Formal Analysis of Electronic Exams Jannik Dreier 1 , Rosario - - PowerPoint PPT Presentation

▶
formal analysis of electronic exams
SMART_READER_LITE
LIVE PREVIEW

Formal Analysis of Electronic Exams Jannik Dreier 1 , Rosario - - PowerPoint PPT Presentation

Aug 21, 2022 258 likes •967 views

Formal Analysis of Electronic Exams Jannik Dreier 1 , Rosario Giustolisi 2 , Ali Kassem 3 , Pascal Lafourcade 4 , Gabriele Lenzini 2 and Peter Y. A. Ryan 2 1 Institute of Information Security, ETH Zurich 2 SnT/University of Luxembourg 3 Universit

slide-1
SLIDE 1

Formal Analysis of Electronic Exams

Jannik Dreier1, Rosario Giustolisi2, Ali Kassem3, Pascal Lafourcade4, Gabriele Lenzini2 and Peter Y. A. Ryan2

1Institute of Information Security, ETH Zurich 2SnT/University of Luxembourg 3Université Grenoble Alpes, CNRS, VERIMAG 4University d’Auvergne, LIMOS

11th International Conference on Security and Cryptography (SECRYPT 2014), Vienna August 28, 2014

1/47

slide-2
SLIDE 2

E-exam

2/47

slide-3
SLIDE 3

E-exam

Information technology for the assessment of knowledge and skills.

2/47

slide-4
SLIDE 4

Educational assessment

3/47

slide-5
SLIDE 5

E-exam: Players and Organization

Three Roles: Candidate Examination Authority Examiner

4/47

slide-6
SLIDE 6

E-exam: Players and Organization

Three Roles: Candidate Examination Authority Examiner Four Phases:

  • 1. Registration
  • 2. Examination
  • 3. Marking
  • 4. Notification

4/47

slide-7
SLIDE 7
  • Threats. . .

◮ Candidate cheating ◮ Bribed, corrupted or unfair examiners ◮ Dishonest/untrusted exam authority ◮ Outside attackers ◮ . . .

5/47

slide-8
SLIDE 8

. . . and their Mitigation

Most existing e-exam systems assume trusted authorities and focus on student cheating:

◮ Exam centers ◮ Software solutions, e.g. ProctorU

6/47

slide-9
SLIDE 9

. . . and their Mitigation

Most existing e-exam systems assume trusted authorities and focus on student cheating:

◮ Exam centers ◮ Software solutions, e.g. ProctorU

Yet also the other threats are real:

◮ Atlanta Public Schools cheating scandal (2009) ◮ UK student visa tests fraud (2014)

6/47

slide-10
SLIDE 10

. . . and their Mitigation

Most existing e-exam systems assume trusted authorities and focus on student cheating:

◮ Exam centers ◮ Software solutions, e.g. ProctorU

Yet also the other threats are real:

◮ Atlanta Public Schools cheating scandal (2009) ◮ UK student visa tests fraud (2014)

So what about dishonest authorities or hackers attacking the system?

6/47

slide-11
SLIDE 11

. . . and their Mitigation

Most existing e-exam systems assume trusted authorities and focus on student cheating:

◮ Exam centers ◮ Software solutions, e.g. ProctorU

Yet also the other threats are real:

◮ Atlanta Public Schools cheating scandal (2009) ◮ UK student visa tests fraud (2014)

So what about dishonest authorities or hackers attacking the system? ⇒ need for better protocols and systems (cf. case studies)

6/47

slide-12
SLIDE 12

. . . and their Mitigation

Most existing e-exam systems assume trusted authorities and focus on student cheating:

◮ Exam centers ◮ Software solutions, e.g. ProctorU

Yet also the other threats are real:

◮ Atlanta Public Schools cheating scandal (2009) ◮ UK student visa tests fraud (2014)

So what about dishonest authorities or hackers attacking the system? ⇒ need for better protocols and systems (cf. case studies) ⇒ precise formal definitions of required properties

6/47

slide-13
SLIDE 13

Plan

Introduction Model and Properties Authentication Properties Privacy Properties Case Studies Huszti & Pethő’s Protocol Remark! Protocol Conclusion

7/47

slide-14
SLIDE 14

Plan

Introduction Model and Properties Authentication Properties Privacy Properties Case Studies Huszti & Pethő’s Protocol Remark! Protocol Conclusion

8/47

slide-15
SLIDE 15

Model

◮ Processes in the applied π-calculus [?] ◮ Annotated using events ◮ Authentication properties as correspondence between

events

◮ Privacy properties as observational equivalence between

instances

◮ Automatic verification using ProVerif [?]

