Questions tagged [group-theory]

Groups are an abstract algebraic concept based on a set and a group law (a binary function which closes the set).

Filter by
Sorted by
Tagged with
1 vote
1 answer
47 views

Does a list of discrete log equations reveal information?

Given public generator $g$ of some cyclic group, a secrets $x\in Z_q$, and public pairs $(a_1,b_1),...,(a_n,b_n)$ (where $a_1,...,a_n$ are selected at random from a big set), and prime p, that ...
user avatar
  • 21
1 vote
1 answer
76 views

Distribution of elliptic curves with rank 2?

An elliptic curve defined over a finite field is either cyclic, or a direct sum of two cyclic groups. In cryptography, we use exclusively the former. I was wondering if there is any result on how ...
user avatar
0 votes
1 answer
53 views

If we can solve discrete log with on $\frac{1}{poly(n)}$ instances, then we can solve, with high probability, for all instances

I am trying to prove the following: Given an ensemble $\{p_n, g_n\}$ ($p_n$ is an $n$-bit prime and $g_n \in \mathbb{Z}^*_{p_n}$ is a generator), if $A$ is a deterministic polynomial time algorithm ...
user avatar
  • 189
5 votes
1 answer
1k views

Can there be identical elliptic curve groups of points from different irreducible polynomials in binary extension fields?

Let $E$ be an elliptic curve over a binary extension field $GF(2^m)$, with constructing polynomial $f(z)$ be an irreducible, primitive polynomial over $GF(2)$, and let $G(x_g,y_g)$ be a generator ...
user avatar
0 votes
0 answers
33 views

How to Run the Public Key Protocol for a Zero-Knowledge Proof of Identity?

In the paper Zero-Knowledge Proofs of Identity (by Feige, Fiat, and Shamir) a ZK protocol is described that leverages quadratic residues. Section 3 describes an "Efficient Identification Scheme,&...
user avatar
2 votes
1 answer
67 views

Linearization attack on group with automorphism

Recently, I've had an exchange with Lorenz Panny about Xifrat. He says, that the quasigroup that I use can be linearized and then attacked, and he provided a script that linearized the quasigroup. His ...
user avatar
  • 6,621
6 votes
1 answer
1k views

Why is the discrete logarithm problem hard?

Why is the discrete logarithm problem assumed to be hard? Someone else asked the same question but the answers only explain that exponentiation is in $O(\log(n))$ while the fastest known algorithms to ...
user avatar
  • 217
1 vote
1 answer
47 views

Division by $2$ or principal root with DH oracle

Assume $g$ is generator of multiplicative group modulo prime $p=2q+1$ where $q$ is prime. Assume we know $g^{2t}\bmod p$ and $g^{2}\bmod p$ and assume we can have access to a Diffie-Hellman oracle. ...
user avatar
  • 882
0 votes
1 answer
50 views

How to know if a power is a permutation of an inverse group

Consider the group $$ℤ^*_{55}$$ Is exponentiating to the 3rd power a permutation of: $$ℤ^*_{55}$$ And exponentiation to the 5th power? I'm trying to solve this problem related to groups, but I don't ...
user avatar
0 votes
1 answer
68 views

Given $N$ with $d$ prime factors. Can the number of unique values $x^d \mod N$ calculated for $d>2$? Does the total amount decrease at some point?

Given a number $N$ with $d$ unique prime factors. Can the number of unique values $v$ with $$v \equiv x^d \mod N$$ $$x\in[0,N-1]$$ $$N = \prod_{i=1}^{d} p_i$$ be calculated for $d>2$? (Q1) Does ...
user avatar
  • 475
3 votes
2 answers
167 views

Common exponent problem related to discrete logarithms assuming Diffie Hellman oracle

Let $g$ be a generator of multiplicative group mod $p$ a prime. Suppose we know $$g^{a+km_1}\bmod p$$ $$g^{b-km_2}\bmod p$$ $$g^{a+k'm_3}\bmod p$$ $$g^{b-k'm_4}\bmod p$$ where $m_2m_3-m_4m_1=\phi(p)$ ...
user avatar
  • 882
4 votes
1 answer
143 views

Given a cycle $x \mapsto x^a$ with his starting point $x_1$. Can another starting point $x_2$ be transformed to generate the same cycle?

