Two recent works on resettable security by Vipul Goyal and Amit Sahai:
(1) Resettably Secure Computation
presented at Eurocrypt'09.
(2) Resolving the simultaneous Resettability Conjecture
announced at the rump session of TCC'09.
[Later appeared in FOCS'09.]
Resetting attacks refer to the possibility of forcing a party
to interact several times using the same internal coin tosses.
Such attacks are natural in a context where the party's randomness
is generated offline and hardwired into the party's strategy
(e.g., as in the case of some "smart cards").
Resetting attacks were first considered in the context of
zero-knowledge, first w.r.t a resetting attack on the prover
(when attempting to gain knowledge)
and later w.r.t a resetting attack on the verifier
(when attempting to fool it into accepting false statements).
[The corresponding primitives are denoted rZK and rsZK, resp.]
The current two works extend the study, first by referring
to arbitrary secure multi-party computation, and second by considering
resetting attacks on both parties in the same zero-knowledge arguments.
In the first work resetting attacks on any honest majority
is considered, but in the case of two-party protocols
the single party to be subjected to such attacks is predetermined
(indeed, as in the case of rZK and rsZK).
The second work seems a necessary condition towards handling
resetting attacks on any party (i.e., not a predetermined one)
also in the case that the honest parties are not in majority
(i.e., the two-party case).
Re the 1st work, it is important to note that resettable security
is defined via an ideal model that allows resetting (or rather
invoking the functionality with the same honest-party input
and different inputs for the other party, which may be adaptovely
selected by the adversary). Note that such an attack cannot be
avoided in the real resetting model, and thus it must be allowed in
the ideal model. Consequently, both the real and ideal models for
resetting attcaks are stronger than the corresponding models for
concurrent executions, and thus resettable security does not
necessarily imply concurrent security. (Indeed, this stands in
contrast to the case of zero-knowledge, where the parties are
supposed to interact on a common input, which cannot be modified
by an adversary.)
The original abstract
The first paper appears in the proceedings of Eurocrypt'09, LNCS 5479.
The second in the proceedings of FOCS'09.
list of Oded's choices.