In this paper, the authors construct an encryption scheme that is supposed to be resilient to tampering and leaking (as opposed to just leaking).

Specifically this scheme:

enter image description here

If you look at the update procedure they simply multiply the current secret key $g^s$ and multiply it by $g^{Bu}$

If you tamper with this updated secret key you get a mutated secret key $T(g^{s+Bu})$. How do we know this new mutated secret key does not depend on the random subspace $B$ (in some arbitrary way) ?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.