0
$\begingroup$

I'm reading Rivest et al.'s "How to leak a secret", but I'm having a hard time understanding step 4 of the generation procedure. This could be because of my own lack of knowledge regarding operations on ring but the following: enter image description here

makes very little sense to me. How am I supposed to solve this equation? I've tried looking for examples and I stumbled upon this other question, but sadly this only ended up confusing me even further, as I don't understand how that kind of construction could lead to the solution (again, likely caused by my lack of knowledge regarding ring operations).

Do I just "unroll" $C_{k, v}$ and invert the $E_k$s until I'm able to solve for $y_s$? Note that this is how the combining function is defined: enter image description here

Could anyone provide a complete example for this? Pointers to what is that I'm lacking are hugely appreciated as well.

$\endgroup$

1 Answer 1

0
$\begingroup$

Let $$ C_1 = E_k(v\oplus y_1) \\ C_2 = E_k(C_1\oplus y_2) \\ ... \\ v = C_r = E_k(C_{r-1}\oplus y_r)$$ Since we know $y_1, ..., y_{s-1}, y_{s+1}, ... y_r$ and $v$:

  1. get $C_{s-1}$ by encryption from $C_1 \to C_2 \to ... \to C_{s-1} $
  2. get $C_{s} = E_k(C_{s-1} \oplus y_s)$ by decryption from $C_r (= v) \to C_{r-1} \to ... \to C_{s}$
  3. decrypt $C_{s}$ to get $C_{s-1} \oplus y_{s}$.
  4. Finally we get $y_s = (C_{s-1} \oplus y_s) \oplus C_{s-1}$.
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.