Questions tagged [verifiability]
Verifiable encryption is an encryption scheme where one can prove some property of a message m, while the message is given in an encrypted form. When an encryption scheme is secure, the encryption E(m) should reveal no information regarding m.
89
questions
0
votes
0
answers
73
views
Can we be certain that Signal doesn't log metadata (e.g. message graphs)?
I know Signal uses public/private key E2E encryption to ensure it's impossible for them to read the contents of messages. WhatsApp does too, hence Signal's main attraction is that it additionally ...
0
votes
0
answers
70
views
ElGamal signature scheme problem and unsure whether my calculations are wrong or that's the answer
Trying to solve problem with verifying a message through the ElGamal signature scheme and I end up getting two different values.
I'm given a prime number p=881
, e1=3,
d=60
, and a random value r=11
. ...
1
vote
2
answers
1k
views
Is there a way to get time from signature? Or is it possible to ensure the message was signed at the time that it says it was signed?
Suppose my server receives a message, the public key, and the signature. The message contains a time stamp.
Is there a way to get the time stamp from the signature to match it with the message time ...
3
votes
1
answer
813
views
When using ECDSA P-384 for signing and verifying messages, should the public key be also included **INSIDE** the message before signing?
I am using ECDSA P-384 for signing and verifying messages. The messages are basically stringified JSON. After receiving, the recipient verifies the signature using the public key.
Should the public ...
2
votes
2
answers
355
views
ECDSA-SHA256 HTTP Signature String Construction
I must verify an HTTP signature to guarantee the origin and integrity of a webhook data: https://www.blockcypher.com/dev/bitcoin/#webhook-signing
This is their x509 PKIX encoded signing key's public ...
6
votes
1
answer
416
views
How can 4 users generate a provable fair random number?
The past few weeks I have been trying to solve a difficult problem.
I have asked some cryptography experts but unfortunately they had no clue on how to solve the problem.
The situation is as follows, ...
1
vote
1
answer
78
views
Public key fingerprint verification for large groups
If you were designing:
An open source client that offered E2E encryption for e.g. folder sharing between users
Each user had public keys for signing (and separate public keys for encryption of ...
6
votes
1
answer
218
views
Succinct verification of computation without ZKP
What the state of the art for producing quickly verifiable proofs of correct computation when your proof is allowed to leak knowledge?
For context, I am inspired by Miden VM's promises:
For any ...
1
vote
2
answers
189
views
Is there a scheme to enforce a random seed without leaking the seed?
End-to-end encrypted web services (like cryptpad) often include a 128-bit seed in the hash part of the URL (that is not sent to the server), to derive both an identifier that is sent to the server, ...
5
votes
2
answers
1k
views
Is there anything like "Proof of Computation"?
Is there any cryptographic method for Proof Of Computation ?
If i am running my program on untrusted hardware (remote server), after some time i want to verify the ...
1
vote
0
answers
57
views
Verifiable computation examples where verification is much faster than re-execution
Verifiable computation (VC) has been practical since Pinocchio and the field has evolved significantly since.
What are some of the best examples today where computation is significantly faster than ...
2
votes
1
answer
290
views
What's the meaning of verifier is "ppt" ? and why we need verifier is ppt in Interactive Proof?
I have been studying Zero Knowledge Proof. I found the Definition of Interactive Proof says that Verifier is ppt.
And I only found in PP (Complexity) Wikipedia says that ppt:
Turing machines that are ...
3
votes
1
answer
177
views
Commit the output of verifiable random functions
The problem setting is as follows. Suppose there exists a public input $x$ and the prover evaluates $y \gets VRF_{sk}(x)$, but the prover does not wish to reveal the output $y$. My question is would ...
2
votes
1
answer
221
views
Can anybody explain the proof of Rabin and Ben-or of secure multiparty computation?
Can anybody explain the proof of Rabin and Ben-or of secure multiparty computation?
The idea is that every player $i$, of $N<+\infty$ players, holds a secret say $s_i$. All of them want to share ...
0
votes
1
answer
62
views
How "identifier" works in Symmetric Searchable Encryption?
I'm new to this field,Symmetric Searchable Encryption, and have read some papers in this field. Notice lots of these papers about SSE use identifiers when build encrypted index and return identifiers ...
-1
votes
1
answer
94
views
How long does it take to generate signature for Elliptic Curve keys using the P-256 curve?
If you have a plain text document, known public key to verify generated signature strings against.
EDIT: You do NOT know the private key, this is all you have.
Using a modern computing power with 4 ...