9/47

slide-16
SLIDE 16

Model

slide-17
SLIDE 17

Model

  • 1. Registration
slide-18
SLIDE 18

Model

  • 1. Registration

reg( )

Register

slide-19
SLIDE 19

Model

  • 1. Registration

reg( )

Register

  • 2. Examination
slide-20
SLIDE 20

Model

  • 1. Registration

reg( )

Register

  • 2. Examination

Questions

slide-21
SLIDE 21

Model

  • 1. Registration

reg( )

Register

  • 2. Examination

Questions

submitted( , , ) collected( , , )

Answer

slide-22
SLIDE 22

Model

  • 1. Registration

reg( )

Register

  • 2. Examination

Questions

submitted( , , ) collected( , , )

Answer

  • 3. Marking
slide-23
SLIDE 23

Model

  • 1. Registration

reg( )

Register

  • 2. Examination

Questions

submitted( , , ) collected( , , )

Answer

  • 3. Marking

distrib( , , , , )

Form

slide-24
SLIDE 24

Model

  • 1. Registration

reg( )

Register

  • 2. Examination

Questions

submitted( , , ) collected( , , )

Answer

  • 3. Marking

distrib( , , , , )

Form

marked( , , , , )

Mark

slide-25
SLIDE 25

Model

  • 1. Registration

reg( )

Register

  • 2. Examination

Questions

submitted( , , ) collected( , , )

Answer

  • 3. Marking

distrib( , , , , )

Form

marked( , , , , )

Mark

  • 4. Notification
slide-26
SLIDE 26

Model

  • 1. Registration

reg( )

Register

  • 2. Examination

Questions

submitted( , , ) collected( , , )

Answer

  • 3. Marking

distrib( , , , , )

Form

marked( , , , , )

Mark

  • 4. Notification

notified( , )

Mark

10/47

slide-27
SLIDE 27

Plan

Introduction Model and Properties Authentication Properties Privacy Properties Case Studies Huszti & Pethő’s Protocol Remark! Protocol Conclusion

11/47

slide-28
SLIDE 28

Answer Origin Authentication

All collected answers originate from registered candidates, and only one answer per candidate is accepted. Definition: On every trace:

  • 1. Registration

reg( )

Register

  • 2. Examination

Questions

submitted( , , ) collected( , , )

Answer preceeded by distinct occurence

12/47

slide-29
SLIDE 29

Form Authorship

Answers are collected as submitted, i.e. without modification. Definition: On every trace:

  • 1. Registration

reg( )

Register

  • 2. Examination

Questions

submitted( , , ) collected( , , )

Answer preceeded by distinct occurence

13/47

slide-30
SLIDE 30

Form Authenticity

Answers are marked as collected. Definition: On every trace:

  • 2. Examination

Questions

submitted( , , ) collected( , , )

Answer

  • 3. Marking

distrib( , , , , )

Form

marked( , , , , )

Mark preceeded by dist. occ.

14/47

slide-31
SLIDE 31

Mark Authenticity

The candidate is notified with the mark associated to his answer. Definition: On every trace:

  • 3. Marking

distrib( , , , , )

Form

marked( , , , , )

Mark

  • 4. Notification

notified( , )

Mark preceeded by distinct occurence

15/47

slide-32
SLIDE 32

Plan

Introduction Model and Properties Authentication Properties Privacy Properties Case Studies Huszti & Pethő’s Protocol Remark! Protocol Conclusion

16/47

slide-33
SLIDE 33

Question Indistinguishability

No premature information about the questions is leaked. Definition: Observational equivalence of two instances up to the end of registration phase: Exam 1 Exam 2 Question 1 Question 2 ≈l

17/47

slide-34
SLIDE 34

Question Indistinguishability

No premature information about the questions is leaked. Definition: Observational equivalence of two instances up to the end of registration phase: Exam 1 Exam 2 Question 1 Question 2 ≈l Can be considered with or without dishonest candidates.

17/47

slide-35
SLIDE 35

Anonymous Marking

An examiner cannot link an answer to a candidate. Definition: Up to the end of marking phase: Exam 1 Exam 2 Answer 1 Answer 2 ≈l Answer 2 Answer 1

18/47

slide-36
SLIDE 36

Anonymous Marking

An examiner cannot link an answer to a candidate. Definition: Up to the end of marking phase: Exam 1 Exam 2 Answer 1 Answer 2 ≈l Answer 2 Answer 1 Can be considered with or without dishonest examiners and authorities.

