On Generating the Initial Key in the Bounded-Storage Model

Abstract. In the bounded-storage model (BSM) for information-theoretically secure encryption and key-agreement one uses a random string R whose length t is greater than the assumed bound s on the adversary Eve’s storage capacity. The legitimate parties Alice and Bob share a short initial secret key K which they use to select and combine certain bits of R to obtain a derived key X which is much longer than K. Eve can be proved to obtain essentially no information about X even if she has infinite computing power and even if she learns K after having performed the storage operation and lost access to R. This paper addresses the problem of generating the initial key K and makes two contributions. First, we prove that without such a key, secret key agreement in the BSM is impossible unless Alice and Bob have themselves very high storage capacity, thus proving the optimality of a scheme proposed by Cachin and Maurer. Second, we investigate the hybrid model where K is generated by a comput...

• Type: Conference
• Year: 2004
• Where: EUROCRYPT
• Authors: Stefan Dziembowski, Ueli M. Maurer
• Keywords: Cryptography, EUROCRYPT 2004, Key Agreement, Key Agreement Scheme, Secret Key