Tag Info

New answers tagged

0

Suppose an adversary can collect all $k$ ciphertexts created for some unknown plaintext. It is clear that product of all $r_i$ is an invariant under any permutation. So this adversary would multiply ciphertexts collected, reducing to previous question with repeated $r$. To avoid such an attack, one needs non-standard assumption(s) on capability of the ...


3

You have to worry not just about a pair of blinding values being equal, but more complex relationships between them. Thus, finding a proof of security for this approach looks non-trivial to me. Let me elaborate. Suppose $R_j$ is the $j$th blinding variable you use. If $R_i = R_j$, that's a problem, but as you say, that can be made very unlikely. ...


2

The first obvious objection is that it would do a lousy job of blinding values; if you reuse the blinding factor, then it would be practical to correlate the blinded values with their original ones (and the entire point of blinding values is to prevent anyone from doing so). Suppose we had two original encrypted values $c$, $d$, and the corresponded blinded ...


3

Recall that in Paillier encryption with public key $n$ of private factorization and $g=1+n$, encryption of plaintext $m$ reduces to: choose random $r$, $0<r<n$ compute and output ciphertext $c=(1+n\cdot m)\cdot r^n\bmod n^2$. Some ideas: In some contexts, it is feasible to pre-compute $r^n\bmod n^2$ in masked time, before the encryption itself, ...



Top 50 recent answers are included