= Mihir Bellare
{c}
{wiki}
<Mihir Bellare> is a <computer scientist> whose work in <cryptography> connects practical constructions with <provable security>: a claimed security property is expressed as a mathematical condition, with a proof relating an attack to specified assumptions. His https://cseweb.ucsd.edu/~mihir/[UC San Diego homepage] describes this emphasis on primitives of applied interest.
With <Ran Canetti> and <Hugo Krawczyk>, <Mihir Bellare> developed the hash-based <message authentication code> <HMAC>. Their 1996 paper studies how to turn an unkeyed <cryptographic hash function> into a keyed <message authentication> mechanism and analyzes the resulting construction under explicit assumptions. The practical task is to let two parties sharing a <cryptographic key> detect unauthorized message changes: an ordinary public <hash function> alone cannot prevent an attacker from changing a message and recomputing its hash.<Keying Hash Functions for Message Authentication by Mihir Bellare, Ran Canetti and Hugo Krawczyk>[June1996 author manuscript, Abstract and §§1.1–1.3]{ref} The construction was subsequently specified in the February1997 document <HMAC: Keyed-Hashing for Message Authentication (RFC 2104)>; that RFC is explicitly categorized as Informational.<HMAC: Keyed-Hashing for Message Authentication (RFC 2104)>[Title page, status and §§1–2]{ref}
With <Oded Goldreich>, <Mihir Bellare> also refined the definition of a <proof of knowledge>. Their work makes “knowing” a mathematical witness operational through a <knowledge extractor>, with a <knowledge error> distinguishing acceptance obtainable without such knowledge from acceptance that supports extraction.<On Defining Proofs of Knowledge by Mihir Bellare and Oded Goldreich>[Definition3.1 and §4.4; author manuscript dated26August1992]{ref}
The <graph isomorphism> example makes that distinction concrete. A prover sends a graph $H$ and must answer a random challenge asking for an isomorphism from either $G_1$ or $G_2$ to $H$. Preparing only one answer can give acceptance probability $1/2$, so one accepted exchange is not itself evidence that the prover knows an isomorphism between $G_1$ and $G_2$. If an extractor obtains valid maps $\pi_1:G_1\to H$ and $\pi_2:G_2\to H$ for the same $H$, it can construct $\pi_2^{-1}\circ\pi_1:G_1\to G_2$. This illustrates why a careful extraction definition, rather than the informal phrase “the verifier was convinced”, matters when building larger <cryptographic protocols>.<On Defining Proofs of Knowledge by Mihir Bellare and Oded Goldreich>[§4.4, atomic graph-isomorphism protocol and knowledge error1/2]{ref}
Back to article page
