New answers tagged

1

For "standard" Shamir secret sharing you use a new random polynomial for each secret you want to share (including when you use Shamir secret sharing in SMC). I.e., you would use different polynomials for each secret. Note, that Shamir secret sharing does not directly work on "words" but rather elements of some field. You would have to translate your data ...


6

Sigma protocols as-is are secure only for honest verifiers. However, they can be easily compiled into full-blown zero knowledge protocols. If you don't want interaction, then the Fiat-Shamir transform suffices, with security in the random oracle model. With interaction, you can do the transform at little cost using commitments based on DDH. For more ...


4

I guess you are talking about Figure 5.3? It is said that the Schnorr proof (sigma protocol for discrete log relation) is insecure against cheating verifiers - it is only honest-verifier zero knowledge. Sigma protocols are always only defined in the honest-verifier zero-knowledge setting. To see why a cheating verifier is a problem in Figure 5.3 think ...


2

I have written a tutorial on how to write simulation-based proofs. I think that it should be helpful.


2

The best work I know on "How to test an implementation of a fully homomorphic scheme" is the work from Tancrede Lepoint and Michael Naehrig. The article has been published at AFRICACRYPT 2014. Basically, you need to compare the efficiency (in space and time) of the most important operations: KeyGen, Encrypt, Add, Mult, Decrypt. Links A Comparison of the ...



Top 50 recent answers are included