Reputation
5,905
Next tag badge:
134/100 score
18/20 answers
Badges
1 14 28
Newest
 Nice Answer
Impact
~121k people reached

Jan
16
comment Why is proof-by-reduction needed (for Elgamal proof of security, for example)?
@Maeher is correct. What is amiss is that you are not considering all the values (that are functionally dependent on x,r,m) that you have available. As for a step-by-step proof, see: shoup.net/papers/games.pdf (Section 3). And read the whole paper if you want more intuition into how to structure proofs.
Dec
4
awarded  Good Answer
Oct
16
comment Can Elgamal be made additively homomorphic and how could it be used for E-voting?
I don't know of any publications that directly compare Paillier with Elgamal in Gq or with ECC; although I haven't look too hard either. It is just accepted as folk wisdom I guess.
Sep
21
awarded  Custodian
Sep
18
reviewed Approve Random oracle model proofs and programmability
Sep
11
comment What is a “rewinding argument”?
It is a little long, but I illustrate it in my answer to another question here: crypto.stackexchange.com/a/1412/64
Sep
10
revised Are picture files “random enough” to be usable as a one-time pad?
deleted 1 characters in body
Sep
10
answered Are picture files “random enough” to be usable as a one-time pad?
Sep
6
revised Bitcoin Research
added 122 characters in body
Sep
6
revised How are timestamps verified?
edited tags
Sep
6
revised Signature and Timestamp for Long Term Document Archival Question
edited tags
Sep
6
revised Timestamping services authorities, utilizing Linked, hybrid and other than PKI schemes
edited tags
Sep
5
answered Bitcoin Research
Sep
4
answered Proof that lottery does not know outcome of draw
Aug
24
answered Can Elgamal be made additively homomorphic and how could it be used for E-voting?
Aug
14
answered Approach towards anonymous e-voting
Aug
13
answered Existing works on pre-computing ElGamal ephermal keys
Aug
13
comment Approach towards anonymous e-voting
P.S., since you are correct about the billions of e-voting systems (slight exaggeration perhaps), I summarize the literature in Chapters 3 and 9 of my dissertation. The bit you are asking about is in 3.3.5: people.scs.carleton.ca/~clark/theses/phd_electronic.pdf
Aug
13
comment Approach towards anonymous e-voting
Paillier is patented so it is questionable if you can use the Baudron et al. approach for an implementation. It inherently requires Paillier because of the way multiple candidates are packed into a single ciphertext. A slightly less efficient but much simpler approach is given by Hirt in Chapter 5 of his dissertation: ftp.inf.ethz.ch/pub/crypto/publications/Hirt01.pdf
Jul
23
comment Additive ElGamal cryptosystem using a finite field
An additional note to augment great answers below: $g$ generates a group of size $q$ but the group is not $\mathbb{Z}_q$. In other words, it is not $1,2,3,\ldots,q$. Rather it is a random looking subset of numbers in $\mathbb{Z}_p^*$; i.e., numbers between $1$ and $p-1$. This is why everything is done $\mod p$.