18/47

slide-37
SLIDE 37

Anonymous Examiner

A candidate cannot know which examiner graded his copy. Definition: Exam 1 Exam 2 Answer 1 Answer 2 Mark 1 Mark 2 ≈l Answer 2 Answer 1 Mark 2 Mark 1 Can be considered with or without dishonest candidates.

19/47

slide-38
SLIDE 38

Mark Privacy

Marks are private. Definition: Exam 1 Exam 2 Answer 1 Mark 1 ≈l Answer 1 Mark 2 Can be considered with or without dishonest candidates, examiners and authorities.

20/47

slide-39
SLIDE 39

Mark Anonymity

Marks can be published, but may not be linked to candidates. Definition: Exam 1 Exam 2 Answer 1 Answer 2 Mark 1 Mark 2 ≈l Answer 1 Answer 2 Mark 2 Mark 1 Can be considered with or without dishonest candidates, examiners and authorities. Implied by Mark Privacy.

21/47

slide-40
SLIDE 40

Plan

Introduction Model and Properties Authentication Properties Privacy Properties Case Studies Huszti & Pethő’s Protocol Remark! Protocol Conclusion

22/47

slide-41
SLIDE 41

Plan

Introduction Model and Properties Authentication Properties Privacy Properties Case Studies Huszti & Pethő’s Protocol Remark! Protocol Conclusion

23/47

slide-42
SLIDE 42

Application: Huszti & Pethő’s Protocol

“A Secure Electronic Exam System” [?] using

◮ ElGamal Encryption ◮ a Reusable Anonymous Return Channel (RARC) [?] for

anonymous communication

◮ a network of servers providing a timed-release service using

Shamir’s Secret Sharing: A subset of servers can combine their shares to de-anonymize a candidate after the exam Goal: ensure

◮ authentication and privacy

in presence of dishonest

◮ candidates ◮ examiners ◮ exam authorities

24/47

slide-43
SLIDE 43

Results

Formal Verification with ProVerif [?]: Property Result Time Answer Origin Authentication × < 1 s Form Authorship × < 1 s Form Authenticity × < 1 s Mark Authenticity × < 1 s Question Indistinguishability × < 1 s Anonymous Marking × 8 m 46 s Anonymous Examiner × 9 m 8 s Mark Privacy × 39 m 8 s Mark Anonymity × 1h 15 m 58 s

25/47

slide-44
SLIDE 44

Main reason

Given its security definition, the RARC

◮ provides anonymity, but not necessarily secrecy ◮ does not necessarily provide integrity or authentication ◮ is only secure against passive attackers

Corrupted parties or active attackers can break secrecy and anonymity, as the following attack shows.

26/47

slide-45
SLIDE 45

RARC: Mode of Operation and Attack

Input (A to RARC, destination B): {IDA, PKA}PKRARC +PoK; {MSG}PKRARC ; {IDB, PKB}PKRARC +PoK

27/47

slide-46
SLIDE 46

RARC: Mode of Operation and Attack

Input (A to RARC, destination B): {IDA, PKA}PKRARC +PoK; {MSG}PKRARC ; {IDB, PKB}PKRARC +PoK Output (RARC to B): {IDA, PKA}PKRARC + Signature; {MSG}PKB

27/47

slide-47
SLIDE 47

RARC: Mode of Operation and Attack

Input (A to RARC, destination B): {IDA, PKA}PKRARC +PoK; {MSG}PKRARC ; {IDB, PKB}PKRARC +PoK Output (RARC to B): {IDA, PKA}PKRARC + Signature; {MSG}PKB Return (B to RARC, destination A): {IDB, PKB}PKRARC +PoK; {MSG}PKRARC ; {IDA, PKA}PKRARC +Signature

27/47

slide-48
SLIDE 48

RARC: Mode of Operation and Attack

Input (A to RARC, destination B): {IDA, PKA}PKRARC +PoK; {MSG}PKRARC ; {IDB, PKB}PKRARC +PoK Output (RARC to B): {IDA, PKA}PKRARC + Signature; {MSG}PKB Return (B to RARC, destination A): {IDB, PKB}PKRARC +PoK; {MSG}PKRARC ; {IDA, PKA}PKRARC +Signature Attack Input (AD to RARC, destination AD): {IDAD, PKAD}PKRARC +PoK; {MSG}PKRARC ; {IDAD, PKAD}PKRARC +PoK

