New answers tagged

0

A solution from the top of my head: Bob will end the server $(Enc(m), h(m))$ where $h$ is a collision resistant hash. Now, Bob will interact with the server and provide a zero-knowledge proof that $m$ is the same one in $Enc(m)$ and $h(m)$. We note that this verification is in NP (the certificate for the verification is the key used to encrypt $m$). ...


3

Yes, you are right. In a proof, the soundness holds against a computationally unbounded prover and in an argument, the soundness only holds against a polynomially bounded prover. Arguments are thus often called "computationally sound proofs".


0

If Bob attaches a digital signature to the encrypted message, and the server knows Bob's public key for the digital signature, The server would know that it is Bob who sent the message. For decrypting the message, if an algorithm such as aes or des is used, the user is able to decrypt the message with any key, although the decrypted message will probably be ...


2

Sure they can, it's called the socialist millionaires problem. The most common solution is to use Yao's protocol: Alice sends a garbled circuit of the equality function to Bob, and then Alice use oblivious transfers to send the keys necessary for the evaluation of the circuit to Bob. Another option is to rely on additively homomorphic IND-CPA encryption: ...


2

I figured it out, it's quite simple actually. The $d$ values (and $r$ values) are all exponents and chosen from $\mathbb{Z}_q$. Thus all calculations on them directly take place in $\mathbb{Z}_q$. Applying mod $q$ (not mod $p$) to all of my calculations on $d$ and $r$ fixed any problems with calculations.



Top 50 recent answers are included