STS

basic STS

\[ \begin{align}\begin{aligned}A -> B : g^x\\B -> A : g^y, B, { SIG_B (g^x, g^y) }_Ks\\A -> B : A , { SIG_A(g^y, g^x) }_Ks\end{aligned}\end{align} \]

主要问题是identity misbinding

maced-signature

\[ \begin{align}\begin{aligned}b = SIG_A(g^y, g^x)\\c = MAC_Ks(b)\end{aligned}\end{align} \]

把加密替换成mac

Photuris 变种

\[ \begin{align}\begin{aligned}A -> B : g^x\\B -> A : g^y, B, SIG_B (g^x, g^y, g^{xy})\\A -> B : A , SIG_A(g^y, g^x, g^{xy})\end{aligned}\end{align} \]

去掉加密