Reputation
1,863
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
3 11 24
Impact
~94k people reached

1d
comment What is the notion of an interactive assumption?
Also comparing CPA with DDH is like comparing apples and oranges...Isn't it? CPA maybe secure because internally the attacker cannot solve ddh for instance. So we can't really compare them i think
1d
comment What is the notion of an interactive assumption?
If at some point of your protocol there is an instance of exactly equivalent well known assumption (e.g: DDH), then during the proof the argumentation is "this is an instance of a well-known assumption" and the proof is over? Or you have to instantiate an attacker who is given an instance to the well known problem and he will use attacker A of the scheme to solve his problem? But this is difficult when we are talking about the same assumptions, because the instance of problem B is given should much with that of A.
Jan
17
comment Proof of non-membership on a merkle tree
Lets take the example in Fig 1. The set comprises of 3 elements. How you prove that 1111 is not there?I do not think that it is supported. So there is a restriction on the type of non-membership queries
Jan
17
comment Proof of non-membership on a merkle tree
How the trees are on the size of the data set? Let's say the universe has size |n| and my dataset is of size |d|. Then the membership tree has 2^|n| leaves. And includes the membership tree and the non-mebership one. This the way it is described i think in the paper with the frontier one. They first construct a complete tree of k levels, where k is the size of the hash digest
Jan
17
comment Proof of non-membership on a merkle tree
Ok, but i still can't see according to the document how you can prevent an attacker of proving a non-membership for an item that actually exists in the merkle tree. Instead of returning the asking H(x) and the path, it returns H(x') and H(x'') which are the before and after nodes
Jan
16
comment Proving pseudorandom generators
how your ideas proceed with hybrid arguments?
Jan
15
comment Proof of non-membership on a merkle tree
Still that assumes you are making a Merkle tree with all the universe in it. All possible ranges.
Jan
15
comment Proof of non-membership on a merkle tree
I know about accumulators. My problem is their non-standard q-ary assumptions they are based on.
Jan
14
comment Proof of non-membership on a merkle tree
That seems to kill the nice property of efficient verification of the dataset, since the user has to keep track of all the leaves
Jan
14
comment Proof of non-membership on a merkle tree
It seems a bit not efficient if i have to construct a tree with data not in the first tree. It seems like i have to construct a huge tree for the uninerse-my data
Dec
22
comment ElGamal in a different group
Also something similar is proven in lemma 1 here eprint.iacr.org/2014/256.pdf
Dec
22
comment ElGamal in a different group
From "Extended-DDH and Lossy Trapdoor Functions": "This series of works generalizing DDH-based constructions suggests the heuristic that “anything that can be done with DDH can be done with DCR or QR.” Like any heuristic it is not completely accurate, but it appears to provide the right intuition"
Dec
22
comment ElGamal in a different group
Also with respect to DCR and factoring i was meaning what you wrote. My semantics were wrong though. Wrong vocabulary to describe a common technical agreement. You need to know the right words to communicate your ideas, but not when you work alone on them :)
Dec
22
comment ElGamal in a different group
So the general framework towards this would be to construct a PPT A to break DCR by using a PPT B who breaks DDH
Dec
22
comment ElGamal in a different group
Yehuda the link you provided does not work. Can you tell me the title? Thanks
Dec
21
comment What libraries do people use to implement and evaluate cryptography protocols?
The paper you mentioned has implementation results here homepage.rub.de/andy.rupp/papers/p4r_full.pdf
Dec
21
comment What libraries do people use to implement and evaluate cryptography protocols?
You can check PBC library for pairings and the for math operations the GMP library. Then Charm crypto abstracts a lot of useful basic crypto operations
Dec
21
comment Is that simple additive homomorphic scheme secure?
that is very weak. The attacker always can ask for encryptions. In its weakest form a security game for confidentiality provides ciphers to the attacker at its will
Dec
19
comment Homomorphic OR operations
Can you elaborate? i have 0,1 and the or equals 1 and not 0 as it would be if i multiplied
Dec
19
comment Homomorphic OR operations
I don't get it very clearly. It the truth table of or 3/4 entries are 1 and 1 is zero. If you multiply the elements then 3/4 entries become zero and 1/4 is one. From the cases it becomes 0 when multiplying only one is correct (0*0) and the others (0*1),(1*0) they do give the wrong result, because the OR gives 1.