Questions tagged [verifiability]

Verifiable encryption is an encryption scheme where one can prove some property of a message m, while the message is given in an encrypted form. When an encryption scheme is secure, the encryption E(m) should reveal no information regarding m.

Filter by
Sorted by
Tagged with
0 votes
0 answers
73 views

Can we be certain that Signal doesn't log metadata (e.g. message graphs)?

I know Signal uses public/private key E2E encryption to ensure it's impossible for them to read the contents of messages. WhatsApp does too, hence Signal's main attraction is that it additionally ...
Seán Healy's user avatar
0 votes
0 answers
70 views

ElGamal signature scheme problem and unsure whether my calculations are wrong or that's the answer

Trying to solve problem with verifying a message through the ElGamal signature scheme and I end up getting two different values. I'm given a prime number p=881 , e1=3, d=60 , and a random value r=11 . ...
Justin B's user avatar
1 vote
2 answers
1k views

Is there a way to get time from signature? Or is it possible to ensure the message was signed at the time that it says it was signed?

Suppose my server receives a message, the public key, and the signature. The message contains a time stamp. Is there a way to get the time stamp from the signature to match it with the message time ...
sudoExclamationExclamation's user avatar
3 votes
1 answer
813 views

When using ECDSA P-384 for signing and verifying messages, should the public key be also included **INSIDE** the message before signing?

I am using ECDSA P-384 for signing and verifying messages. The messages are basically stringified JSON. After receiving, the recipient verifies the signature using the public key. Should the public ...
sudoExclamationExclamation's user avatar
2 votes
2 answers
355 views

ECDSA-SHA256 HTTP Signature String Construction

I must verify an HTTP signature to guarantee the origin and integrity of a webhook data: https://www.blockcypher.com/dev/bitcoin/#webhook-signing This is their x509 PKIX encoded signing key's public ...
Carlos's user avatar
  • 33
6 votes
1 answer
416 views

How can 4 users generate a provable fair random number?

The past few weeks I have been trying to solve a difficult problem. I have asked some cryptography experts but unfortunately they had no clue on how to solve the problem. The situation is as follows, ...
Mathijs's user avatar
  • 61
1 vote
1 answer
78 views

Public key fingerprint verification for large groups

If you were designing: An open source client that offered E2E encryption for e.g. folder sharing between users Each user had public keys for signing (and separate public keys for encryption of ...
gecad41980's user avatar
6 votes
1 answer
218 views

Succinct verification of computation without ZKP

What the state of the art for producing quickly verifiable proofs of correct computation when your proof is allowed to leak knowledge? For context, I am inspired by Miden VM's promises: For any ...
Matthias's user avatar
1 vote
2 answers
189 views

Is there a scheme to enforce a random seed without leaking the seed?

End-to-end encrypted web services (like cryptpad) often include a 128-bit seed in the hash part of the URL (that is not sent to the server), to derive both an identifier that is sent to the server, ...
lukasl's user avatar
  • 113
5 votes
2 answers
1k views

Is there anything like "Proof of Computation"?

Is there any cryptographic method for Proof Of Computation ? If i am running my program on untrusted hardware (remote server), after some time i want to verify the ...
fin's user avatar
  • 51
1 vote
0 answers
57 views

Verifiable computation examples where verification is much faster than re-execution

Verifiable computation (VC) has been practical since Pinocchio and the field has evolved significantly since. What are some of the best examples today where computation is significantly faster than ...
sinoTrinity's user avatar
2 votes
1 answer
290 views

What's the meaning of verifier is "ppt" ? and why we need verifier is ppt in Interactive Proof?

I have been studying Zero Knowledge Proof. I found the Definition of Interactive Proof says that Verifier is ppt. And I only found in PP (Complexity) Wikipedia says that ppt: Turing machines that are ...
Sheldon's user avatar
  • 215
3 votes
1 answer
177 views

Commit the output of verifiable random functions

The problem setting is as follows. Suppose there exists a public input $x$ and the prover evaluates $y \gets VRF_{sk}(x)$, but the prover does not wish to reveal the output $y$. My question is would ...
Chenghong's user avatar
2 votes
1 answer
221 views

Can anybody explain the proof of Rabin and Ben-or of secure multiparty computation?

Can anybody explain the proof of Rabin and Ben-or of secure multiparty computation? The idea is that every player $i$, of $N<+\infty$ players, holds a secret say $s_i$. All of them want to share ...
Hunger Learn's user avatar
0 votes
1 answer
62 views

How "identifier" works in Symmetric Searchable Encryption?

I'm new to this field,Symmetric Searchable Encryption, and have read some papers in this field. Notice lots of these papers about SSE use identifiers when build encrypted index and return identifiers ...
zbo's user avatar
  • 75
-1 votes
1 answer
94 views

How long does it take to generate signature for Elliptic Curve keys using the P-256 curve?

If you have a plain text document, known public key to verify generated signature strings against. EDIT: You do NOT know the private key, this is all you have. Using a modern computing power with 4 ...
Carmageddon's user avatar
1 vote
2 answers
591 views

Is the verification process in ECDSA the same or different from in RSA?

