I have been reading this paper by Abdalla, et al. But there's something I don't get about the security proof (Theorem 3.2) for the basic IP scheme from DDH--how are they simulating the mpk's using $g^a$?

I understand that for each basis vector they are sampling secret keys, and for $x_1 - x_0$ they are implicitly setting the secret key $a$. Now, my question is, are they generating the mpk's by finding the canonical vectors and representing the mpk's as a linear combination of the public keys of the corresponding basis vectors? If so, then why is this needed at all?

They can simply sample the secret key for $x_1 - x_0$ as they did for the other basis vectors and represent the mpk's in this way: $(g^a)^{\alpha_i}$, where $\alpha_i$ is the secret key for the i'th basis vector. And, in this way they will be able to answer for queries where the predicate $y_i$ is orthogonal to $(x_1 - x_0)$; the simulator will not answer for $y_j$ where $y_j$ is not orthogonal for $x_1 - x_0$.

I may be missing some crucial point; but, at this moment, I am even unsure of that. So, any help will be highly appreciated.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.