Many lattice IBE scheme follow the scheme outlined in ABB10.

In ABB10, the ciphertext is

$c_0 = u^\top s + x$, where $u$ is a public parameter. (No consider message here.)

I want to ask:

Is it possible to make sure the ciphertext is generated following the scheme?

That is, can the sender provide a zero-knowledge proof that $c_1$ is generated from $us+x$, instead of $u's+x$?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.