27/47

slide-49
SLIDE 49

RARC: Mode of Operation and Attack

Input (A to RARC, destination B): {IDA, PKA}PKRARC +PoK; {MSG}PKRARC ; {IDB, PKB}PKRARC +PoK Output (RARC to B): {IDA, PKA}PKRARC + Signature; {MSG}PKB Return (B to RARC, destination A): {IDB, PKB}PKRARC +PoK; {MSG}PKRARC ; {IDA, PKA}PKRARC +Signature Attack Input (AD to RARC, destination AD): {IDAD, PKAD}PKRARC +PoK; {MSG}PKRARC ; {IDAD, PKAD}PKRARC +PoK Output (RARC to AD): {IDAD, PKAD}PKRARC + Signature; {MSG}PKAD

27/47

slide-50
SLIDE 50

Plan

Introduction Model and Properties Authentication Properties Privacy Properties Case Studies Huszti & Pethő’s Protocol Remark! Protocol Conclusion

28/47

slide-51
SLIDE 51

Application: Remark! Protocol

A recent protocol [?] using

◮ ElGamal encryption ◮ an exponentiation mixnet [?] to create pseudonyms based

  • n the parties’ public keys

⇒ allows to encrypt and sign anonymously

◮ a public append-only bulletin board

Goal: ensure

◮ authentication and integrity ◮ privacy ◮ verifiability

in presence of dishonest

◮ candidates ◮ examiners ◮ exam authorities

29/47

slide-52
SLIDE 52

Results

Formal Verification with ProVerif: Property Result Time Answer Origin Authentication

  • < 1 s

Form Authorship

  • < 1 s

Form Authenticity 1 < 1 s Mark Authenticity

  • < 1 s

Question Indistinguishability

  • < 1 s

Anonymous Marking

  • 2 s

Anonymous Examiner

  • 1 s

Mark Privacy

  • 3 m 32 s

Mark Anonymity

  • 2

1after fix 2implied by Mark Privacy 30/47

slide-53
SLIDE 53

Plan

Introduction Model and Properties Authentication Properties Privacy Properties Case Studies Huszti & Pethő’s Protocol Remark! Protocol Conclusion

31/47

slide-54
SLIDE 54

Conclusion

◮ E-exams are used and vulnerable to attacks ◮ Cryptographic protocols exist, but lack formal verification ◮ First formal framework for analysis of e-exams:

◮ Formal model in the applied π-calculus ◮ Definitions for central authentication, integrity and privacy

properties

◮ Automated verification in ProVerif of two case studies:

◮ Huszti & Pethő’s protocol: Fails on all properties due to severe

flaws in protocol design

◮ Remark! protocol: Ensures all properties after one fix

◮ Future work: verifiability and accountability, analyzing

implementations

32/47

slide-55
SLIDE 55

Thank you for your attention!

Questions? jannik.dreier@inf.ethz.ch

33/47

slide-56
SLIDE 56

Model Definition

Definition

(E-exam protocol). An e-exam protocol is a tuple (C, E, Q, A1, . . . , Al, ˜ np), where

◮ C is the process executed by the candidates, ◮ E is the process executed by the examiners, ◮ Q is the process executed by the question commitee, ◮ Ai’s are the processes executed by the authorities, and ◮ ˜

np is the set of private channel names.

34/47

slide-57
SLIDE 57

Model Definition cont’d

Definition

(E-exam instance). An e-exam instance is a closed process EP = ν ˜ n.(Cσid1σa1| . . . |Cσidjσaj|Eσid′

1σm1| . . . |Eσid′ kσmk|

Qσq|A1σdist| . . . |Al), where

◮ ˜

n is the set of all restricted names, which includes the set of the protocol’s private channels;

◮ Cσidiσai’s are the processes run by the candidates, the

substitutions σidi and σai specify the identity and the answers

  • f the ith candidate respectively;

◮ Eσid′

i σmi’s are the processes run by the examiners, the

substitution σid′

i specifies the ith examiner’s identity, and σmi

specifies for each possible question/answer pair the corresponding mark;

35/47

slide-58
SLIDE 58

Model Definition cont’d

Definition

(E-exam instance). An e-exam instance is a closed process EP = ν ˜ n.(Cσid1σa1| . . . |Cσidjσaj|Eσid′

1σm1| . . . |Eσid′ kσmk|

Qσq|A1σdist| . . . |Al), where

◮ Q is the process run by the question committee, the

substitution σq specifies the exam questions;

◮ the Ai’s are the processes run by the exam authorities, the

substitution σdist determines which answers will be submitted to which examiners for grading. Without loss of generality, we assume that A1 is in charge of distributing the copies to the examiners.

