Fundamental Ideas III

• From Thayer, Herzog, Guttman: the ideal [THG98]

• Let S be the set of primitive fields that are secret by policy

  • Private or shared keys and any other shared secrets

• The ideal I[k, S] is the smallest set T such that

  1. T includes S
  
  2. X in T implies {X, Y} in T and {Y, X} in T (any Y)
  3. X in T and K in k implies {X}K in T

• Let k be the set of keys whose inverses are not in S.

  • Assume that keys are not computed: i.e., no key is expressible as {X, Y} or {X}Y.

• Inductive invariant for secrecy: no message is in I[k, S].

  • Sufficient because I[k, S] includes S and anything obtained by the attacker may be sent as a message.

Previous slide

Next slide

Back to first slide

View graphic version