Institute of Cryptography Science and Technology,
Government Information Security Committee, Hanoi, Vietnam
Abstract:
In this paper we consider two variants of the basic SIGMA protocol in which the MAC tag is not sent separately but rather it is computed under the signature operation. As a consequence, both these variants are secure in the Canetti–Krawczyk “post-specified peer” model.
Fulltext:
PDF file (288 kB)