Reputation
6,281
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
1 15 34
Newest
 Nice Answer
Impact
~155k people reached

Sep
4
answered Proof that lottery does not know outcome of draw
Aug
24
answered Can Elgamal be made additively homomorphic and how could it be used for E-voting?
Aug
14
answered Approach towards anonymous e-voting
Aug
13
answered Existing works on pre-computing ElGamal ephermal keys
Aug
13
comment Approach towards anonymous e-voting
P.S., since you are correct about the billions of e-voting systems (slight exaggeration perhaps), I summarize the literature in Chapters 3 and 9 of my dissertation. The bit you are asking about is in 3.3.5: people.scs.carleton.ca/~clark/theses/phd_electronic.pdf
Aug
13
comment Approach towards anonymous e-voting
Paillier is patented so it is questionable if you can use the Baudron et al. approach for an implementation. It inherently requires Paillier because of the way multiple candidates are packed into a single ciphertext. A slightly less efficient but much simpler approach is given by Hirt in Chapter 5 of his dissertation: ftp.inf.ethz.ch/pub/crypto/publications/Hirt01.pdf
Jul
23
comment Additive ElGamal cryptosystem using a finite field
An additional note to augment great answers below: $g$ generates a group of size $q$ but the group is not $\mathbb{Z}_q$. In other words, it is not $1,2,3,\ldots,q$. Rather it is a random looking subset of numbers in $\mathbb{Z}_p^*$; i.e., numbers between $1$ and $p-1$. This is why everything is done $\mod p$.
Jul
23
answered Relation between Threshold Cryptosystem and Secure Multiparty Computation ?
Jul
16
answered Is it possible to ensure security with zero pre-shared information?
Jul
12
awarded  Yearling
Jul
11
comment Feedback on rolling my own entropy gatherer
Hash functions cannot be shown to be good extractors. There is a theory-practice gap on this point, but given that there are very simple constructions that can be shown to be good extractors, one should use them. See Section 1 of this paper: iacr.org/archive/crypto2004/31520493/clean.pdf
Jul
11
awarded  Sportsmanship
Jul
10
reviewed Approve Untraceable communication protocol
Jul
10
answered Do Quantum Key Distribution and Physical Unclonable Functions combine, and how?
Jul
10
answered Untraceable communication protocol
Jun
30
comment Using bad generator in ElGamal Encryption
Your first point is semantics, but all modern crypto textbooks do not consider the secure version (order q instead of p-1) a variant. Elgamal with order p-1 leaks Legrange, not Jacobi, but it is true both Elgamal and RSA leak a bit. Padding is necessary for RSA to have CPA (and likely CCA) security, but Elgamal is CPA secure in prime order subgroups without padding. Padding is essentially never used with Elgamal, either because you want the homomorphic properties or you use a hybrid variant (e.g., hash Elgamal).
Jun
29
comment Using bad generator in ElGamal Encryption
Typo: should be "not generally (always) be hard". Also FWIW, if you try and encrypt an $M$ that is not in the group generated by $g$, then you can end up with a different set of problems.
Jun
29
comment Using bad generator in ElGamal Encryption
If $g$ generates a prime-ordered group that is small (e.g., less than 160 bits), then discrete logs become feasible. If $g$ has composite order, the discrete log will not generally (always) not be hard (there are ways to setup composite groups that are). If $g$ has large prime order, then it is secure even if it is not the order that was intended (but you may have trouble encoding $M$ into $\mathbb{G}_q$).
Jun
29
revised Using bad generator in ElGamal Encryption
added 14 characters in body
Jun
29
revised Using bad generator in ElGamal Encryption
added 88 characters in body; added 120 characters in body; added 14 characters in body