35/47

slide-59
SLIDE 59

Authentication Properties

Definition (Answer Origin Authentication)

An e-exam protocol ensures Answer Origin Authentication if, for every e-exam process EP, each occurrence of the event collected(id_c, ques, ans) is preceded by a distinct occurrence

  • f the event reg(id_c) on every execution trace.

Definition (Form Authorship)

An e-exam protocol ensures Form Authorship if, for every e-exam process EP, each occurrence of the event collected(id_c, ques, ans) is preceded by a distinct occurrence

  • f the event submitted(id_c, ques, ans) on every execution

trace.

36/47

slide-60
SLIDE 60

Authentication Properties cont’d

Definition (Form Authenticity)

An e-exam protocol ensures Form Authenticity if, for every e-exam process EP, each occurrence of the event marked(ques, ans, mark, id_form, id_e) is preceded by a distinct occurrence of the events distrib(id_c, ques, ans, id_form, id_e) and collected(id_c, ques, ans) on every execution trace.

Definition (Mark Authenticity)

An e-exam protocol ensures Mark Authenticity if, for every e-exam process EP, each occurrence of the event notified(id_c, mark) is preceded by a distinct occurrence of the events marked(ques, ans, mark, id_form, id_e) and distrib(id_c, ques, ans, id_form, id_e) on every execution trace.

37/47

slide-61
SLIDE 61

Privacy Properties

Definition (Question Indistinguishability)

An e-exam protocol ensures Question Indistinguishability if for any e-exam process EP that ends with the registration phase, any questions q1 and q2, we have that: EP{idQ}[Qσq1]|reg ≈l EP{idQ}[Qσq2]|reg.

Definition (Anonymous Marking)

An e-exam protocol ensures Anonymous Marking if for any e-exam process EP that ends with the marking phase, any two candidates id1 and id2, and any two answers a1 and a2, we have that: EP{id1,id2}[Cσid1σa1|Cσid2σa2]|mark≈l EP{id1,id2}[Cσid1σa2|Cσid2σa1]|mark.

38/47

slide-62
SLIDE 62

Privacy Properties cont’d

Definition (Anonymous Examiner)

An e-exam protocol ensures Anonymous Examiner if for any e-exam process EP, any two candidates id1, id2, any two examiners id′

1, id′ 2, and any two marks m1, m2, we have that:

EP{id1,id2,id′

1,id′ 2,idA1}[Cσid1σa1|Cσid2σa2|Eσid′ 1σm1|Eσid′ 2σm2|A1σdist1] ≈l

EP{id1,id2,id′

1,id′ 2,idA1}[Cσid1σa1|Cσid2σa2|Eσid′ 1σm2|Eσid′ 2σm1|A1σdist2]

where σdist1 attributes the exam form of candidate id1 to examiner id′

1 and the exam form of candidate id2 to examiner id′ 2, and σdist2

attributes the exam form of candidate id1 to examiner id′

2 and the

exam form of candidate id2 to examiner id′

1.

Definition (Mark Privacy)

An e-exam protocol ensures Mark Privacy if for any e-exam process EP, any marks m1, m2, we have that: EP{id′}[Eσid′σm1] ≈l EP{id′}[Eσid′σm2].

39/47

slide-63
SLIDE 63

Privacy Properties cont’d

Definition (Mark Anonymity)

An e-exam protocol ensures Mark Anonymity if for any e-exam process EP, any candidates id1, id2, any examiner id′

1, any answers

a1, a2 and a distribution σdist that assigns the answers of both candidates to the examiner, and two substitutions σma and σmb which are identical, except that σma attributes the mark m1 to the answer a1 and m2 to a2, whereas σmb attributes m2 to the answer a1 and m1 to a2, we have that: EP{id1,id2,id′

1,idA1}[Cσid1σa1|Cσid2σa2|Eσid′ 1σma|A1σdist] ≈l

EP{id1,id2,id′

1,idA1}[Cσid1σa1|Cσid2σa2|Eσid′ 1σmb|A1σdist] 40/47

slide-64
SLIDE 64

Remark! Equational Theory

checkpseudo(pseudo_pub(pk(k), rce), pseudo_priv(k, exp(rce))) = true decrypt(encrypt(m, pk(k), r), k) = m decrypt(encrypt(m, pseudo_pub(pk(k), rce), r), pseudo_priv(k, exp(rce))) = m getmess(sign(m, k)) = m checksign(sign(m, k), pk(k)) = m checksign(sign(m, pseudo_priv(k, exp(rce))), pseudo_pub(pk(k), rce)) = m

