Read the summary and the most important questions on UT201500042 (PET)

• Lecture 1

  This is a preview. There are 3 more flashcards available for chapter 25/04/2017
  Show more cards here

• When is a system IND-secure?

  
  
  
  A system is said to have indistinguishable encryptions if no adversary can win the following game with probability greater than one half. The adversary will run in two stages:
  • Find: In the “find” stage the adversary produces two plaintext messages m0 and m1, of equal length.
  • Guess: The adversary is now given the encryption c∗ of one of the plaintexts mb for some secret hidden bit b. The goal of the adversary is to now guess the value of b with probability greater than one half. 

• Lecture 2

  This is a preview. There are 10 more flashcards available for chapter 04/05/2017
  Show more cards here

• What 3 things are discussed when looking what to hide?

  
  
  
   Sender anonymity:
  attacker cannot determine (within the anonymity set) who the sender of a particular message is
   Receiver anonymity:
  attacker cannot determine (within the anonymity set) who the intended receiver of a particular message is
   Unlinkability:
  attacker cannot link several messages to the same sender/receiver 

• What is the difference between onion routing and mix networks?

  
  • no batching of messagesglobal passive attacks!
  • avoids costly public-key encryption as much as possible
  • connection-oriented: uses public-key crypto to establish a network route

• Explain how hidden services work in TOR.

  
  
  
  Hidden services and rendezvous points
  

  •   Location-hidden services, accessible via a TOR client
    
  •   Hidden services maintain connections to introduction points (IPs),
    which are publicly advertised ORs
    
  •   Client specifies one OR called rendezvous point (RP) and establishes anonymous/TOR circuit to IP, specifying her RP
    
  •   Server connects to RP, who connects Alice’s and Bob’s circuits 
    

• Lecture 3

  This is a preview. There are 11 more flashcards available for chapter 11/05/2017
  Show more cards here

• What anonymous credential do we study? What is one of it's restrictions?

  Algebraic MACs - Chase-Meiklejohn-Zaverucha.
  A restriction is that the issuer also has to be the verifier.

• When is a commitment scheme hiding? Computationally/information theoretically?

  
  
  
  
  C is computationally (resp. information theoretically) hiding if no computationally bounded (resp. unbounded) adversaries A can win in the above game with non-negligible (in λ) probability. 

• What opposing propperties do the pederson commitment scheme and the El Gamal commitment scheme have?

  Pederson: computationally binding, information theoretically hiding.
  
  ElGamal: computationally hiding, information theoretically binding

• Lecture 5

  This is a preview. There are 5 more flashcards available for chapter 01/06/2017
  Show more cards here

• Give the 1-out-of-2 oblivious transfer protocol. What is the input?

  : Input is OT(x1,x2;s). x1 and x2 are the secrets from the sender, s is the selectio nbit of user 2 (receiver). Output is xs.

• How can you develop the logical AND gate in the oblivious transfer protocol?

  (= the love game!). OT(0,x;y)=xy.

• Give the additively homomorphic ElGamal scheme. What is the difference with 'normal' ElGamal? What is the downside?

  Downside: only usable if mesage space is small because decryption returns g^m.
  
  Normal ElGamal: E(m)=(g,h*m)