密码算法与协议3_密钥的确认全解.ppt

* * * Coin Flipping by Telephone Alice and Bob want to make some decision based on a random coin -- if the coin is “head” Alice gets the right and if the coin is “tail”, Bob gets the right Alice is in Beijing Bob is in Shanghai * * Using Commitment Protocol Alice choose a random bit b Alice send to Bob her commitment blob Bob guess the value of the bit Alice open the Blob Head if Bob is wrong and tail if Bob is right * * Coin Flipping Protocol A selects rA ?R ?0,1?; Commits to rA B sends bit rB ?R ?0,1? Coin is rA ? rB If A doesn’t open - result is ? If A’s opening is invalid - result is ? * * Interactive Proof System Let L ? {0,1}* be a language One party, the Prover P, want to convince the other party, Verifier V that X ?L In our case: both parties are PPTM; exchange messages and flip coins Prover P may have some extra information W At the end of the protocol Verifier V state ?{accept, reject} For a given W the interaction between V and P induces a distribution of the transcripts Prover P Verifier V * * Witness Protection Programs A witness indistinguishable proof system for X?L Prover p ? Verifier V Completeness: if prover P has witness W - can construct effective proof that makes verifier V accept. Soundness: if X?L no prover P* can succeed with high probability to make verifier V accept. Witness Indistinguishability: for every V* and any witnesses W1 and W2: distributions on transcripts are computationally indistinguishable. No polynomial time test can distinguish the two * * Example: Hamiltonicity Common input graph G=(V,E) L is the language of graphs with Hamiltonian cycles G=(V,E) ?L if and only if there is a cycle C=(i1,i2, ? in) covering all nodes of V once and (ij,ij+1 ) ? E * * Example: Hamiltonicity Common input graph G=(V,E) L is the language of graphs with Hamiltonian cycles Witness W – a Hamiltonian Cycle C=(i1,i2, ? in) Protocol: Prover P selects a random permutation ? of the nodes Commits to the adjacency