Deniable Authenticated Key Establishment for Internet Protocols

摘要

Mike Roe: I don’t really like using absolute deniability as opposed to plausible deniability. We called it plausible deniability in the beginning1 partly as a joke; it was a reference to plausible deniability in the sense that a government official wants to be able to deny they were responsible for things they said o. the record. More seriously it’s plausible because we’re thinking about non-repudiation. Anybody can say it wasn’t them, but it may be that their signature proves they did it, so the fact that they say it wasn’t them doesn’t get believed. The reason it’s plausible is when you say it wasn’t him, and you go to a third party with all the evidence of the protocol, then it’s plausible in the sense that the third party will think there’s. . .Bruce Christianson: There’s some other way the signature could have got there. Mike Roe: Yes, so it’s plausible in the sense that the third party would think maybe he was telling the truth. Of course it can’t be absolute because the whole idea about the protocol is you really did it, so there can’t possibly be something that absolutely proves you didn’t do it, because that then is a contradiction. So there has to be something using this area of doubt. I don’t really like calling it absolute deniability. Reply: I don’t know, I would rather use the bad words. When Bob wants to allege Alice’s involvement, it actually means that Bob must self-expose and say, “this is my public key.” Even in that sense nobody can make a denial attack.