and the given values a, b in the simulation according to the following distribution of transcript, session key pair. ←− Z∗; k , . . . , k ←− {0, 1}l 1 2 3 c1
Game G3. In this game, the attacker can, compared to the previous game, in addition execute Corrupt queries. As a result of the Corrupt(D) query, the attacker is able to extract dd and thus to retrieve K and perform the decryption in order to find Qu, Cd h rd, cd. However, as the attacker will not be able to find the response on the challenge, according to the predefined assumptions, it will not be able to find h and to derive a legitimate response to the user’s device or to construct the SK. When executing Corrupt(U, 1) query, the attacker has no access to the stored data and thus cannot derive useful information. Executing Corrupt(U, 2) will not lead to useful information unless the biometric data is correctly guessed, while in Corrupt(U, 3) the password should be guessed in order to be successful, following Equation 3. As a consequence: |Pr[succ3(A)] − Pr[succ2(A)]| ≤ legitimate entity, each one can conclude that the request is authenticated. As a consequence, impersonation and man-in-the-middle attacks become impossible. • Anonymity and untracebility: The identity related in- formation is encrypted in the message M1. Without knowledge of the private key material dd or z + du, C cannot be decrypted to derive the identity. For the same reasons, no guessing attacks allow to reveal the identity from M2. Also, the identity related information Qu on the device is stored encrypted. • Perfect forward secrecy: Suppose that βu, pwu are 3qs + C′qs′ , (6) leaked of the user’s device and access is obtained to
Game G3. The difference between G2 and G3 is that |Hash| |PUF| |D| where qh , qP , and qsend denote the number of hash, PUF, and Send queries, respectively. Also, Hash , PUF , and D denote the length of the hash output, length of the PUF-based output strings, and the length of the output of an algorithm that simulations of the Send and PUF queries are included in G3 . In the proposed scheme, we assume that the PUFs used in the UAVs are secure as defined in Section V-B. Therefore, as in G2 , we also have: AKE pAKE protocol, respectively. resolves a particular problem by running A on a simulation A,G2 A,G3 2|PUF| Adv − Adv ≤
Game G3. In this game, if the adversary A can fake ⟨Sj, Fi, θ, ρ, Lj⟩ without making the random oracle queries, • Event E4: Similar to event E3, A is allowed to ask the Update(V a, UPW ) query. A can obtain updat- the scheme is simply terminated. This situation only appears in the Send queries. As a result, Games G3 and G2 are perfectly indistinguishable unless the vehicle rejects Sj or Lj, or the RA
Game G3. This game is exactly same as the game G2 except that we use an instance (A = ga, B = gb) of CDH problem with its solution C = gab and the given values a, b in the simulation according to the following distribution of transcript, session key pair. ←− Z∗; k , . . . , k ←− {0, 1}l 1 2 3 c1 n q 1 n c2 x3 xn oracle goes into an expecting state. X1 = A , X2 = B , X3 = g , . . . , Xn = g ; Similarly on Send1(Un, dn, Y1) and Send1(Un, dn, Yn−1) = Epw