{"action":"created","issue":{"url":"https://api.github.com/repos/zcash/zcash/issues/792","repository_url":"https://api.github.com/repos/zcash/zcash","labels_url":"https://api.github.com/repos/zcash/zcash/issues/792/labels{/name}","comments_url":"https://api.github.com/repos/zcash/zcash/issues/792/comments","events_url":"https://api.github.com/repos/zcash/zcash/issues/792/events","html_url":"https://github.com/zcash/zcash/issues/792","id":141332161,"number":792,"title":"Write security proofs for nonstandard primitives","user":{"login":"defuse","id":4211072,"avatar_url":"https://avatars.githubusercontent.com/u/4211072?v=3","gravatar_id":"","url":"https://api.github.com/users/defuse","html_url":"https://github.com/defuse","followers_url":"https://api.github.com/users/defuse/followers","following_url":"https://api.github.com/users/defuse/following{/other_user}","gists_url":"https://api.github.com/users/defuse/gists{/gist_id}","starred_url":"https://api.github.com/users/defuse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/defuse/subscriptions","organizations_url":"https://api.github.com/users/defuse/orgs","repos_url":"https://api.github.com/users/defuse/repos","events_url":"https://api.github.com/users/defuse/events{/privacy}","received_events_url":"https://api.github.com/users/defuse/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/zcash/zcash/labels/crypto","name":"crypto","color":"ff6b75"},{"url":"https://api.github.com/repos/zcash/zcash/labels/protocol%20spec","name":"protocol spec","color":"8dc6eb"},{"url":"https://api.github.com/repos/zcash/zcash/labels/SECURITY","name":"SECURITY","color":"e01010"}],"state":"open","locked":false,"assignee":{"login":"daira","id":643204,"avatar_url":"https://avatars.githubusercontent.com/u/643204?v=3","gravatar_id":"","url":"https://api.github.com/users/daira","html_url":"https://github.com/daira","followers_url":"https://api.github.com/users/daira/followers","following_url":"https://api.github.com/users/daira/following{/other_user}","gists_url":"https://api.github.com/users/daira/gists{/gist_id}","starred_url":"https://api.github.com/users/daira/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daira/subscriptions","organizations_url":"https://api.github.com/users/daira/orgs","repos_url":"https://api.github.com/users/daira/repos","events_url":"https://api.github.com/users/daira/events{/privacy}","received_events_url":"https://api.github.com/users/daira/received_events","type":"User","site_admin":false},"milestone":null,"comments":49,"created_at":"2016-03-16T16:47:58Z","updated_at":"2016-04-03T21:24:18Z","closed_at":null,"body":"Looking over the current `protocol.pdf`, we are using the following nonstandard primitives. We should prove all of them secure using reasonable assumptions about SHA256.\r\n\r\n- The four PRFs.\r\n- The fixed-depth merkle tree which uses the SHA256 compression function as the hash.\r\n- The way the coin commitment is computed.\r\n- The way h_{sig} is computed.\r\n- The way the key-private encryption works, which includes a KDF based on SHA256.\r\n\r\n[Edit by Daira: the KDF is now based on SHA-512.]"},"comment":{"url":"https://api.github.com/repos/zcash/zcash/issues/comments/205058963","html_url":"https://github.com/zcash/zcash/issues/792#issuecomment-205058963","issue_url":"https://api.github.com/repos/zcash/zcash/issues/792","id":205058963,"user":{"login":"defuse","id":4211072,"avatar_url":"https://avatars.githubusercontent.com/u/4211072?v=3","gravatar_id":"","url":"https://api.github.com/users/defuse","html_url":"https://github.com/defuse","followers_url":"https://api.github.com/users/defuse/followers","following_url":"https://api.github.com/users/defuse/following{/other_user}","gists_url":"https://api.github.com/users/defuse/gists{/gist_id}","starred_url":"https://api.github.com/users/defuse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/defuse/subscriptions","organizations_url":"https://api.github.com/users/defuse/orgs","repos_url":"https://api.github.com/users/defuse/repos","events_url":"https://api.github.com/users/defuse/events{/privacy}","received_events_url":"https://api.github.com/users/defuse/received_events","type":"User","site_admin":false},"created_at":"2016-04-03T21:24:18Z","updated_at":"2016-04-03T21:24:18Z","body":"@daira: The inner adversary's queries are pairs (m<sub>0</sub>, m<sub>1</sub>). Since there's no key the outer adversary can respond with *either* Commit<sub>r</sub>(m<sub>0</sub>) or Commit<sub>r</sub>(m<sub>0</sub>). Computing Commit<sub>r</sub>(m<sub>b</sub>) theirselves presumes they know b (in which case they've already won)."}}