A cyclic sequence can be produced with $$s_{i+1} = s_i^a \mod N$$ with $N = P \cdot Q$ and $P = 2\cdot p+1$ and $Q = 2\cdot q+1$ with $P,Q,p,q$ primes. and $a$ a primitive root of $p$ and $q$. The ...
user avatar
  • 475
0 votes
1 answer
66 views

Finding collisions of polynomial rolling hashes

A polynomial hash defines a hash as $H = c_1a^{k-1} + c_2a^{k-2} ... + c_ka^0$, all modulo $2^n$ (that is, in $GF(2^n)$). For brevity, let $c$ be a $k$ dimensional vector (encapsulating all the ...
user avatar
3 votes
1 answer
143 views

Distinguishing points in elliptic curves over binary extension fields using Trace

Let $E$ be an elliptic curve curve $𝑦^2 + xy ≡ 𝑥^3+𝑎𝑥^2+𝑏$ (a Weierstrass curve) (in this case, with characteristic 2) over a binary extension field $𝐺𝐹(2^{m})$ with constructing polynomial $𝑓(...
user avatar
0 votes
1 answer
72 views

Could someone explain to me in simple terms why we need a large order of group G for Diffie-Hellman and what does that mean?

For El-gamal encryption, safe prime p is used such that p = 2q+1. However, can someone explain to me in simple terms why we would need in this context a large order of G and how it will contribute in ...
user avatar
  • 1
1 vote
1 answer
81 views

On access to a Diffie Hellman oracle

Assume $g$ is generator of multiplicative group modulo prime $p$. Assume we know $g^X\bmod p$ and $g^{XY}\bmod p$ and assume we can have access to a Diffie-Hellman oracle. Can we find $g^Y\bmod p$ in ...
user avatar
  • 882
0 votes
0 answers
40 views

RSA - is the message a member of the multiplicative group of integers modulo n? [duplicate]

As I understand it, RSA works as follows: Pick two large primes $p$ and $q$ Compute $n = p \cdot q$ The associated group $\mathbb{Z}^*_n$ consists of all integers in the range $[1, n - 1]$ that are ...
user avatar
  • 101
0 votes
0 answers
58 views

How could this scheme work?

When we use a secret sharing scheme we usually want to reconstruct the polynomial function $p(x)\in\mathbb{Z}_q[X]$ with the Lagrange interpolation method and then compute $s=p(0)=a_0$. However, the ...
user avatar
1 vote
1 answer
28 views

Internal direct product of group of invertible elements in a Paillier modulus

Let $p$ and $q$ are Sophie-Germain primes such that $p=2p'+1$ and $q=2q'+1$. Also let $n=pq$ and $n'=p'q'$. In Section 8.2.1 of this paper, the internal direct product of $\mathbb{Z}_{n^2}^*$ is shown ...
user avatar
1 vote
2 answers
199 views

What could a_0=s in Shamir's secret sharing scheme represent?

What could $a_0=s$ in Shamir's secret sharing scheme represent? As we already know in a $k$ out of $n$ secret sharing scheme, a secret is split in $n$ parts however only $k=t$ parts (of a polynomial ...
user avatar
0 votes
1 answer
68 views

An equivalent definition for shamir secret sharing?

