Questions tagged [cramer-shoup]

Cramer-Shoup asymmetric encryption (an extension of ElGamal)

Filter by
Sorted by
Tagged with
6
votes
2answers
550 views

Does Cramer-Shoup allow re-randomization?

Is it possible to re-randomize a ciphertext with the Cramer-Shoup System? I have some Cramer-Shoup ciphertexts and i want to re-randomize them, so they look different and are unlinkable to there ...
0
votes
1answer
89 views

ECCS: Elliptic Curve Cryptography Cramer Shoup

Introduction I know how to do Cramer-Shoup with cyclic groups. But how do I do it in elliptic curve cryptography (ECC)? Cramer-Shoup with cyclic groups Following was taken from Wikipedia: https://...
1
vote
1answer
43 views

Knowledge of discrete log is needed in the proof of Cramer-Shoup public key scheme?

In the proof of the Cramer-Shoup public key scheme [1], I understand that the adversary's view can be seen as equations such as $\log c = x_1 + w x_2, \log d = y_1 + w y_2$ and so on (equation 1 and 2 ...
0
votes
1answer
92 views

Is Cramer-Shoup Lite IND-CCA secure?

Recently, I studied about Cramer-Shoup encryption scheme. Then, I read a book which mentioned a simpler version of this scheme, the Cramer-Shoup Lite encryption scheme. I was wondering if there is ...
0
votes
1answer
66 views

What's the proper way of fitting hash digest to encryption scheme?

I would like to know what is the proper way of fitting the hash digest to the prime in which the encryption scheme operates. regardless if the bits of the hash digest is larger or smaller than the ...
2
votes
0answers
82 views

Intuition for Cramer Shoup Encryption Scheme?

I was reading the Cramer Shoup CCA2 secure encryption scheme. The scheme is as follows. Public key = $(g_1, g_2, c, d, h, hk)$, where $c = g_1^{x_1}g_2^{y_1}$, $d = g_1^{x_2}g_2^{y_2}$, $h = g_1^z$, ...
3
votes
1answer
495 views

Why is the lite version of Cramer-Shoup not IND-CCA2 secure?

In the lite version of Cramer-Shoup we have a group $G$ with generators $g_1$ and $g_2$, private key $a_1, a_2, b_1, b_2$, and public key $A = g_1^{a_1} g_2^{a_2}$, $B = g_1^{b_1} g_2^{b_2}$. ...
2
votes
1answer
350 views

Is Cramer-Shoup backdoorable?

We recently had the question whether it's possible to have multiple private keys with one public key for the cramer-shoup cryptosystem. There it was stated that finding such "secondary" private keys ...
0
votes
1answer
74 views

Can a Cramer-Shoup public key have two different private keys?

Since I am new to the Cramer-Shoup algorithm, I would like to know: Is it possible to have two different private keys for a public key due the key pair generation algorithm that Cramer-Shoup uses? I ...
1
vote
1answer
423 views

Key construction in the Full Cramer-Shoup cryptosystem

The Full Cramer-Shoup Encryption scheme needs to choose six random numbers from $\mathbb{Z}_q$, which we denote them by $ x_1,x_2,y_1,y_2,z_1,z_2 $. Then the scheme hides these random numbers in the ...