Cryptography Reference
In-Depth Information
As we know, after
m
h
runs of the protocol, we accomplish to find one victim
half-nonce, after
m
e
extra runs of the protocol, we have
β
=2
m
h
+2
m
e
equations
and
β
half-nonces which
m
e
+ 1 of them can be inferred. The probability that
none of these
m
e
+ 1 half-nonces match is:
Pr(Having no pair after
m
h
+
m
e
runs) =
(
β
−
1)
(
β
−
2)
(
β
−
m
e
)
β
×
×
...
×
β
β
=
m
e
i
=1
(
β
−
i
)
(23)
β
(
m
e
)
Consequently, the probability of having at least one pair after observing
m
e
runs
is simply calculated by (24).
P
e
= Pr(Having at least one pair of matching half-nonces after
m
h
+
m
e
runs)
m
e
i
=1
(
β
−
i
)
=1
−
(24)
β
(
m
e
)
By using (22) and (24) the total number of protocol runs to have at least one
complete victim nonce (
m
t
=
m
h
+
m
e
) can be calculated by (25) and is plotted
in Figure 3.
P
t
= Pr(Having at least one complete nonce after
m
t
runs)
=(
P
e
|
m
h
=
h
)
×
Pr
(
m
h
=
h
)=(
P
e
|
m
h
=
h
)
×
P
h
(
h
)
(25)
Remark.
The authors of [17] have also calculated
m
t
by using some other pro-
tocol outputs (
B
and
C
). Figure 3 compares our results with what the authors
”Expected”. This comparison has been conducted for two different security pa-
rameters
N
=128,
N
=256 which are plotted on the left and right respectively. The
results show that the security margin of the protocol in terms of the number of
consecutive runs that must be observed to infer one nonce is less than what the
designers of the protocol expected. In other words, we need less number of pro-
tocol runs to infer at least one nonce. For example a passive adversary is able to
infer a complete nonce with high probability of 0.99 by eavesdropping less that
60 and 90 runs of the protocol for the key size of 128 and 256 bits respectively.
These numbers were expected to be 110 and 200 respectively.
4.2 Phase II: Finding the Constant Nonce
Having
m
h
consecutive runs of the protocol observed, we have one constant
half-nonce or one half-nonce with only one possible value. In order to find this
half-nonce, we adopt the following algorithm.
Algorithm Inputs
:
A
(
i
)
,...,A
(
i
+
m
t
−
1)
,D
(
i
)
,...,D
(
i
+
m
t
−
1)
1. Determine a level of confidence(probability) for the final results.
2. Find the
m
h
,
m
t
related to the determined probability from Figures 1,2
respectively.
Search WWH ::
Custom Search