Taking into account this paper I will write here a definition that the authors provide. $\textbf{Definition:}$ (linear secret sharing scheme). A $(t,n)$ secret sharing scheme is a linear secret ...
user avatar
0 votes
2 answers
94 views

Secret sharing questions

I would like to make a few questions about Shamir's secret sharing scheme and. To begin with, I am starting with the next theorem that determines the intuition of the whole theorem. $\textbf{Theorem:}$...
user avatar
-1 votes
1 answer
48 views

How to define a cryptosystem when the encryption-decyrption scheme is based on Shamir's secret sharing scheme?

I would like to make a parallelism between Shamir's secret sharing scheme and how to define a cryptosystem where the encryption scheme is based on secret sharing. To begin with I do not know if there ...
user avatar
0 votes
1 answer
29 views

Could we use permutation polynomials for Shamir's secret sharing scheme?

Could we use permutation polynomials for secret sharing scheme like Shamir's? The say that they induce a bijection over $\mathbb{Z}_p$ what does this mean and how does it helps?
user avatar
1 vote
1 answer
112 views

Mathematical formulation for a cryptosystem

I will try to define easily the cryptographic system of this paper. The author designs a communication game for $N$ players. The private information of every player is denoted as $t_i\in T_i$ and ...
user avatar
  • 131
0 votes
0 answers
47 views

Secure multi-party computation made simple - questions

The scheme that I refer to is from this paper. A secret $s\in D$ is obtained by splitting s into a random sum. We have (actually linear) for any $k$ this $k$-out-of-$k$ secret-sharing scheme: Select $...
user avatar
0 votes
0 answers
26 views

Could you provide the proof of a secure multi - secret sharing scheme that fulfils the requirements of correctness and information-theoretic privacy?

Suppose that we have a multi-secret sharing scheme and let $I$ be the a set of agents. Say that $S$ is the space of the (uniform) random variables $s=(s_1,s_2,\cdots,s_I)\in S$ such that the share $...
user avatar
1 vote
0 answers
53 views

Could anybody help by applying a secure multiparty secret sharing scheme?

Suppose that we have a multi-secret sharing scheme as it is described in the literature Let there be $I$ agents and say that $S$ is the space of the (uniform) random variables $s=(s_1,s_2,\cdots,s_I)\...
user avatar
0 votes
0 answers
24 views

Secret sharing scheme combined with probability theory results?

As a sequel of my previous post I am writing a new one with respect to the secret sharing scheme. I will only cite here the answer because I want to make a question on it. $\textbf{Answer:}$ To be ...
user avatar
0 votes
0 answers
22 views

How to design such a secure multiparty computation scheme with the players using a majority rule

Suppose that $y$ is a uniform random variable that is defined over the field (or group or abelian group) $Y$. Let us suppose that there are $N=\{1,2,\cdots,i\cdots,N\}$ agents and only one of them, ...
user avatar
1 vote
1 answer
978 views

Could this be a secure multiparty secret sharing scheme?

Suppose that $y$ is a uniform random variable that is defined over the field (or group or abelian group) $Y$. Let us suppose that there are $N=\{1,2,\cdots,i\cdots,N\}$ agents and only one of them, ...
user avatar
1 vote
0 answers
32 views

Finding an element of $\mathbb{Z}_p$ if the order of that element is known [duplicate]

I have two prime numbers $p$ (1024 bits) and $q$ (160 bits) such that $q$ divides $p-1$. Now I want to find an element $b$ in $\mathbb{Z}_p$ with the order of $q$. That means that $b^q \equiv 1 \mod p$...
user avatar
  • 11
0 votes
1 answer
106 views

How are the cipher, the key and the initial message (that is not encrypted) are releted?

Suppose that $m$ is a message that someone player $i$ wants to send to a network of other players $j\neq -i$. The player to prevent his message from cheating by others uses an encyrpstion scheme. Say $...
user avatar
  • 131
2 votes
0 answers
80 views

Secure multiparty scheme in key (splitting) distribution among the players

Suppose that we have a game with $I$ players and each of them has a private secret say $e_i$. Every player wants to share her secret with the rest of the players but in such a way that she will not be ...
user avatar
0 votes
0 answers
41 views

Could anyone provide any idea of such a protocol?