41/47

slide-65
SLIDE 65

Remark! Protocol

Assumption: The protocol assumes a list of eligible examiners and their public keys PKE, and a list of eligible candidates and their public keys PKC. Examiner Registration

1- NET calculates re = k i=1 rei, PK E = PK re E and he = gre 2- NET publishes sign((PK E, he), SK NET) 3- E checks if PK E = hSKE e

Candidate Registration

4- NET calculates rc = k i=1 rci, PK C = PK rc C and hc = grc 5- NET publishes sign((PK C, hc), SK NET) 6- C checks if PK C = hSKC c

Examination

7- EA → C : {sign(question, SK EA)}PK C 8- C → EA : // Ca = {question, answer, PK C}

{Ca, sign(Ca, SKC, hc)}PKEA

9- EA → C : {Ca, sign(Ca, SKEA)}PKC

42/47

slide-66
SLIDE 66

Remark! Protocol Cont’d

Marking

10- EA → E : {Ca, sign(Ca, SKEA)}PKE 11- E → EA : // Ma = (sign(Ca, SKEA), mark)

{sign(Ma, SKE, he)}PKEA Notification

12- EA → C : {Ma, sign(Ma, SKE, he)}PK C 13- NET → EA : {rc, sign(rc, SKN)}PKEA

43/47

slide-67
SLIDE 67

Huszti Equational Theory

decrypt(encrypt(m, pk(k), r), k) = m getmess(sign(m, k)) = m checksign(sign(m, k), pk(k)) = m exp(exp(g, x), y) = exp(exp(g, y), x) checkproof (xproof (p, p1, g, exp(g, e), e), p, p1, g, exp(g, e)) = true zkpsec(zkp_proof (exp(b, e), e), exp(b, e)) = true

44/47

slide-68
SLIDE 68

Huszti’s Protocol

Setup 1 - EA publishes g and h = gs 2 - Committee →priv EA : {question, {question}SSK committee, timex1}PK MIX Candidate Registration 3 - EA checks C’s eligibility, and calculates ˜ p = (PKC)s 4 - EA → NET : {˜ p, gC} 5- NET calculates p′ = ˜ pΓ, and r = gΓ

C, and stores timent

6 - NET → C : {p′, r} 7 - C calculates p = rSKC 8 - EA ← → C : ZKPeq((p, p′), (g, h)) //C’s pseudonym: (r, p, p′)

45/47

slide-69
SLIDE 69

Huszti’s Protocol

Examiner Registration 9 - EA checks E’s eligibility, and calculates ˜ q = (PKE)s 10 - EA → E : {˜ q, gE} 11 - E calculates q′ = ˜ qα, t = g α

E , and q = tSKE

12 - EA ← → E : ZKPeq((q, q′), (g, h)) 13 - E → EA : {t, q, q′, h} 14 - EA checks qs = q′ 15 - E ← → EA : ZKPsec(SK E) 16 - EA stores {IDE, PK E}PK MIX , h Examination 17 - C → EA : {r, p, p′, h} 18 - EA checks ps = p′ 19 - C ← → EA : ZKPsec(SK C) 20 - EA → C : {question, {question}SSK committee, timex1}PK MIX 21 - C → EA : {r, p, {answer}PK MIX , timex2} 22 - EA → C : Hash(r, p, p′, h, transC, question, timex1,timex2 {answer}PK MIX )

46/47

slide-70
SLIDE 70

Huszti’s Protocol

Marking 23 - EA → E : {answer}PKMIX // Note that EA stored {IDE, PK E}PK MIX , h) 24 - E → EA : {mark, Hash(mark, answer), [Hash(mark, answer)]SK E , verzkp, t, q} 25 - E ← → EA : ZKPeq(Hash(mark, answer), [Hash(mark, answer)]SK E ), (t, q)) Notification 26 - EA → NET : {p′} //Note that r = gΓ

C, p = PK Γ C, p′ = gΓs C

27 - NET calculates p′ = ˜ pΓ 28 - NET → EA : {p′, ˜ p} 29 - EA publishes mark, Hash(mark, answer), [Hash(mark, answer)]SK E , verzkp

47/47