SP2 - Crypto protocols 1 (3-pass, Secret Shar., Bit Com.)

Shamir's three-pass protocol allows...

• A user to commit to a chosen value that is kept secret until it is latter revealed.

• Two parties to exchange encrypted messages without first sharing cryptographic keys.

• To share secrets between a subset of users such that information is not leaked from individual shares.

Is Shamir's 3-pass protocol always secure (regardless of the encryption scheme used)?

• Yes

• No

Why shouldn't the Verman cipher be used in Shamir's 3-pass protocol?

• In Verman cipher, E(k2, E(k1, m))

  !=

  E(k1, E(k2, m)).

• Verman cipher is insecure.

• Using Verman within Shamir's 3-pass protocol is not secure.

• It can be used without problems.

Shamir secret sharing scheme allows...

• A user to commit to a chosen value that is kept secret until it is latter revealed.

• Two parties to exchange encrypted messages without first sharing cryptographic keys.

• To share secrets between a subset of users such that information is not leaked from individual shares.

I want to share my bank password (1234) with my 4 best friends, so that the four of them together can access my funds. Each of my friends is getting a digit of the secret (Alice gets 1, Bob gets 2, Carol gets 3, and David gets 4). Why is this not a good scheme for sharing my password?

• It is a great scheme.

• They won't be able to recover my password, even if all of them collaborate.

• Information is leaked to individual users.

I have made 4 paper copies of my bank password, and stored them in 4 different locations. In this way, if I forget the password, I would be able to recover it. Why is this not a good scheme?

• It is a great scheme.

• Each of the copies is susceptible to leakage.

• It is not useful for recovering the password.

How many points do we need to recover a 4-degree polynomial?

• 3

• 4

• 5

• 6

What are the main problems with Shamir's secret sharing scheme?

• Information can be leaked with individual shares.

• There is no way to detect cheaters.

• We need to trust someone to create the shares.

• The recovery of the secret fails in some situations.

Given C(m) a commitment to m made by user A to user B.

What are the properties of a bit commitment scheme?

• Given C(m), B can extract the committed message m.

• Given C(m), B can not learn anything from m.

• Once B knows C(m), A can change m to another value, m'.

• Once B knows C(m), A cannot change m to another value, m'.