Game G3. In this game, we do exactly as above, except that any hash value involving an αi (either 0(c αi i∈Gc ) or 1(c αi)), asked by the players or the server are answered indepen- dently from the random oracles. Since the same hash queries, asked by the adversary, are still answered by querying the random oracles, some inconsistency may occur. Such an inconsistency is discovered by the adversary if such a hash query is asked by the adversary, event which we denote by XxxX: | Pr[S3] — Pr[S2]| ≤ Pr[AskH]. Such an event AskH means that some αi (among at most qs, since at most qs valid signatures have been produced, and thus at most qs values for yi’s which each leads to one αi) appears in the list of the hash queries. Since we do not need anymore α, β and C either for the simulation (they were just required in Game G2 for simulating K and the Ki), we are now just given A and B. By guessing the αi instance (and thus the δi) that has been asked by the adversary, and the corresponding hash-query (and thus the αi), one extracts C = αiA−δi : G Pr[AskH] ≤ qHqs × Succcdh(t).
Game G3. Allowing to Choose Keys For Two Honest Parties With Close Pass-strings P P ≤
Game G3. Building FiPAKE. In this game, we start modeling FA-iPAKE. First, we let F maintain two initially empty lists: ΛP , a list of tuples of the form (Pi, pwi) and ΛL, a list of tuples of the form (Pi, A). Upon receiving a query (NewSession, sid, pwi, A) from (dummy) party Pi, if this is the first NewSession query, or if this is the second NewSession query and there is a record (P1−i, pw1−i, Aj), then F records (Pi, pwi) in ΛP and marks this record as fresh. If ΛL does not contain any record (Pi, ·) so far, F also records (Pi, A) in ΛL. Then, F relays the query (NewSession, sid, pwi, A) to S. Now that F knows about pass-strings and labels, we can add a TestPwd interface to F as described in Figure 8. We let S parse outputs (sid, Aj, ki) towards F to be of the form (NewKey, sid, Pi, Aj, ki) by adding the NewKey tag and the name of the party who produced the output. Additionally, we let F translate this back to (sid, Aj, ki) and send it to Z via the dummy party Pi, marking the corresponding record as completed Z None of these modifications changes the output towards compared to the previous game G2. ← ⊥ F
Game G3. It simulates a situation in which the adversary wins the game because of hash oracle collision. When 𝒜 issues the query, 𝐷𝑒𝑣 returns the appropriate response from 𝐿𝑇 and 𝐿𝐻 lists that store transcripts and hash records, respectively. The game is over when random numbers or hash oracles collide. Based on birthday 𝑞 paradox, the probability of collision for hash oracles and random numbers is ℎ and 2𝜆 (𝑞𝑠+𝑞𝑒)2 2𝜆 , respectively. This game is undistinguishable from the previous one, and thus |Pr[𝑆𝑢𝑐𝑐 𝒜(𝑡)] − Pr[𝑆𝑢𝑐𝑐 𝒜(𝑡)]| ≤ 𝑞2+(𝑞𝑠+𝑞𝑒)2
