Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

In this paper, the authors construct an encryption scheme that is supposed to be resilient to tampering and leaking (as opposed to just leaking).

Specifically this scheme:

enter image description here

If you look at the update procedure they simply multiply the current secret key $g^s$ and multiply it by $g^{Bu}$

If you tamper with this updated secret key you get a mutated secret key $T(g^{s+Bu})$. How do we know this new mutated secret key does not depend on the random subspace $B$ (in some arbitrary way) ?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.