# Tag Info

15

The notation $c=\oplus~c_i$ is (terrible) shorthand for $$c=\bigoplus_{i \in I(c)} c_i$$ where the sum sign should be replaced by the big xor sign which could also be written as $$c=\sum_{i \in I(c)} c_i,$$where $\sum$ denotes vector addition modulo 2. An example of this decomposition (for length 8 vectors) is $$c=(1,0,1,0,0,0,1,0)=$$ which is nonzero in ...

10

I'll review the standard mathematical notations used for $H_1:\{0,1\}^*\times\mathbb Z_p^∗\to\mathbb Z_q^∗$ , going from the bottom up. Hopefully, that will make the rest evident. $\{0,1\}$ is the set with the two elements $0$ and $1$, known as Booleans. $\{0,1\}^k$ (for some non-negative integer $k$ ) is the set of tuples with $k$ Booleans, or ...

9

Usually, $^\top$ denotes the transpose of a matrix or vector. Common variants include $^t$ and $^T$. Hence $(c_1,c_2)^\top$ is just $\begin{pmatrix}c_1\\c_2\end{pmatrix}$. Such notation is often used to fit column vectors neatly into text.

7

What exactly does $0...0$ and $1...1$ mean usually? This simply means a (more or less) long string of $0$s or $1$s or more clearly $000000...000000$ and $111111...111111$. Related notiational notes, you may have to use soon: Sometimes the notation $0^n$ and $1^n$ is also used for these strings with exactly $n$ zeroes and ones. Even more generally ...

6

$c = (U,V)$ means that the ciphertext is actually a tuple, made of two parts, $U$ and $V$. It is very common to have ciphertexts that are actually tuples of elements. In this particular case, this scheme is reminiscent to Hashed ElGamal, where ciphertexts are composed of two parts: $U$, which essentially encodes the randomness used, and $V$, which contains ...

4

It's a comma to separate the two things. Alice has $m$ and can calculate $c$ which is equal to $E(K_{e}, m)$. Bob has $c$ and can calculate $m$ which is equal to $D(K_{e}, c)$.

4

Yes, exactly. This can be read as "given m, c is defined as the encryption of m, with the key Ke"

4

There is not a single standard for pseudocode. The := operator is the assignment operator from Pascal, a programming language which was in widespread usage in the 1970s and 1980s, especially for teaching purposes. Many academics have thus been exposed to Pascal and remember it. In Pascal, the equality comparison is =, which matches mathematical practice. By ...

4

TL;DR: Find the most important specification that is of the same type as the one you want to write and use its style for yourself, chances are, other people also have read it. There is a myriad of ways to specify a crypto protocol / design. However, there are four things that you really should take into consideration when writing a crypto-related ...

3

So let's start with the hash functions: $$H_n:A\times B\times C \rightarrow D$$ is the mathematican's notion for a function called $H_n$ that takes arguments from the sets $A,B,C$ (in this order) and maps it to $D$, where $B,C$ are optional. You're facing three types of sets for this: $\{0,1\}^*$ is the set of binary bit-strings of arbitrary size, e.g. ...

3

To quote yyyyyyy from the comments: The $_R$ has nothing to do with the field — it is associated to $\in$! To quote your first link: "For a set $S$, by $a\in_R S$, we mean that $a$ is randomly chosen from $S$." and to quote SEJPM from the comments: If $p\in \mathbb P$ (with $\mathbb P$ being the set of all primes) then the notations ...

3

There is no standard way, and I think it's impossible to find universal agreement. However, it is pretty common to use lowercase letters for integers and uppercase letters for elliptic curve points. And it is very common to indicate as p the prime defining the field $\mathbb F_p$ over which the curve is defined. For the order of the curve you can use ...

2

In formal papers, the standard way would be to either cleverly shorten it or to omit arguments. For example you could write something like $M:=...$ (but please replace the dots with the actual message composition) at the end of your algorithm: $$\operatorname{Output} (M||\sigma_K(M))$$ The alternative to this (a shortened version of your approach) would be ...

2

From context, it appears $\langle A,B \rangle$ simply denotes (some value unambiguously encoding) the pair of values $A$ and $B$. In general, when discussing high-level protocols, no specific encoding for such pairs (or more complex tuples of values) is specified. It is simply assumed that we can unambiguously store and transmit such structured data ...

2

This is string notation: $J_i^0=0^{i-1}10^{k-i}$ means i-1 consecutive 0's followed by a 1 (we don't write $1^1$) which is then followed by k-i consecutive 0's. So $0^{3}10^{4}$ is $00010000$. As for $S^t[i,x]=\langle J_i^t,x\rangle$, with $t\in \{0,1\}$ this is an inner product of $J_i^t$ with $x=(x_1,\ldots,x_k) \in \{0,1\}^k$ so in general $S^t[i,x]=x_i$ ...

1

Correct me if I am wrong $xH_1$ $(ID_A,w_0)$ means $x \times H_1(ID_A) \oplus H_1(w_0)$ where $x \in Z_q^*$ It is hard to formally respond because I don't have access to the paper you mention but with common sense, just by reading the $H_1$ definition, $xH_1$ $(ID_A,w_0)$ means $x \times H_1(ID_A, w_0)$ where $ID_A \in \{0,1\}^*$ and $w_0 \in Z_p^*$. ...

1

The notation $$H_0\;\;\;\text{ Mapping }\{0,1\}^*\to \mathbb Z_p^*$$ means: $H_0$ designates a function from the set $\{0,1\}^*$ of all bitstrings (the typical input set for a theroretical hash function; it includes all bitstrings of various finite length, including the empty bitstring); which may becomes clearer noting that $\{0,1\}$ is the set of the ...

1

"Mapping" is just a synonym of "function" (or its generalisations in category theory). Here $H_0$ is a function from the set $\{0,1\}^*$ of finite binary strings to the set $\mathbf{Z}_p^*$ of non-zero integers modulo $p$. https://en.wikipedia.org/wiki/Map_%28mathematics%29

1

There is no standard (let alone correct) notation for elliptic curves, or anything else for that matter. It is up to each author to precisely state which notation is used for what.

Only top voted, non community-wiki answers of a minimum length are eligible