Merkle's Key Agreement Protocol is Optimal: An $O(n^2)$ Attack on any Key Agreement from Random Oracles

Boaz Barak; Mohammad Mahmoody

Merkle's Key Agreement Protocol is Optimal: An $O(n^2)$ Attack on any Key Agreement from Random Oracles

Computational Complexity 2019-04-02 v4

Authors: Boaz Barak , Mohammad Mahmoody

Abstract

We prove that every key agreement protocol in the random oracle model in which the honest users make at most $n$ queries to the oracle can be broken by an adversary who makes $O(n^2)$ queries to the oracle. This improves on the previous $\widetilde{\Omega}(n^6)$ query attack given by Impagliazzo and Rudich (STOC '89) and resolves an open question posed by them. Our bound is optimal up to a constant factor since Merkle proposed a key agreement protocol in 1974 that can be easily implemented with $n$ queries to a random oracle and cannot be broken by any adversary who asks $o(n^2)$ queries.

Cite

@article{arxiv.0801.3669,
  title  = {Merkle's Key Agreement Protocol is Optimal: An $O(n^2)$ Attack on any Key Agreement from Random Oracles},
  author = {Boaz Barak and Mohammad Mahmoody},
  journal= {arXiv preprint arXiv:0801.3669},
  year   = {2019}
}

Comments

This version fixes a bug in the proof of the previous version of this paper, see "Correction of Error" paragraph and Appendix A

Merkle's Key Agreement Protocol is Optimal: An $O(n^2)$ Attack on any Key Agreement from Random Oracles

Abstract

Cite

Comments

Related papers