diff options
author  Jeff Burdges <burdges@gnunet.org>  20180925 02:49:25 0400 

committer  Jeff Burdges <burdges@gnunet.org>  20180925 02:49:25 0400 
commit  038f0e91e7fc4d84bd6012e45bea199f91764b5f (patch)  
tree  f74333078215ba27ad6146fd329c587fc951a5da  
parent  55f661c0a3b9e1936858761b26376f2036eb10ef (diff)  
download  papers038f0e91e7fc4d84bd6012e45bea199f91764b5f.tar.gz papers038f0e91e7fc4d84bd6012e45bea199f91764b5f.tar.bz2 papers038f0e91e7fc4d84bd6012e45bea199f91764b5f.zip 
I'm not seeing thie A for adversary elsewhere
rwrr  talerfc19/paper.tex  18 
1 files changed, 9 insertions, 9 deletions
diff git a/talerfc19/paper.tex b/talerfc19/paper.tex index baecc52..8d48ead 100644  a/talerfc19/paper.tex +++ b/talerfc19/paper.tex @@ 1244,15 +1244,15 @@ Our instantiation satisfies {weak income transparency}. \end{theorem}
\begin{proof}
In our refresh operation, the commitment phase sends only the hash of blinded
coins and transfer public keys to reduce bandwidth. We therefore first
convert our adversary $\mathcal{A}$ into an adversary for a variant protocol
in which these commitments contain the full values: We rewind $\mathcal{A}$
to try two distinct $\gamma \in 1,\dots,\kappa$ during each refresh
operation, so that we obtain all values. We need only try two choices
because the adversary reveals all but one planchet in each run. We now
witness a hash collision if the transfer secret the adversary reveals does not
yield the correct coins.
+In our refresh operation, the commitment phase sends only the hash
+of blinded coins and transfer public keys to reduce bandwidth.
+We therefore first convert our adversary into an adversary for a
+variant protocol in which these commitments contain the full values:
+We rewind the adversary to try two distinct $\gamma \in 1,\dots,\kappa$
+during each refresh operation, so that we obtain all values.
+We need only try two choices because the adversary reveals all but
+one planchet in each run. We now witness a hash collision if the
+transfer secret the adversary reveals does not yield the correct coins.
If Taler satisfies unforgeability then this variant protocol does so too,
because an adversary against the protocol with commitment to full planchets
