Reputation
1,933
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
3 13 26
Impact
~106k people reached

2d
comment Searchable Encryption with Substring Search
what is practical for you? Why Chase and Shen is not practical?
Apr
29
comment improve of cryptography algorithm
There are standarized crypto algorithms both symmetric (AES) and asymmetric (RSA) that preserve confidentiality. Why you want to come up with your own?
Apr
29
comment improve of cryptography algorithm
why existing crypto algos do not suit you?
Apr
1
comment What is a Non-Interactive Zero Knowledge Proof?
How then in NI-ZKP the proof of zero knowledge proceeds? Because in interactive ZKP we are using a simulator who is powerful to rewind the random tape of the verifier as long as he did not guess correctly the challenge. But now there is no challenge the simulator has to guess. Right?
Mar
3
comment how to verify subset of hashes from hash list
You can have a look in batch signatures verification
Feb
18
comment Simulation-based security?
Recently Mr Yehuda Lindell wrote a manual style manuscript for simulation based security definitions eprint.iacr.org/2016/046.pdf
Feb
9
comment What is the notion of an interactive assumption?
Also comparing CPA with DDH is like comparing apples and oranges...Isn't it? CPA maybe secure because internally the attacker cannot solve ddh for instance. So we can't really compare them i think
Feb
9
comment What is the notion of an interactive assumption?
If at some point of your protocol there is an instance of exactly equivalent well known assumption (e.g: DDH), then during the proof the argumentation is "this is an instance of a well-known assumption" and the proof is over? Or you have to instantiate an attacker who is given an instance to the well known problem and he will use attacker A of the scheme to solve his problem? But this is difficult when we are talking about the same assumptions, because the instance of problem B is given should much with that of A.
Jan
17
comment Proof of non-membership on a merkle tree
Lets take the example in Fig 1. The set comprises of 3 elements. How you prove that 1111 is not there?I do not think that it is supported. So there is a restriction on the type of non-membership queries
Jan
17
comment Proof of non-membership on a merkle tree
How the trees are on the size of the data set? Let's say the universe has size |n| and my dataset is of size |d|. Then the membership tree has 2^|n| leaves. And includes the membership tree and the non-mebership one. This the way it is described i think in the paper with the frontier one. They first construct a complete tree of k levels, where k is the size of the hash digest
Jan
17
comment Proof of non-membership on a merkle tree
Ok, but i still can't see according to the document how you can prevent an attacker of proving a non-membership for an item that actually exists in the merkle tree. Instead of returning the asking H(x) and the path, it returns H(x') and H(x'') which are the before and after nodes
Jan
16
comment Proving pseudorandom generators
how your ideas proceed with hybrid arguments?
Jan
15
comment Proof of non-membership on a merkle tree
Still that assumes you are making a Merkle tree with all the universe in it. All possible ranges.
Jan
15
comment Proof of non-membership on a merkle tree
I know about accumulators. My problem is their non-standard q-ary assumptions they are based on.
Jan
14
comment Proof of non-membership on a merkle tree
That seems to kill the nice property of efficient verification of the dataset, since the user has to keep track of all the leaves
Jan
14
comment Proof of non-membership on a merkle tree
It seems a bit not efficient if i have to construct a tree with data not in the first tree. It seems like i have to construct a huge tree for the uninerse-my data
Dec
22
comment ElGamal in a different group
Also something similar is proven in lemma 1 here eprint.iacr.org/2014/256.pdf
Dec
22
comment ElGamal in a different group
From "Extended-DDH and Lossy Trapdoor Functions": "This series of works generalizing DDH-based constructions suggests the heuristic that “anything that can be done with DDH can be done with DCR or QR.” Like any heuristic it is not completely accurate, but it appears to provide the right intuition"
Dec
22
comment ElGamal in a different group
Also with respect to DCR and factoring i was meaning what you wrote. My semantics were wrong though. Wrong vocabulary to describe a common technical agreement. You need to know the right words to communicate your ideas, but not when you work alone on them :)
Dec
22
comment ElGamal in a different group
So the general framework towards this would be to construct a PPT A to break DCR by using a PPT B who breaks DDH