# Tag Info

4

xagawa's original answer is almost correct, except for the valid concern pointed out by Florian in the comments. (The updated answer looks good to me.) The answer to the question is "yes," except that the most 'lattice-y' proof works for the modified version of the Regev system defined in Applebaum-Cash-Peikert-Sahai CRYPTO'09. (A version of this was also ...

4

I give another simple proof using the leftover hash lemma. The proof goes as follows, where I'll abuse the notation and assume that q is prime. Game0 The adversary can see $$(A,b,c,u,v,w,s) = (A, As+e, At+f, rA, rb+x\lfloor q/2 \rceil, rc+y\lfloor q/2 \rceil, s).$$ Game1 The view is changed as (A,b,c,u,v,w,s) = (A, As+e, c, rA, rb+x\lfloor q/2 \rceil, ...

2

ECC public keys are not random numbers. They are generated through a scalar multiplication of a random scalar with a known/public point on the curve, called Generator. The entropy lies entirely in the random scalar. Two public keys will collide if the random scalars collide. When you say "256bit ECDSA public key" you probably mean that your elliptic ...

1

Public-key algorithms such as RSA or ECDSA have exactly one private key for each public key and vice versa. Attribute-based Encryption Attribute-based encryption works (a little bit) like that. You have only one public key which is used to create all ciphertexts and you select the users that should be able to decrypt the data based on a policy of ...

1

Your scheme does mean that the server as a passive participant can't read the data, but if your threat model includes the server trying to get access to the data you'll need to do more. tylo mentions the server (or one of its agents) attempting to join a group, but it could probably also MITM the process of another user joining the group (by returning a ...

1

Your questions: if all the clients leave the group (at which moment they delete K from their local store), all the information on the server will be useless as nobody has K anymore if Client2 comes online for the first time and another group member is not online it will not be able to obtain K and will not be able to decrypt any of the data stored on ...

1

It is clear that if $r_i$ is picked randomly the above Mac [defined in the second paragraph] would be secure. Actually, that's not at all clear. I would claim that if I were given that values of $Mac_i(a)$ and $Mac_i(b)$, I could compute the value of $Mac_i(x)$ for any $x$, as long as $a-b$ is relatively prime to $p-1$. To do this, I need the value of ...

Only top voted, non community-wiki answers of a minimum length are eligible