1
vote
2
answers
591
views
Is the verification process in ECDSA the same or different from in RSA?
With an RSA key pair, from my understanding, Alice who holds the private key is able to encrypt a message into a signature. She would then send the signature together with her original message to Bob. ...
0
votes
1
answer
138
views
Ensure that a speedrun (or video recording) was done in one continuous hop (and not spliced together from many parts)
In speedrunning video games, one records a game being played and beaten in one continuous attempt. However, what can be done to cheat is to do multiple attempts, and splice together clips of the best ...
2
votes
0
answers
221
views
Verifiable execution of a program
I would like to know what cryptographic primitives could be used for Alice to prove to Bob that she actually executed a program. The goal is to make a Proof-of-useful work, where Alice proves she ...
1
vote
0
answers
51
views
Efficient proof for Cartesian product
I am trying to find some efficient zero-knowledge arguments that could prove the vector ${\bf v}$ is the Cartesian product of two vectors ${\bf x}$ and ${\bf y}$. I know there are efficient inner ...
0
votes
0
answers
117
views
Shamir secret sharing in automated verification tools
Can Shamir secret sharing scheme (SSS) be verified using automated verification tools such as AVISPA? I read in the HLPSL manual that we cannot use arithmetic or relative operations such +,-,< ......
0
votes
0
answers
42
views
Verify data integrity without being able to see the clear text
I have a distributed application with many participants.
The participants can be in different groups (channels).
Is it possible for all data sent in all channels to be accessible as encrypted data,
...
1
vote
2
answers
106
views
Is there a way to sign a message so that any subset can be verified?
I would like to know if there's a scheme that can allow something like the following:
Alice signs a message $M$ with signature $S$ and gives it to Bob and Mallory.
Bob can present any subset of $M$, ...
0
votes
2
answers
721
views
Given ciphertexts C1, C2 of different messages P1 and P2; how can we prove that both C1 and C2 were encrypted using public keys of the same pair?
I vaguely recall reading about a scheme that accomplished this but am not able to figure out which one it was. For the sake of brevity I'm gonna omit any nonces.
Let's say we have an asymmetric ...
1
vote
1
answer
97
views
Attestation of private key deletion
I recently came across an article outlining a framework for a hypothetical cryptocurrency, the article is here if you care to read the whole thing. The relevant section is the "Digital Cash" ...
1
vote
0
answers
51
views
Why VDFs need to be "quickly" verifiable?
I am very new to the topic, I found it out only today afternoon, so forgive the dumbness of the question should that be the case.
I have tried to grasp the rationale of Verifiable Delayed Functions (...
2
votes
1
answer
209
views
Ed25519 signature verification as described in RFC 8032
In RFC 8032, section 5.1.7, it is prescribed that an Ed25519 signature is verified if
$[8][S]B = [8]R + [8][k]A'.$
The text then says
It's sufficient, but not required, to instead check $[S]B = R + ...
1
vote
1
answer
190
views
Proving I can solve an equation without disclosing the solution (zero-knowledge proof)
Given a (potentially multivariable) equation $f(x)=0$, Peggy wants to prove to Victor that she knows a solution $x^\star$ to it without actually disclosing anything information about the value of $x^\...
0
votes
0
answers
64
views
Is it possible to verify a python code produced an answer without re-doing the computation?
Context
Suppose Alice asks Bob to write a (python) code/function named get_sqrt(input) that computes and returns the square root of an input number named ...
1
vote
1
answer
86
views
What's the least computationally expensive way to verify a message is from who they say they are?
We're building an ingame GPS system where only 5 lines of code are executed a second. We're starting to face problems with people spoofing the satellites we use to triangulate. Is it feasible to ...
1
vote
0
answers
191
views
Generate version 3 x509 certificate from version 1 CA
Please do forgive me for my naivety. I have inherited a legacy system wherein the CA which signs the certificate is of version 1. Is it possible to generate a x509 version 3 certificate which is ...
0
votes
1
answer
26
views
Allowing third party to verify and/or replay a draw
I’m not an expert in crypto, and I would like to design draw system (like a lottery, but choosing one of the participants), the most open possible, allowing a third party to verify the data/draws, and ...
1
vote
1
answer
345
views
How to compute certificates using Diffie-Hellman key exchange with certificates and Elgamal signature scheme
We consider the Diffie–Hellman key exchange scheme with certificates. We have a system with the three users Alice, Bob and Charley. The Diffie–Hellman algorithm uses p = 61 and α = 18. The three ...
