Reputation
1,515
Top tag
Next privilege 2,000 Rep.
Access moderator tools
Badges
2 9 23
Impact
~73k people reached

4h
comment What are the roles of the simulator in simulation based proofs
Does not seem as cheating in the proof when the simulator is interacting with the real world adversary in order to output indistinguishable outputs?Since in the proof it is desirable to show that the two parties (real world adversary-ideal simulator) learn equal information.
Jul
30
comment What consequences do the plaintext space size has on the performances in the BGV scheme?
I think it is not clear in your mind. Ciphertext size depends on the size on the group and its bitstring representation which depends on $p$ obviously. What is your question about?size of p=1024bit which is the ciphertext space then |ciphertext|=1024 bits. Since you want additions why you need BGV, and not Paillier?
Jul
30
comment What consequences do the plaintext space size has on the performances in the BGV scheme?
You have to be more precise with respect to what operations you need to perform. For instance for multiplication there are various techniques:Karatsuba, Montgomery. Here you can find an idea : en.wikipedia.org/wiki/…
Jul
30
comment What consequences do the plaintext space size has on the performances in the BGV scheme?
The bigger the modulo the more computationally expensive the modular operations. This is obvious.
Jul
28
comment Reduction to cdp,dl or cdh?
@D.W. It is the value to be encoded. and it comes from $\mathbb{Z}_p^*$
Jul
27
comment Reduction to cdp,dl or cdh?
I want to be deterministic. This leakage is acceptable
Jul
24
comment Differential Privacy and appropriate noise distribution
yes but why laplacian and not gaussian for example??What is the special property that makes laplacian suitable for differential privacy
May
30
comment What is the difference between uniformly and at random in crypto definitions?
Seems like uniformity has to do with which elements and randomness how to chose
May
21
comment Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?
@cygnusv report link does not work
May
12
comment Possible to check if $a \in \mathrm{QR}_n$?
@DrLecter But since the adversary knows that $Jacobi(a)=1$ it means that there exists for sure $y$ such that $y^2=x \mod n$. So adversary can decide whethera has QR since it known that $a \in \{\mathbb{J}=1\}$
May
5
comment How to calculate if probability is negligible or not
It's weird that the sum of one nn and on n probability is nn while for this for the product does not hold.
May
5
comment security proof in pairing based cryptography
@FlorianBourse even if there is a correlation in $C_x-C_i$, still you have to recover D
May
5
comment security proof in pairing based cryptography
It is more than straightforward i think following the reductionist approach
May
5
comment security proof in pairing based cryptography
what is $C_x$? Of course if you know $C_x$.What is known to the attacker?What is public and secret?
Apr
27
comment Paillier cryptosystem preserve ordering of sums for two integer sequences
@Alexandros The great about Paillier cryptosystem is the fact that users can encrypt with different randomness under the same public key that will decrypt to the correct plaintext under the single decryption key because $r^{N\lambda}=1 , \forall r \in \mathbb{Z}_{N^*}$
Apr
8
comment Altering the message space of Paillier
@FlorianBourse this can be done by any homomorphic scheme since they are not supposed to be CCA secure. Meaning, the adversary can alter on its will the ciphertext
Apr
7
comment Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?
Well, the assumption is that as long the fault event does not happen then adversary cannot identify that the simulator cheats by not giving her the true transcripts of the original game. This event F is often of this form: [F: A breaks a problem as DDH, CDH, DL, etc] I cannot get why you want to make an assumption that this even happens not negligibly since if this is the case then everything is broken....
Apr
1
comment Is computing roots moduli a composite $N$ a hard problem without knowing the factorization of $N$?
@Thomas you mean that you can find the inverse moduli $N$ but you do not which one is the correct one.
Apr
1
comment Is computing roots moduli a composite $N$ a hard problem without knowing the factorization of $N$?
But $v \equiv u^{-1} \mod N$ also which is easy computable
Apr
1
comment Is computing roots moduli a composite $N$ a hard problem without knowing the factorization of $N$?
@Aleph Then why finding $x \mod N$ from $x^u \mod N$ is difficult? You compute $v=u^{-1}$ and then $x= (x^{u})^v=x^{uu^{-1}} \mod N$