# Tag Info

0

To answer your question (ignoring for a moment the inaccuracy of the definition), if am understanding you correctly you are wondering if $p \leq \kappa(|x|)$ how can there exist a $q(|x|)$ so that $K$ outputs a witness with probability $\frac{p - \kappa(|x|)}{q(|x|)}$ (because in this case the probability might be negative). I will try to explain this. ...

2

For CPA security it is actually enough that the first scheme, i.e., $\pi = (gen, enc, dec)$ is CPA secure. Lets define the CPA game of a general scheme $\pi = (Gen, Enc, Dec)$ against an adversary $A$ as follows: We sample $(pk, sk) \leftarrow Gen(1^\lambda)$, and send $pk$ to $A$. $A$ outputs messages $m_0$ and $m_1$. We sample $b \leftarrow \{0,1\}$ (a ...

1

I am having a hard time understanding your argument why you think this could be simulated. However, here is an explanation of why it could not. Assume Bob is honest and has input $y$, now we have to simulate the view of Alice. As the simulator, as you state, we only get the input and output of Alice. I.e, we only know $x$ and $f(x,y)$. We only need to ...

1

Short answer, no. The 112-bit value is actually the security parameter, and not necessarily the key length. For all NIST hash functions, the security provided is half the output bit of the hash function, therefore SHA-224 or better is required for 112-bit security. The security parameter we are considering is collision resistance. However, there are other ...

0

I am not aware of any work that proposes a Gap problem related to LWE. The reason is probably that LWE is an average-case problem specifically designed for the use in crypto. However, there are the related worst-case problems, e.g. the shortest vector problem (SVP), that come with a Gap version. So, you might want to have a look at GapSVP and GapCVP.

0

First, a fact. For some polynomial $f_x$ and some random polynomial of the same degree, say $t$, an adversary given only $f_x+t$, knows no additional information about $f_x$. Basically (due to the finite ring), this operation is the same thing as the one-time-pad. On to the problem at hand. Let $f_3=f_2\cdot(s+1)$. Since $f_2$ and $s$ have the same ...

Top 50 recent answers are included