3
votes
2
answers
433
views
Certificate validation on an IoT device using few bytes
I'm trying to validate if an IoT device is authentic or it's a fraud. The problem is I only have 17 bytes to do that verification.
What if I let the IoT device sign the message with the private key ...
1
vote
1
answer
190
views
Scheme to verify AES key was correctly encrypted for public key recipient
In our file sharing scenario there are three participants: $A$, $B$ and $C$. Each participant has a public-private key pair (let's assume RSA for now). $A$ wants to share a symmetric AES key $k$ with ...
1
vote
1
answer
189
views
Publicly verifiable secret sharing scheme
In https://www.win.tue.nl/~berry/papers/crypto99.pdf, Schoenmakers proposes a publicly verifiable secret sharing scheme, that uses a non-interactive DLEQ proof to allow any participant to verify the ...
1
vote
2
answers
169
views
Secret sharing scheme verifiability
This secret sharing scheme takes place in the polynomial ring over a finite field $F_p[x]$, $p$ being a large prime, in the following simplified way:
The dealer chooses a private polynomial $f(x)$.
...
2
votes
0
answers
39
views
What are some examples of out of bound channels that work over the Internet in practice?
If I want to verify a public key (be it RSA, PGP, etc.) with another client over the Internet only, what are some viable out-of-bound channels for verification? Which channels have been used in ...
2
votes
1
answer
117
views
Does anyone know an easily creatable asymmetric cryptosystem for usage in VDF?
I've read multiple papers about VDFs (1, 2, etc.).
I look for a lighter alternative to El-Gamal regarding cryptosystem creation.
It can be anything exotic too, but it would be nice to have at least ...
7
votes
2
answers
586
views
Verifiable delay functions vs Proof of Sequential Work
I've read recent papers about verifiable delay functions (Boneh et al 2018) and proof of sequential works (Cohen et al. 2018). I understand that the core difference between the definitions is that a ...
6
votes
2
answers
641
views
Verify partial message given hash of full message
I need to verify partial downloads (retrieved sequentially), given a (preferably short) hash of the complete download.
Given a message $m_0 \mathbin\| m_1 \mathbin\| m_2 \mathbin\| \cdots$, hash ...
3
votes
1
answer
358
views
Verifiable Encryption of a Pedersen Commitment
Can the Verifiable Encryption of a Discrete Logarithm scheme of the paper https://www.shoup.net/papers/verenc.pdf (page 19) be used to verify that a ciphertext encrypts the same value committed in a ...
0
votes
1
answer
36
views
Can randomness protect a list of signatures against forgery attacks?
Suppose we have a list of signatures $S = [s_1, .., s_n]$ for a list of messages $M = [m_1, .., m_n]$, and we want to verify that $S$ is a valid signature of $M$, so each $s_i$ should be valid for ...
5
votes
1
answer
259
views
Is this an error in the Pinocchio Protocol paper
I am going through the Pinocchio protocol paper and I need 2 clarifications in the section Protocol 1 (Verifiable Computation from strong QAP). The part that explains the Verify process, which ...
0
votes
0
answers
48
views
Verifying valid public key and finding private key? [duplicate]
A naive user of RSA has announced the public key $n = 2903239, e = 5$.
Eve has worked out that $n = 1237×2347$. Verify that the public key is valid
and explain why the private key is $d = 2319725$. [...
2
votes
1
answer
188
views
How can I generate large primes for Pedersen commitment?
I want to make a commitment on Shamir's Secret Sharing, based on the work of Pedersen, "Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing".
To implement the commitment ...
4
votes
2
answers
326
views
Does this description of verifiable random functions seem accurate?
I've been thinking about verifiable random functions recently due to my interest in sortition (random selection of political officials). I wrote up this little paragraph below, and I'm wondering: Does ...
1
vote
1
answer
138
views
Verification in Threshold RSA or Threshold Paillier
In the key generation of the threshold version of RSA or the threshold version of the Paillier cryptosystem (e.g. "Shoup - 2000 - Practical threshold signatures" or "Fouque et al. - 2000 - Sharing ...
4
votes
1
answer
96
views
Lightweight primality certificates for untrusted DH parameters
Are there any light-weight techniques to generate primality certificates for custom Diffie–Hellman parameters that could be sent to the client to allow it to verify primality without needing to run ...
1
vote
2
answers
97
views
Constraint about encrypted values
Let V = $[x_1,\ldots ,x_n]$ be a binary vector of length $n$, and let $E(V)$ be the entrywise encryption of this vector.
Suppose I want to give to another player, $E(V)$, but also let him have the ...