Tag Info

New answers tagged


Not always, it depends on the particular encryption scheme. Strictly speaking, the proofs only say that breaking indistinguishability is equivalent to breaking the hardness assumption they are based on. There are some cryptosystems, like Rabin's, where the security of the key is equivalent to the security of the ciphertexts, i.e. factoring <=> key ...


Some observations, though I would recommend against inventing your own protocol, at least for real world use: When a new Chat group is formed, a random AES Key is generated and encrypted using each users public key. This means the protocol lacks forward secrecy. Anyone who compromises the private key of a chat participant can decrypt any previous chats ...


Mostly. The two problems are actually more closely equivalent in a gap model than in a non-gap model. Square-DH clearly reduces to CDH either way, but CDH reduces to two calls to Square-DH (you have 3, but you can use $(u-v)^2$ to make it 2). This is fine if the Square-DH adversary is always right, but maybe the adversary only solves the Square-DH problem ...


This scheme is insecure, as anyone with the public key can generate a forgery of an arbitrary message. To do this, the forger would take the message $M$, the public key $y$, pick an arbitrary $z$, and compute $r = y^{-H(M)} g^{z} \bmod p$ and output $(r,z)$

Top 50 recent answers are included