Groups are an abstract algebraic concept based on a set and a group law (a binary function which closes the set).

learn more… | top users | synonyms

-2
votes
0answers
45 views

Question about Composite Order Bilinear Groups [closed]

I need a prove of Thank you very much!
2
votes
1answer
61 views

Elliptic Curve ElGamal and DSA - smooth group order and element of large prime order

In regular ElGamal and DSA, we choose large primes $p$ and $q$ such that $p\equiv 1\pmod{q}$, and a group element $g$ of order $q$ by computing $a^{(p-1)/q}$ for some random $a$. This is to prevent ...
1
vote
1answer
153 views

Modular Arithmetic in RSA

Consider the following the following RSA public key $pk = (N, e) = (1457, 1307)$. (a) Knowing that $187^2 \equiv 1 \pmod {1457}$ find the factorization of $N$. (b) Given the factorization of $N$ ...
2
votes
1answer
101 views

Given $g,g^t$ in a cyclic group of order $pq$, is it hard to compute $g^{t^{-1}}$?

Suppose we have a group $G$ cyclic of order $pq$ , where $p,q$ are primes. Let $g$ be a generator of $G$ and $t\in \mathbb{Z}_{pq}$. Having $g$ and $g^t$, it seems to be very hard to find ...
0
votes
0answers
32 views

What is the security parameter in “KAC” key generation? [duplicate]

I am trying to implement key generation from the paper Key-Aggregate Cryptosystem for Scalable Data Sharing in Cloud Storage. In the paper, the first step in key generation is a setup phase state as ...
3
votes
1answer
56 views

How is a group element converted into a key?

I've only just started research on cryptography so I apologize if this is a basic question or I'm getting terms confused. I'm researching braid group cryptography and currently looking at the ...
5
votes
2answers
180 views

lcm versus phi in RSA

In textbook RSA, the Euler $\varphi$ function $$\varphi(pq) := (p-1)(q-1)$$ is used to define the private exponent $d$. On the other hand, real-world cryptographic specifications require the ...
2
votes
1answer
44 views

Number generation for Fujisaki-Okamoto commitment scheme parameters

I need to implement the Fujisaki-Okamoto commitment scheme for a project such that I can demonstrate performance of various zero-knowledge proofs in relation to one another, for example Boudot's ...
1
vote
0answers
35 views

What is the hardness in Decisional Linear Assumption (DLIN)?

I had understood what does the DLIN assumption means and here is a related question. But I fail to understand the 'real hardness' in this problem. I would be grateful if someone can help me to ...
3
votes
1answer
51 views

Do $v_1=\alpha\cdot r_1$ and $v_2=\alpha\cdot r_2$ leak information about $\alpha$

Please consider we have finite field $\mathbb{F}_p$ for large prime number $p$. We have a fixed field element $\alpha$. By $r_i\leftarrow \mathbb{F}_p$ we mean we pick $r_i$ uniformly random from the ...
11
votes
2answers
261 views

How to determine the order of an elliptic curve group from its parameters?

Let $\quad E:\; y^2 = x^3 + ax + b \quad$ be an elliptic curve defined over a finite field $\mathbb F_q$ where $q = p^n$, $a,b \in \mathbb F_q$ and $p \neq 2, 3$. By Hasse's theorem we know that the ...
0
votes
1answer
38 views

Confusion regarding computing Multiplicative Inverse Modulo P?

May be a silly doubt, please rectify my confusion regarding below problem: For concreteness assume $g=2, p=11, a=6$ and $x=9$ $$A = g^a \bmod p = 2^6 \bmod 11 = 9$$ $$X = g^x \bmod p = 2^9 \bmod 11 ...
0
votes
1answer
129 views

Simple example to describe Bilinear mapping

Notation : $\mathbb{G}$ is an additive group and $\mathbb{G}_T$ is multiplicative group of prime order $q$. Bilinear mapping $e: \mathbb{G} \times \mathbb{G} \rightarrow \mathbb{G}_T$ has to satisfy ...
-2
votes
1answer
91 views

Show How to Efficiently Solve the Computational Diffie-Hellman Assumption given an Algorithm that Solves the Square-DH Problem

Let $q$ prime number, $G$ a cyclic group with order $q$ and let $g \in G$ be a generator of $G$. Suppose that you have an algorithm $A$ who takes input the element $g^a$ of $G$ and gives as output the ...
1
vote
1answer
51 views

“Order” in cryptographic terms for generators

Frequently I have seen people use the term order in cryptography (the group theoretic one). I have a mathematical background and order (say for prime modulus $p$) is defined as the smallest integer ...
1
vote
2answers
64 views

How to compute two EC point multiplication?

