3
$\begingroup$

I have been reading this paper by Abdalla, et al. But there's something I don't get about the security proof (Theorem 3.2) for the basic IP scheme from DDH--how are they simulating the mpk's using $g^a$?

I understand that for each basis vector they are sampling secret keys, and for $x_1 - x_0$ they are implicitly setting the secret key $a$. Now, my question is, are they generating the mpk's by finding the canonical vectors and representing the mpk's as a linear combination of the public keys of the corresponding basis vectors? If so, then why is this needed at all?

They can simply sample the secret key for $x_1 - x_0$ as they did for the other basis vectors and represent the mpk's in this way: $(g^a)^{\alpha_i}$, where $\alpha_i$ is the secret key for the i'th basis vector. And, in this way they will be able to answer for queries where the predicate $y_i$ is orthogonal to $(x_1 - x_0)$; the simulator will not answer for $y_j$ where $y_j$ is not orthogonal for $x_1 - x_0$.

I may be missing some crucial point; but, at this moment, I am even unsure of that. So, any help will be highly appreciated.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.