8
M. Kutyłowski et al.
2. The Watchdog chooses n-bit blocks θ and κ at random and presents them to the
Device,
3. The Device recomputes the basic commitment:
t := t
⊕ θ, k := k
⊕ κ, c := Enc k (t)
and presents c to the Watchdog,
4. the Watchdog chooses α at random and computes
t := t
⊕ θ, ζ := Enc c (α)
5. The Watchdog presents the final commitment (t, α, ζ ) concerning the element k
to the Reader.
Note that the Watchdog has no control over the correctness of execution of the
third step and therefore the Device can potentially install a covert channel in c.
However, at this moment c is hidden behind the commitment (α, ζ ) chosen by the
Watchdog. So in particular, the potential covert channel is hidden as well.
However, it is necessary to note that the Device should not be given the freedom
to interrupt the protocol execution. Otherwise the Device could selectively interrupt
the execution depending on the values of t and k and in this way leak some secret
bits.
Opening the commitment is controlled by the Watchdog in the following way:
1. the Device presents k to the Watchdog,
2. the Watchdog computes k := k ⊕ κ and aborts if
c
= Enc k (t
), or c = Enc k (t
⊕ θ),
3. the Watchdog presents k to the Reader,
4. the Reader computes ¯
c := Enc k (t), and accepts the opening if ζ = Enc ¯
c (α).
Note that breaking this commitment by the adversary is at least as hard as knownplaintext cryptanalysis. Namely, for a (plaintext, ciphertext) pair (α, ζ ) one can
choose t at random and present it to the adversary. Indeed, for any key ψ that is
a solution for (α, ζ ), for most values t there is a key k such that ψ = Enc k (t).
1.2.3.3 Encrypted Random Challenge
We assume that the protocol requires the Device to send a random challenge r as
a ciphertext Enc k (r) for the key k shared with the Reader. The following protocol
enables the Watchdog to control the situation:
1. the Watchdog sends a commitment θ to an element α chosen at random (for this
purpose the basic commitment from Sect. 1.2.3.2 can be used),
M. Kutyłowski et al.
2. The Watchdog chooses n-bit blocks θ and κ at random and presents them to the
Device,
3. The Device recomputes the basic commitment:
t := t
⊕ θ, k := k
⊕ κ, c := Enc k (t)
and presents c to the Watchdog,
4. the Watchdog chooses α at random and computes
t := t
⊕ θ, ζ := Enc c (α)
5. The Watchdog presents the final commitment (t, α, ζ ) concerning the element k
to the Reader.
Note that the Watchdog has no control over the correctness of execution of the
third step and therefore the Device can potentially install a covert channel in c.
However, at this moment c is hidden behind the commitment (α, ζ ) chosen by the
Watchdog. So in particular, the potential covert channel is hidden as well.
However, it is necessary to note that the Device should not be given the freedom
to interrupt the protocol execution. Otherwise the Device could selectively interrupt
the execution depending on the values of t and k and in this way leak some secret
bits.
Opening the commitment is controlled by the Watchdog in the following way:
1. the Device presents k to the Watchdog,
2. the Watchdog computes k := k ⊕ κ and aborts if
c
= Enc k (t
), or c = Enc k (t
⊕ θ),
3. the Watchdog presents k to the Reader,
4. the Reader computes ¯
c := Enc k (t), and accepts the opening if ζ = Enc ¯
c (α).
Note that breaking this commitment by the adversary is at least as hard as knownplaintext cryptanalysis. Namely, for a (plaintext, ciphertext) pair (α, ζ ) one can
choose t at random and present it to the adversary. Indeed, for any key ψ that is
a solution for (α, ζ ), for most values t there is a key k such that ψ = Enc k (t).
1.2.3.3 Encrypted Random Challenge
We assume that the protocol requires the Device to send a random challenge r as
a ciphertext Enc k (r) for the key k shared with the Reader. The following protocol
enables the Watchdog to control the situation:
1. the Watchdog sends a commitment θ to an element α chosen at random (for this
purpose the basic commitment from Sect. 1.2.3.2 can be used),