I would like to know how to compute multiplication of two valid EC points over a curve E with generator G. i.e. Given only P and Q points then how to compute R = P * Q where $P = p G$, $Q = q G$ and ...
0
votes
1answer
83 views

Working on subgroup of $\mathbb{Z}^*_p$ in practice

It is said that, given a group $\mathbb{Z}^*_p$, we can always have a subgroup whose order is prime. To this end, for a safe prime $p=2q+1$, compute $x_i^2 \bmod p$ for all $x_i \in \mathbb{Z}^*_p$. ...
3
votes
1answer
124 views

Can we reduce Diffie-Hellman problem to “Discrete-log inversion” problem?

Let $G$ be a cyclic multiplicative group of order $n$. Let $g$ be a (public) generator of $G$. The Diffie-Hellman (DH) problem asks: Given $g^x, g^y\in G$ for $x, y\in \mathbb{Z}^*_n$, to compute ...
7
votes
1answer
206 views

Logjam: “composite order subgroups” explained for TLS developers and system admins?

I have read the recent logjam paper Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice. On page 11 in the Recommendations section, they state: ...
0
votes
1answer
71 views

How to perform homomorphic multiplication in ElGamal?

How can I compute homomorphic multiplication in ElGamal? That is: Given two ciphertexts $(R_1,c_1)$ and $(R_2,c_2)$ corresponding to plaintexts $m_1$ and $m_2$ under some public key; how can I compute ...
0
votes
2answers
177 views

Why does Diffie-Hellman need be a cyclic group?

Why is Diffie-Hellman defined on a cyclic group? Doesn't it work for any commutative operation which the inverse is hard to find? Say Alice and Bob agree in a public prime $c$ and both choose a ...
2
votes
1answer
57 views

In a additive group is it hard to calculate $bg$ given $ag, g, abg$

The ECDH problem defined that given $g,ag,bg$ it is difficult to calculate $abg$. But it is also difficult to calculate $bg$ given $ag,g,abg$. where $g$ is generator and a,b are elements of group.
2
votes
1answer
100 views

Hash “Preimage by product” resistance

Let H() be a hash function that achieves collision resistance as well as first and second preimage resistance. Let's equip the output set of H of a multiplicative group structure, more precisely a ...
4
votes
2answers
190 views

In a group, is it hard to calculate the base $g$ given $g^a$ and $a$?

Discrete logarithm, that is: calculate $a$ given $g$ and $g^a$, is assumed to be a hard problem in some groups. Is it also hard to calculate $g$ given $g^a$ and $a$?
0
votes
1answer
123 views

Generating cyclic group for Ciphertext-Policy Attribute-Based Encryption [closed]

I am doing Project under the topic CP-ABE.I need to generate a symmetric bilinear group Go of prime order p and with generator g...Then how to choose random elements from Zp....kindly anyone help ...
0
votes
2answers
458 views

Generation of a cyclic group of prime order

I am trying to implement a cyclic group generator in Java, but I am running into some issues. In many cryptosystems, the following phrase is expressed during the key generation stage. Let G be ...
0
votes
1answer
72 views

Converting a number to a member of a multiplicative cyclic group

I am currently trying to make an implementation of the ElGamal encryption for educational purposes. As I understand it, when using the encryption with multiplicative cyclic groups, one generates a ...
1
vote
1answer
125 views

ElGamal and Schnorr groups

As I gather, a normal practice for choosing a cyclic group for ElGamal key generation is to find a safe prime $p$ and use a multiplicative cyclic group with modulus $p$ and order $q = (p-1)/2$. ...
-1
votes
1answer
78 views

Meaning of Multiplicative Group to the power n i.e. Z^n [closed]

What does $Z_q^n$ mean in this notation?      References: on the 2nd paragraph of page: http://en.wikipedia.org/wiki/Learning_with_errors
0
votes
1answer
171 views

Pollard's Rho - Constructing the random function

Suppose we are aiming to solve the discrete logarithm problem $\alpha^x=\beta$ in some cyclic group $G=<\alpha>$. Then we are looking for a (uniformly) random sequence of elements of the form ...
1
vote
2answers
171 views

Elliptic curve group over a prime finite field $F_p$

If $p$ is a big prime, and the elliptic curve $E$ is defined over $F_p$ by the equation $y^2=x^3+ax+b$ where $a,b\in F_p$. The point on $E/F_p$ together with the infinite point $\mathcal{O}$ form a ...
2
votes
2answers
214 views

Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?

As in the title, given $g$, $g^{ab}$ are big elements in a prime group $Z_p$ and $b$ in prime group $Z_r$ ($p > r$, $g$ is one generator of $Z_p$). $a$ is unknown and also in $Z_r$, is finding ...
5
votes
2answers
994 views

What are Cryptographic Multi-linear Maps?

I've encountered this term many times in the fields of Fully-Homomorphic Encryption and Obfuscation. I want to learn those subject and Cryptographic Linear Maps seems to be an obstacle in the way. ...
0
votes
2answers
389 views

Why is ElGamalEngine in bouncy castle restricting input data to be less than the length of the group parameter p?