With an RSA key pair, from my understanding, Alice who holds the private key is able to encrypt a message into a signature. She would then send the signature together with her original message to Bob. ...
xenon's user avatar
  • 225
0 votes
1 answer
138 views

Ensure that a speedrun (or video recording) was done in one continuous hop (and not spliced together from many parts)

In speedrunning video games, one records a game being played and beaten in one continuous attempt. However, what can be done to cheat is to do multiple attempts, and splice together clips of the best ...
chausies's user avatar
  • 335
2 votes
0 answers
221 views

Verifiable execution of a program

I would like to know what cryptographic primitives could be used for Alice to prove to Bob that she actually executed a program. The goal is to make a Proof-of-useful work, where Alice proves she ...
ineiti's user avatar
  • 121
1 vote
0 answers
51 views

Efficient proof for Cartesian product

I am trying to find some efficient zero-knowledge arguments that could prove the vector ${\bf v}$ is the Cartesian product of two vectors ${\bf x}$ and ${\bf y}$. I know there are efficient inner ...
Chenghong's user avatar
0 votes
0 answers
117 views

Shamir secret sharing in automated verification tools

Can Shamir secret sharing scheme (SSS) be verified using automated verification tools such as AVISPA? I read in the HLPSL manual that we cannot use arithmetic or relative operations such +,-,< ......
Mona's user avatar
  • 197
0 votes
0 answers
42 views

Verify data integrity without being able to see the clear text

I have a distributed application with many participants. The participants can be in different groups (channels). Is it possible for all data sent in all channels to be accessible as encrypted data, ...
Petar Atanasov's user avatar
1 vote
2 answers
106 views

Is there a way to sign a message so that any subset can be verified?

I would like to know if there's a scheme that can allow something like the following: Alice signs a message $M$ with signature $S$ and gives it to Bob and Mallory. Bob can present any subset of $M$, ...
Joseph Kaptur's user avatar
0 votes
2 answers
721 views

Given ciphertexts C1, C2 of different messages P1 and P2; how can we prove that both C1 and C2 were encrypted using public keys of the same pair?

I vaguely recall reading about a scheme that accomplished this but am not able to figure out which one it was. For the sake of brevity I'm gonna omit any nonces. Let's say we have an asymmetric ...
krkhan's user avatar
  • 87
1 vote
1 answer
97 views

Attestation of private key deletion

I recently came across an article outlining a framework for a hypothetical cryptocurrency, the article is here if you care to read the whole thing. The relevant section is the "Digital Cash" ...
fiberBundle's user avatar
1 vote
0 answers
51 views

Why VDFs need to be "quickly" verifiable?

I am very new to the topic, I found it out only today afternoon, so forgive the dumbness of the question should that be the case. I have tried to grasp the rationale of Verifiable Delayed Functions (...
Nicola Miotto's user avatar
2 votes
1 answer
209 views

Ed25519 signature verification as described in RFC 8032

In RFC 8032, section 5.1.7, it is prescribed that an Ed25519 signature is verified if $[8][S]B = [8]R + [8][k]A'.$ The text then says It's sufficient, but not required, to instead check $[S]B = R + ...
Jay Smith's user avatar
1 vote
1 answer
190 views

Proving I can solve an equation without disclosing the solution (zero-knowledge proof)

Given a (potentially multivariable) equation $f(x)=0$, Peggy wants to prove to Victor that she knows a solution $x^\star$ to it without actually disclosing anything information about the value of $x^\...
chausies's user avatar
  • 335
0 votes
0 answers
64 views

Is it possible to verify a python code produced an answer without re-doing the computation?

Context Suppose Alice asks Bob to write a (python) code/function named get_sqrt(input) that computes and returns the square root of an input number named ...
a.t.'s user avatar
  • 101
1 vote
1 answer
86 views

What's the least computationally expensive way to verify a message is from who they say they are?

We're building an ingame GPS system where only 5 lines of code are executed a second. We're starting to face problems with people spoofing the satellites we use to triangulate. Is it feasible to ...
AlexAndHisScripts's user avatar
1 vote
0 answers
191 views

Generate version 3 x509 certificate from version 1 CA

Please do forgive me for my naivety. I have inherited a legacy system wherein the CA which signs the certificate is of version 1. Is it possible to generate a x509 version 3 certificate which is ...
amrx's user avatar
  • 111
0 votes
1 answer
26 views

Allowing third party to verify and/or replay a draw

I’m not an expert in crypto, and I would like to design draw system (like a lottery, but choosing one of the participants), the most open possible, allowing a third party to verify the data/draws, and ...
Max13's user avatar
  • 237
1 vote
1 answer
345 views

How to compute certificates using Diffie-Hellman key exchange with certificates and Elgamal signature scheme

We consider the Diffie–Hellman key exchange scheme with certificates. We have a system with the three users Alice, Bob and Charley. The Diffie–Hellman algorithm uses p = 61 and α = 18. The three ...
CEL's user avatar
  • 31
3 votes
2 answers
433 views

