320 reputation
110
bio website
location
age 31
visits member for 1 year, 6 months
seen Sep 11 at 10:57

Jul
2
awarded  Curious
Apr
22
revised ElGamal with elliptic curves
Small correction to explain what is "d"
Apr
22
suggested suggested edit on ElGamal with elliptic curves
Apr
18
awarded  Yearling
Feb
21
accepted Does Runge phenomenon affect Shamir's secret sharing scheme?
Feb
20
asked Does Runge phenomenon affect Shamir's secret sharing scheme?
Feb
20
comment Homomorphic crypto allowing anonymous yes/no votes?
As for whether the server can simply decrypt each ciphertext individually instead of decrypting the ciphertext containing the overall result of the election, yes, in principle this can happen. But in order to avoid this, e-voting systems usually use what is known as threshold cryptography: the decryption key is shared among a set of trustees, in such a way that only when a certain subset (threshold) of them collaborate, they can decrypt anything.
Feb
20
comment Homomorphic crypto allowing anonymous yes/no votes?
I don't know about the particular case of the Damgård-Jurik e-voting system, but ZKP are generally used in this context not only to make the voter prove that he voted only once, but also to prove that his vote is valid (for example, he only voted "0" or "1").
Jan
24
revised Question Error Correcting Codes
fixed grammar and some spelling mistakes
Jan
24
suggested suggested edit on Question Error Correcting Codes
Dec
6
accepted Difference between Pedersen commitment and commitment based on ElGamal
Nov
24
asked Difference between Pedersen commitment and commitment based on ElGamal
Oct
30
accepted What is it meant by a “hybrid argument”?
Oct
24
accepted Decrypting without using the private key
Oct
24
comment Verifying encrypted addition
Yes, but still you're using a homomorphic cryptosystem, otherwise $\frac{c_1 c_2}{c_3}$ wouldn't give you the encryption of $1$, isn't it?
Oct
23
awarded  Commentator
Oct
23
comment Verifying encrypted addition
Didn't @martin-sustrik said that he didn't want to use any homomorphic cryptosystem? In your solution you're assuming that anyone has access to $c_1=(x_1,w_1)$ and $c_2=(x_2,w_2)$, and if that was the case, then anyone could also compute $E(a+b)$.
Oct
11
comment Decrypting without using the private key
So computing the encryption again, given the claimed plaintext $m$, the public key $h$ and the randomness used $r$ would be more efficient than letting Bob know the plaintext $m$ by computing $\log_g \frac{S}{h^r}$? Why is it that? (assuming that, as I commented, the plaintext is within a restricted set of allowed values, and thus the $\log_g$ is kind of feasible and efficient to compute).
Oct
11
comment Decrypting without using the private key
You're right. I was using exponential ElGamal because the plaintext in this protocol is within a restricted set of allowed values. But for this question I thought it wasn't relevant to mention. It could have perfectly worked with the non-additive homomorphic variant.
Oct
10
asked Decrypting without using the private key