a590003

Discussion. We now elaborate on Theorem 1. If we consider the distinguisher
D w,l from Theorem 1, we observe that by the advantage lower bound in the
theorem statement, if l,w ≪ 2 n/4 and consequently p(H,w,l) ≈ 0, the number
of queries made by the simulator, denoted q S = q S (2l,w + 1) must satisfy
q S = Ω(w·l) = Ω(q 1·q 2 ) to ensure a sufficiently small indifferentiability advantage.
This in particular means that in the case where both q 1 and q 2 are large,
the simulator must make a quadratic effort to prevent the attacker from distinguishing.
Below, in Theorem 2, we show that this simulation effort is essentially
optimal.
In many scenarios, this quadratic lower bound happens to be a problem, as
wenow illustrate.As aconcreteexample, letSS = (key,sign,ver)be anarbitrary
signature scheme signing n bits messages, and let ˜SS[R] = (˜key R , ˜sign R ,ṽer R )
forR : {0,1} ∗ → {0,1} n betheschemeobtainedviathehash-then-signparadigm
such that ˜sign R (sk,m) = sign(sk,R(m)). It is well known that for an adversary
B making q sign signing and q R random oracle queries, there exists an adversary
C making q sign signing queries such that
Adv uf-cma
˜SS[R] (BR ) ≤ (q sign +q R ) 2
2 n +Adv uf-cma
SS (C) , (1)
where Adv uf-cma
˜SS[R] (BR ) and Adv uf-cma
SS (C) denote the respective advantages in
the standard uf-cma game for security of signature schemes (with and without
a random oracle, respectively). This in particular means that ˜SS is secure for
q sign and q R as large as Θ(2 n/2 ), provided SS is secure for q sign signing queries.
However,letusnowreplaceRbyH 2 [P]foranarbitraryconstructionH = H[P].
Then, for all adversaries A making q P queries to P and q sign signing queries, we
cancombinetheconcreteversionoftheMRHcompositiontheoremprovenin[31]
and (1) to infer that there exists an adversary C and a distinguisher D such that
Adv uf-cma
˜SS[H 2 [P]] (AP ) ≤ Θ
(
(qsign ·q P ) 2
2 n )
+Adv uf-cma
SS (C)+Adv indiff
H 2 [P],R,S (D) ,
whereC makesq sign signingqueries.Note thateven ifthe termAdv indiff
H 2 [P],R,S (D)
isreallysmall,thisnewboundcanonlyensuresecurityfortheresultingsignature
scheme as long as q sign ·q P = Θ(2 n/2 ), i.e., if q sign = q P , we only get security up
to Θ(2 n/4 ) queries, a remarkable loss with respect to the security bound in the
random oracle model.
We note that of course this does not mean that H 2 [P] for a concrete H
and P is unsuitable for a certain application, such as hash-then-sign. In fact,
H 2 [P] may well be optimally collision resistant. However, our result shows that
a sufficiently strong security level cannot be inferred from any indifferentiability
statementviathecompositiontheorem,takingusbacktoadirectad-hocanalysis
and completely loosing the one main advantage of having indifferentiability in
the first place.
Upper bound. Our negative results do not rule out positive results completely:
there could be indifferentiability upper bounds, though for simulators that make
13
15. To Hash or Not to Hash Again?