In this paper, the authors construct an encryption scheme that is supposed to be resilient to tampering and leaking (as opposed to just leaking).

Specifically this scheme:

enter image description here

If you look at the update procedure they simply multiply the current secret key $g^s$ and multiply it by $g^{Bu}$

If you tamper with this updated secret key you get a mutated secret key $T(g^{s+Bu})$. How do we know this new mutated secret key does not depend on the random subspace $B$ (in some arbitrary way) ?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.