Pseudorandomness. (Sketched) Any probabilistic poly- nomial time adversary cannot distinguish the output of a VRF from a uniform random variable. Intuitively, pseudorandomness requires that the output of a VRF should be indistinguishable from a string sampled from a uniform distribution. APPENDIX B PROOF IN RBA
Pseudorandomness. K A must be indistinguishable from a truly random string to all parties except A, and B, and those parties that have broken into A or B or have compromised that session of A or B. These requirements must remain true even in the presence of adversaries. There are two essential ideas in modeling the adversary in the SK-security model. The first is to model the network as a star with the adversary at the hub. All messages sent from one host intended for another host first go to the adversary. Furthermore, the adversary can modify, reroute, stall, reorder, inject, and/or drop any and all messages. This captures the adversary’s ability to mount “man-in-the-middle” attacks, as well as eavesdropping on packets before sending them on their way to the intended recipient. The second modification is to allow the adversary to control the timing of events and thus, for example, to control the interleaving of sessions made possible by the concurrent capability of the protocol. In this model the protocol is event/message driven. In particular, a protocol session in a host may be initiated by an initiate-session event in the host itself, in which case the host is the initiator in that protocol session. Such an event specifies the intended responder for that session. A protocol session in a host may also be initiated by the receipt of a message from the adversary (i.e., ostensibly from another host), in which case the host is the responder in that protocol session. The adversary is given the power to issue initiate-session events to hosts in any fashion it sees fit. Recall the adversary also controls the timing of the sending and receiving of all messages. The adversary can thus create arbitrary interleavings of messages of multiple sessions within the same host. As alluded to above, a key-agreement protocol is said to be SK-secure if it meets the security requirements above even in the face of an adversary with the above powers that runs in a feasible amount of time. But to be a bit more precise we need to expand on the pseudorandomness requirement, which is to say we need to describe the meaning of pseudorandomness in our context, and the capabilities given to the adversary in its attempt to distinguish a session key from a truly random string. In addition to dynamically initiating sessions and controlling the timing/content of all received messages, the adversary is allowed to make session-key queries. That is, it is allowed to dynamically query a host of its choosing a...