I am currently using the ElGamalEngine of bouncy castle to implement exponential ElGamal for the purpose of making ElGamal additively homomorphic. To do this i raise the message to be encrypted to the ...
-1
votes
1answer
95 views

Symmetry for finite cyclic groups (Z/pZ)∗

How well is it known that for $i$ such that $1 \leq i \leq \frac{p − 1}2$: $$ g^{i+(p−1)/2} = g^{i−1+(p−1)/2} − g^i + g^{i−1} \pmod p $$ Whilst working in the finite cyclic group of prime moduli ...
6
votes
2answers
330 views

in Bilinear pairings, what is the difference between Type 2 and Type 3?

in Bilinear pairings, what is the difference between Type 2 and Type 3? I understand in Type 2, there exists an efficiently computable homomorphic function $\phi : G_2 \rightarrow G_1$ , which is not ...
2
votes
1answer
35 views

Is the CONF key sharing Problem equivalent to discrete log problem?

If there a proof in the literature which says the CONF Problem is equivalent to solving the discrete log ? Let $g$ be a generator of a cyclic group $\mathbb{G}$ of prime order $q$ CONF problem: ...
1
vote
1answer
188 views

Are the RFC3526 MODP groups Schnorr groups?

I was wondering if a group like the 1536-bit MODP Group from RFC 3526 was a Schnorr group? A Schnorr group must apparently have: $p$ and $q$ being primes $p = q\cdot r+1$ $1 < h < p$ ...
6
votes
1answer
142 views

How can I find the order of the group that an elliptic curve is defined over?

I have a Weierstrass elliptic curve ($y^2=x^3+a \times x+b \mod p $) How can I find the order of the group itself? I have seen Mathematica has a GroupOrder[] ...
1
vote
1answer
283 views

Why is “multiplying” $g^x$ and $g^y$ not possible?

The computational Diffie-Hellman problem states that for a cyclic group $G$ of order $p$ and a generator $g$, it is hard to find the value $g^{xy}$ given only $g^x$ and $g^y$ (but easy if either $x$ ...
-1
votes
1answer
78 views

$f : \mathbb{Z}_n \rightarrow \mathbb{Z}^\times_n$?

Is there any function $f : \mathbb{Z}_n \rightarrow \mathbb{Z}^\times_n$ that is invertible? By invertible, I mean it given $y \in \mathbb{Z}^\times_n$, it should be easy to find $x \in \mathbb{Z}_n$ ...
6
votes
1answer
157 views

Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?

I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but ...
0
votes
0answers
35 views

How to understand the Bilinear mapping with an example [duplicate]

An efficient bilinear map is given by $ e $: $G_{1}$ × $G_{1}$ → $G_{T} $. How can i prove this equation with the help of an example.
3
votes
2answers
206 views

Diffie-Hellman insecure on addition modulo $n$

Assume that the group $G$ is the set $\mathbb{Z}_{n} = \{0,\ldots, n-1\}$ for a 1024 bit integer and $+$ is addition modulo $n$. Then why would Diffie-Hellman key exchange in this group be insecure?
1
vote
1answer
255 views

Diffie-Hellman on additive group

Given the finite cyclic, additive group (G, +), with |G| = n and generator = g, what are the computations and exchanged messages for Diffie-Hellman? What I tried myself: Alice chooses a private $a$ ...
1
vote
0answers
218 views

Best group if one wants the discrete log problem to be hard?

Suppose one is implementing a cryptographic scheme over a group where one needs the discrete logarithm to be hard - what is the recommended group to use? I'm looking for a group where calculations are ...
4
votes
2answers
260 views

Can anyone give an example where (asymmetric) crypto can go wrong due to selection of wrong groups?

Basically the title says it all. It would be great if someone could tell give an example using provable security. More information about groups can be found at: ...
3
votes
1answer
213 views

Generator for Group $QR_{N}$

Let $N=PQ$, where $P=2p+1$ and $Q=2q+1$. $P,Q,p,q$ are prime numbers. $QR_{N}$ is the set of quadratic residues modulo $N$. Please help me to prove $QR_{N}$ is a cyclic group. Note: $QR_{P}$ and ...
3
votes
0answers
87 views

Why does the new encryption scheme proposed by authors stop an adversary from guessing the subspace of the secret key?

In this paper, the authors construct an encryption scheme that is supposed to be resilient to tampering and leaking (as opposed to just leaking). Specifically this scheme: If you look at the ...
2
votes
2answers
405 views

What does the linear assumption over bilinear groups mean?

In the abstract of "Cryptography with Tamperable and Leaky Memory", at the end of the 3rd paragraph, the authors say: In both schemes we rely on the linear assumption over bilinear groups. What ...