# Tag Info

1

Multivariable Crypto drags a long history of attempts , breaking and repair for at least 20 years. Introduced in the late 80s, and not based on classical number theory, it was presented as an alternative to the conventionnal Public Key Crypto, and could resists the quantum attacks. The keys for these systems are usually very long, even huge, despite great ...

1

Public-key algorithms such as RSA or ECDSA have exactly one private key for each public key and vice versa. Attribute-based Encryption Attribute-based encryption works (a little bit) like that. You have only one public key which is used to create all ciphertexts and you select the users that should be able to decrypt the data based on a policy of ...

2

ECC public keys are not random numbers. They are generated through a scalar multiplication of a random scalar with a known/public point on the curve, called Generator. The entropy lies entirely in the random scalar. Two public keys will collide if the random scalars collide. When you say "256bit ECDSA public key" you probably mean that your elliptic ...

-2

Generally speaking, the bit length of the exponents are the same as the modulus. Depending on the implementation, there may also be some extra data in the public/private key structure. Here is a good discussion on the concept of key length as it relates to the public/private values: Private key length bytes

0

Well to start of, great question it really got me thinking. unfortunately I cannot give you an exact answer but i can tell you the chances of getting the same public key as someone else is negligible. If the chance would have been anything but negligible the whole system would collapse since and attacker would have just as much chance of getting your key ...

4

xagawa's original answer is almost correct, except for the valid concern pointed out by Florian in the comments. (The updated answer looks good to me.) The answer to the question is "yes," except that the most 'lattice-y' proof works for the modified version of the Regev system defined in Applebaum-Cash-Peikert-Sahai CRYPTO'09. (A version of this was also ...

4

I give another simple proof using the leftover hash lemma. The proof goes as follows, where I'll abuse the notation and assume that q is prime. Game0 The adversary can see $$(A,b,c,u,v,w,s) = (A, As+e, At+f, rA, rb+x\lfloor q/2 \rceil, rc+y\lfloor q/2 \rceil, s).$$ Game1 The view is changed as (A,b,c,u,v,w,s) = (A, As+e, c, rA, rb+x\lfloor q/2 \rceil, ...

0

if the adversary knows $m^{e_1}$, $m^{e_2}$ and $d_1e_2$, is it able to guess m? Obviously not; if he could, then they could break RSA. Here's the RSA problem, given $m^e$, $e$ (and the modulus $N$), recover $m$. Suppose that we can solve your problem, that is, we had a black box that, given $m^{e_1}$, $m^{e_2}$ and $d_1e_2$, could recover $m$. Then, ...

-1

Blinding technics are well know now to defeat most attacks against SCA. You need a random number generator (True or Pseudo) to generate unpredictable random $r_i$. Additionnal precautions against Zero Attacks values can alo be taken. Try this: $m_0=y_0 \times r_0 \; + \; r_1 \times p \; mod \;(r_2 \times p)$

1

Your scheme does mean that the server as a passive participant can't read the data, but if your threat model includes the server trying to get access to the data you'll need to do more. tylo mentions the server (or one of its agents) attempting to join a group, but it could probably also MITM the process of another user joining the group (by returning a ...

1

Your questions: if all the clients leave the group (at which moment they delete K from their local store), all the information on the server will be useless as nobody has K anymore if Client2 comes online for the first time and another group member is not online it will not be able to obtain K and will not be able to decrypt any of the data stored on ...

1

It is clear that if $r_i$ is picked randomly the above Mac [defined in the second paragraph] would be secure. Actually, that's not at all clear. I would claim that if I were given that values of $Mac_i(a)$ and $Mac_i(b)$, I could compute the value of $Mac_i(x)$ for any $x$, as long as $a-b$ is relatively prime to $p-1$. To do this, I need the value of ...

Top 50 recent answers are included