Game G0 definition
Game G0. In G0, a real attack against our proposed scheme from A is simulated. Firstly, the value of b is selected randomly. According to the above definitions, we obtain: AdvInd = 2 · Pr[Succ0] − 1 (27) Game G1: To increase the probability that A wins game, the query Execute is used to model the eavesdropping attacks. Since its goal is to get some information about SK, A has to compute skU or skS according to the definition of the proposed scheme; however, skU = rS(rU + N(x))P, where rU, rS are unknown. Without corrupting the gateway node GWN to get dGWN, the probability of success would not be increased just by eavesdropping the transmitted messages, which implies that Pr[Succ1] = Pr[Succ0] (28)
Game G0. The real protocol execution. This is the real execution where the environment Z runs the EKE2 protocol (see Figure 26) with parties P0 Receiver R
Game G0. This is the real attack. The X generates a pair of signing/verification key and the U0 is given a pair of public-private key. It answers all queries of the adversary in accordance of the protocol. Game G1: Let Forge be an event that A asks for a send query to the U0 such that the verification of the signature is correct and m′ was not previously out- put by a client as an answer to another send query. It means that A is sending a message that it has pro- duced itself. Such an event can be detected by X as it Protocol User U0 round Message Dyn Auth Verif PS
Examples of Game G0 in a sentence
Game G0: Game G0 is the real game in the random-oracle and ideal-tweakable-cipher models: the simulator simulates all the honest players as they would do according to the protocol, using the passwords sent by the environment.
A, Gi Game G0 : It is simulated as an actual attack by A against PUF outputs an arbitary string of length l2 .
More Definitions of Game G0
Game G0. The starting game G0 is the real attack experi- ment by the adversary against the proposed AKA scheme in the random oracle model. The value of c is selected randomly by at the beginning of the experiment. According to the definition of semantic security [46], [47], it follows that,
Game G0. This game simulates an ordinary attack by an
Game G0. This game corresponds with the real attack against the defined scheme. From the definition, it holds that Adv(A) = 2Pr[succ0(A) − 1] (3) • Game G1: This game corresponds with a passive attack in which the adversaries can intercept the messages and thus Execute queries are performed, followed by a Test query. However, from the intercepted messages M1, M2, the attacker is not able to derive additional information and thus, it follows that Pr[succ1(A)] = Pr[succ0(A)] (4)
Game G0. This is the real protocol in the random oracle model. The oracles including five random oracles (H0, h1, h2, h3, and h4) and all instances (Ci and Sj) are thus available to the adversary. By definition, tp Advake−fs(A) = 2Pr[Succ0] − 1. Then we furthermore assume that we choose a random bit b' if the game aborts or stops with no answer b' from the adversary, or the adversary has not finished the game with more than qse queries or lasts for more than time t where qse and t are predetermined upper-bounds.
Game G0. This game G0 is the real game as defined earlier. ∆ initializes the game by generating public-private key pairs for all the participants as specified by the protocol and choosing a random bit b, which is used by him to answer the Test query. Then it answers all queries of the adversary in accordance with the protocol P . Game G1: The game G1 is identical to G0 except that ∆ aborts if a signature forgery occurs for some player U before any Corrupt(U) query was made. We denote such an event by E1. Using a well-know lemma we get: | Pr[W in0] | ≤ - Pr[W in1] Pr[E1]. Note that ∆ can detect a signature forgery for some player U when he finds a valid message, not generated by him (all messages generated by ∆ are stored in the Sessions table), in some session before the Corrupt query was made to U . |P|∗ Calculation of Pr[E1]: The event E1 occurs when the adversary makes an existential signature forgery for any one of the protocol participants. The probability of this happening is bounded by SuccF,Σ(k) where SuccF,Σ(k) is the success probability of an existential signature forgery against a signature scheme Σ, given some public key PK.