The Oracle Diffie-Hellman Assumptions and an Analysis of DHIES

By Michel Abdalla, Mihir Bellare, Phillip Rogaway. The Cryptographer's Track at RSA Conference, 2001

484 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/501b92dd5b25029266d0cbc9ca2cab40ef9da3dc

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

A Modular Analysis of the Fujisaki-Okamoto Transformation (2017, methodology): “A similar transformation was also implicitly used in the “Hashed ElGamal” encryption scheme by Abdalla et al. [1].”
Password-Based Authenticated Key Exchange in the Three-Party Setting (2005, methodology): “The definition of time-complexity that we use henceforth is the usual one, which includes the maximu m of all execution times in the experiments defining the security plus the code size [1].”
Practical Secure Aggregation for Privacy-Preserving Machine Learning (2017, methodology): “2ODH-ExpbG,M (k): (1) (G′,д,q,H )← G(k) (2) a ← Zq ;A← дa (3) b ← Zq ;B ← дb (4) if b = 1, s ← H (дab ), else s $← {0,1}k (5) MOa (·),Ob (·)(G′,д,q,H ,A,B,s)→ b ′ (6) Output 1 if b = b ′, 0 o/w. where Oa (X ) returnsH (Xa ) on anyX ̸= B (and an error on input B) and similarly Ob (X ) returns H (Xb )”
Cryptographic Extraction and Key Derivation: The HKDF Scheme (2010, background): “Note that the Photuris failure would happen also if one built on the “hash Diﬃe-Hellman (HDH) assumption” [1] where one assumes that a speciﬁc hash function, say SHA-1, acts as a good extractor from a speciﬁc group (or family of groups).”
Design and Analysis of Practical Public-Key Encryption Schemes Secure against Adaptive Chosen Ciphertext Attack (2003, methodology): “In a revised version of DHAES, called DHIES [ ABR01 ], the group G is required to have prime order, and only the shared Die-Hellman key is hashed.”
Guide to Elliptic Curve Cryptography (2004, background): “A[t −1] A[1] A[0] am−1 · · ·a(t−1)W · · · a2W−1 · · ·aW+1aW aW−1 · · · a1a0 }{{} s”
Identity-Based Signcryption (2002, background): “1 Con dentiality The de facto de nition of security for public key encryption schemes is indistinguishability of encryptions under chosen ciphertext attack [1, 3, 5, 10, 11].”
Simple Password-Based Encrypted Key Exchange Protocols (2005, methodology): “The definition of time-complexity that we use henceforth is the usual one, which includes the maximum of all execution times in the experiments defining the security plus the code size [1].”
Introduction to Modern Cryptography, Second Edition (2014, unknown): “j + S1[i] = X + S1[2] = X + S0[2] = X,”