Certificate validation on an IoT device using few bytes

I'm trying to validate if an IoT device is authentic or it's a fraud. The problem is I only have 17 bytes to do that verification. What if I let the IoT device sign the message with the private key ...
Rafael's user avatar
  • 35
1 vote
1 answer
190 views

Scheme to verify AES key was correctly encrypted for public key recipient

In our file sharing scenario there are three participants: $A$, $B$ and $C$. Each participant has a public-private key pair (let's assume RSA for now). $A$ wants to share a symmetric AES key $k$ with ...
Sigmatics's user avatar
  • 113
1 vote
1 answer
189 views

Publicly verifiable secret sharing scheme

In https://www.win.tue.nl/~berry/papers/crypto99.pdf, Schoenmakers proposes a publicly verifiable secret sharing scheme, that uses a non-interactive DLEQ proof to allow any participant to verify the ...
Fiono's user avatar
  • 567
1 vote
2 answers
169 views

Secret sharing scheme verifiability

This secret sharing scheme takes place in the polynomial ring over a finite field $F_p[x]$, $p$ being a large prime, in the following simplified way: The dealer chooses a private polynomial $f(x)$. ...
Fiono's user avatar
  • 567
2 votes
0 answers
39 views

What are some examples of out of bound channels that work over the Internet in practice?

If I want to verify a public key (be it RSA, PGP, etc.) with another client over the Internet only, what are some viable out-of-bound channels for verification? Which channels have been used in ...
09182736471890's user avatar
2 votes
1 answer
117 views

Does anyone know an easily creatable asymmetric cryptosystem for usage in VDF?

I've read multiple papers about VDFs (1, 2, etc.). I look for a lighter alternative to El-Gamal regarding cryptosystem creation. It can be anything exotic too, but it would be nice to have at least ...
vvwccgz4lh's user avatar
7 votes
2 answers
586 views

Verifiable delay functions vs Proof of Sequential Work

I've read recent papers about verifiable delay functions (Boneh et al 2018) and proof of sequential works (Cohen et al. 2018). I understand that the core difference between the definitions is that a ...
Bartolinio's user avatar
6 votes
2 answers
641 views

Verify partial message given hash of full message

I need to verify partial downloads (retrieved sequentially), given a (preferably short) hash of the complete download. Given a message $m_0 \mathbin\| m_1 \mathbin\| m_2 \mathbin\| \cdots$, hash ...
partialhash's user avatar
3 votes
1 answer
358 views

Verifiable Encryption of a Pedersen Commitment

Can the Verifiable Encryption of a Discrete Logarithm scheme of the paper https://www.shoup.net/papers/verenc.pdf (page 19) be used to verify that a ciphertext encrypts the same value committed in a ...
Fiono's user avatar
  • 567
0 votes
1 answer
36 views

Can randomness protect a list of signatures against forgery attacks?

Suppose we have a list of signatures $S = [s_1, .., s_n]$ for a list of messages $M = [m_1, .., m_n]$, and we want to verify that $S$ is a valid signature of $M$, so each $s_i$ should be valid for ...
abdul rahman taleb's user avatar
5 votes
1 answer
259 views

Is this an error in the Pinocchio Protocol paper

I am going through the Pinocchio protocol paper and I need 2 clarifications in the section Protocol 1 (Verifiable Computation from strong QAP). The part that explains the Verify process, which ...
Abhijit's user avatar
  • 83
0 votes
0 answers
48 views

Verifying valid public key and finding private key? [duplicate]

A naive user of RSA has announced the public key $n = 2903239, e = 5$. Eve has worked out that $n = 1237×2347$. Verify that the public key is valid and explain why the private key is $d = 2319725$. [...
princetongirl818's user avatar
2 votes
1 answer
188 views

How can I generate large primes for Pedersen commitment?

I want to make a commitment on Shamir's Secret Sharing, based on the work of Pedersen, "Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing". To implement the commitment ...
Curve25519's user avatar
4 votes
2 answers
326 views

Does this description of verifiable random functions seem accurate?

I've been thinking about verifiable random functions recently due to my interest in sortition (random selection of political officials). I wrote up this little paragraph below, and I'm wondering: Does ...
Will 's user avatar
  • 153
1 vote
1 answer
138 views

Verification in Threshold RSA or Threshold Paillier

In the key generation of the threshold version of RSA or the threshold version of the Paillier cryptosystem (e.g. "Shoup - 2000 - Practical threshold signatures" or "Fouque et al. - 2000 - Sharing ...
ZoDiaC's user avatar
  • 13
4 votes
1 answer
96 views

Lightweight primality certificates for untrusted DH parameters

Are there any light-weight techniques to generate primality certificates for custom Diffie–Hellman parameters that could be sent to the client to allow it to verify primality without needing to run ...
forest's user avatar
  • 15.2k
1 vote
2 answers
97 views

Constraint about encrypted values

Let V = $[x_1,\ldots ,x_n]$ be a binary vector of length $n$, and let $E(V)$ be the entrywise encryption of this vector. Suppose I want to give to another player, $E(V)$, but also let him have the ...
user1387682's user avatar