meta user
network profile
| bio | website | people.scs.carleton.ca/~clark |
|---|---|---|
| location | Ottawa, Canada | |
| age | 32 | |
| visits | member for | 1 year, 11 months |
| seen | 14 hours ago | |
| stats | profile views | 106 |
Postdoctoral fellow interested in authentication and cryptographic voting.
|
Aug 13 |
comment |
Approach towards anonymous e-voting P.S., since you are correct about the billions of e-voting systems (slight exaggeration perhaps), I summarize the literature in Chapters 3 and 9 of my dissertation. The bit you are asking about is in 3.3.5: people.scs.carleton.ca/~clark/theses/phd_electronic.pdf |
|
Aug 13 |
comment |
Approach towards anonymous e-voting Paillier is patented so it is questionable if you can use the Baudron et al. approach for an implementation. It inherently requires Paillier because of the way multiple candidates are packed into a single ciphertext. A slightly less efficient but much simpler approach is given by Hirt in Chapter 5 of his dissertation: ftp.inf.ethz.ch/pub/crypto/publications/Hirt01.pdf |
|
Jul 23 |
comment |
Additive ElGamal cryptosystem using a finite field An additional note to augment great answers below: $g$ generates a group of size $q$ but the group is not $\mathbb{Z}_q$. In other words, it is not $1,2,3,\ldots,q$. Rather it is a random looking subset of numbers in $\mathbb{Z}_p^*$; i.e., numbers between $1$ and $p-1$. This is why everything is done $\mod p$. |
|
Jul 23 |
answered | Relation between Threshold Cryptosystem and Secure Multiparty Computation ? |
|
Jul 16 |
answered | Is it possible to ensure security with zero pre-shared information? |
|
Jul 12 |
awarded | Yearling |
|
Jul 11 |
comment |
Feedback on rolling my own entropy gatherer Hash functions cannot be shown to be good extractors. There is a theory-practice gap on this point, but given that there are very simple constructions that can be shown to be good extractors, one should use them. See Section 1 of this paper: iacr.org/archive/crypto2004/31520493/clean.pdf |
|
Jul 11 |
awarded | Sportsmanship |
|
Jul 10 |
reviewed | Approve suggested edit on Untraceable communication protocol |
|
Jul 10 |
answered | Do Quantum Key Distribution and Physical Unclonable Functions combine, and how? |
|
Jul 10 |
answered | Untraceable communication protocol |
|
Jun 30 |
comment |
Using bad generator in ElGamal Encryption Your first point is semantics, but all modern crypto textbooks do not consider the secure version (order q instead of p-1) a variant. Elgamal with order p-1 leaks Legrange, not Jacobi, but it is true both Elgamal and RSA leak a bit. Padding is necessary for RSA to have CPA (and likely CCA) security, but Elgamal is CPA secure in prime order subgroups without padding. Padding is essentially never used with Elgamal, either because you want the homomorphic properties or you use a hybrid variant (e.g., hash Elgamal). |
|
Jun 29 |
comment |
Using bad generator in ElGamal Encryption Typo: should be "not generally (always) be hard". Also FWIW, if you try and encrypt an $M$ that is not in the group generated by $g$, then you can end up with a different set of problems. |
|
Jun 29 |
comment |
Using bad generator in ElGamal Encryption If $g$ generates a prime-ordered group that is small (e.g., less than 160 bits), then discrete logs become feasible. If $g$ has composite order, the discrete log will not generally (always) not be hard (there are ways to setup composite groups that are). If $g$ has large prime order, then it is secure even if it is not the order that was intended (but you may have trouble encoding $M$ into $\mathbb{G}_q$). |
|
Jun 29 |
revised |
Using bad generator in ElGamal Encryption added 14 characters in body |
|
Jun 29 |
revised |
Using bad generator in ElGamal Encryption added 88 characters in body; added 120 characters in body; added 14 characters in body |
|
Jun 29 |
answered | Using bad generator in ElGamal Encryption |
|
Jun 18 |
answered | Are there any differences between PIR, oblivious transfer and differential privacy? |
|
May 7 |
comment |
RSA reencryption scheme Section 4.3 of this paper has an example for RSA but it is unidirectional: www.isoc.org/isoc/conferences/ndss/03/proceedings/papers/14.pdf |
|
May 7 |
comment |
RSA reencryption scheme This is called proxy re-encryption and there are a lot of ways of doing it: en.wikipedia.org/wiki/Proxy_re-encryption |
