1
$\begingroup$

In the paper [1,p5], the authors construct a matrix to find out $n$ solutions of a equation set as follows:

enter image description here

where $c_i$ is generated by the adversary, $c$ is picked by the simulator. Note that $c^i$ means different forgeries instead of exponent.

My question is, they find out $n$ solutions iff the determinant equals non-zero, but they don't prove why the determinant equals non-zero. There is no need to prove it?

(I'm not true this is a crypto problem or not, it seems more like a math problem?)

[1] Liu, J. K., Au, M. H., Susilo, W., & Zhou, J. (2014). Linkable ring signature with unconditional anonymity. IEEE Transactions on Knowledge and Data Engineering, 26(1), 157–165. https://doi.org/10.1109/TKDE.2013.17

$\endgroup$
10
  • 2
    $\begingroup$ Let $A$ be an $n\times n$ matrix. Then the system $Ax=b$ has exactly one solution vector $x$ with $n$ entries iff $\det A \neq 0$, that is iff $A$ is invertible. This is a basic result of linear algebra. $\endgroup$
    – SEJPM
    Commented Oct 2, 2018 at 17:06
  • $\begingroup$ @SEJPM Yes, I know it. My question is how to prove $A\neq 0$? The authors didn't give an explaination. $\endgroup$
    – p1gd0g
    Commented Oct 3, 2018 at 2:40
  • 1
    $\begingroup$ From the context you provide it's not clear to me that the matrix is invertible, and I don't have access to the paper since it's behind a paywall. So we need either more context please or a free link to the paper. $\endgroup$
    – eins6180
    Commented Oct 3, 2018 at 7:23
  • $\begingroup$ @eins6180 Thanks for concerning. I'm sorry I'm not sure if it is legal to send you the paper. May I have your contact? Whichever is OK. $\endgroup$
    – p1gd0g
    Commented Oct 3, 2018 at 10:16
  • $\begingroup$ I'm sorry but this is really not how it works. If you're uncomfortable to provide a free link to the paper you need to provide more context. But having this discussion in private prevents everyone else to contribue and learn from it. $\endgroup$
    – eins6180
    Commented Oct 3, 2018 at 13:07

2 Answers 2

0
$\begingroup$

For linear system $Ax = \beta$ with a vector on $n$ unknowns $x$, $A$ is the Vandermonde matrix, produced with powers of $c_i$. For such a matrix, determinant is a product of $(c_i - c_j)$, and so is non-zero for different $c_j$ in the set of field elements.

$\endgroup$
1
  • $\begingroup$ Note that $c^i$ means different forgeries instead of exponent. $\endgroup$
    – p1gd0g
    Commented Oct 4, 2018 at 15:33
0
$\begingroup$

Consider the matrix as follows

$$ \begin{pmatrix} 1 & c_1^{(1)} & c_2^{(1)} & ... & c_n^{(1)}\\ 1 & c_1^{(2)} & c_2^{(2)} & ... & c_n^{(2)}\\ ... & ... & ... & ... & ...\\ 1 & c_1^{(n+1)} & c_2^{(n+1)} & ... & c_n^{(n+1)} \end{pmatrix} $$

If all $c_i$ for $i\in[n]$ are determined after $H_Z$ query, we can say that they are generated from $c=H_Z$ which is randomly picked by $\mathcal{B}$. Then we know that the determinant of this matrix $det(M)=0$ with only negligible possibility.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.