Could anybody provide the seminal paper and/or every specific manual in mathematics that describes a secure multiparty computation procedure, where the players will exchange encrypted messages (...
user avatar
0 votes
0 answers
24 views

Sharing information scheme of cryptography - operations in modular arithmetic

Taking into account my previous question here and the answer about the proposed encryption-decryption scheme. I am trying to understand how to make possible operations in modular arithmetic for a ...
user avatar
1 vote
1 answer
47 views

computation time of pairing operations and their securities

Suppose G1 is an elliptic group and G2 be a multiplicative group and they are of same prime order p and e is a bilinear pairing, e: G1 X G1 -> G2. The operations e(p,q)r and e(pr,q) gives equal ...
user avatar
1 vote
2 answers
157 views

In AES-256, what exactly forms the extension field $GF(2^8)$?

My question is a little difficult to describe, so let me first start with an analogy In an elliptic curve over a finite field, there are 2 groups - the first group is a finite field over which the ...
user avatar
  • 1,637
5 votes
3 answers
729 views

How to decide if a point on a elliptic curve belongs to a group generated by a generator g?

In the elliptic curve encryption scheme, there is a cyclic group generated by a base point $G$ on the elliptic curve. Given a random point on the elliptic curve, is there a way to decide if the random ...
user avatar
3 votes
1 answer
348 views

problem with a discrete logarithm/cyclic groups example... can anyone clarify this concept for me?

I was watching this really short video about the discrete logarithm example: https://www.youtube.com/watch?v=SL7J8hPKEWY and at 0:38 they show all the possible values that you can get if $p = 17$ and $...
user avatar
2 votes
1 answer
154 views

How to have a hash function that maps from a group element to a binary string of a certain size in charm-crypto?

I am facing a problem in programming with the charm-crypto library. The hash functions for pairing group elements in charm-crypto can only map from a string to a specific field: $\mathbb Z_r$, $G_1$ ...
user avatar
  • 43
0 votes
1 answer
110 views

zkSnark Intro by Maksym Petkus: Is the polynomial defined over $Z$ or is it defined over $Z_n$?

I am reading this explanation of zkSnark written by Maksym Petkus - http://www.petkus.info/papers/WhyAndHowZkSnarkWorks.pdf Here he has a polynomial $p(x) = x^3 − 3x^2 + 2x$ and the homomorphic ...
user avatar
  • 1,637
0 votes
1 answer
61 views

Structure of composition of permutations

If $P_1, P_2$ are finite permutations, what can we say about $P_3 = P_1 \cdot P_2$? That is, what properties of the composition of permutations can be inferred from the properties of the permutations ...
user avatar
1 vote
1 answer
37 views

Generation of the order $\lambda$ (which is lcm((p-1),(q-1))) element g in modified paillier, why $-a^{2n}$?

As the question states, in variants of paillier cryptosystem, such as CS01 and DT-PKC, when they want an element $g$ of order $\lambda$, they choose a random number $a$ from group $Z^*_{n^2}$ and ...
user avatar
  • 73
1 vote
1 answer
174 views

How to find integer point of a ec curve in a given range?

I was looking inside the basics of ecc and found the examples from Internet either uses continuous domain curve or use a very small prime number p like 17 in a ...
user avatar
0 votes
1 answer
126 views

Setting up the discrete logarithm framework

The discrete logarithm problem over prime cyclic groups consist of finding $x$ satisfying $g^x\equiv h\bmod p$ where $g$ is generator of multiplicative group $\mathbb Z/p\mathbb Z$ at a large prime $p$...
user avatar
  • 882
6 votes
2 answers
137 views

Does Poly1305 have weak keys like GCM/GHASH?

Some block cipher keys are weak when used with GCM; see this question. This happens when the multiplier $H$ decided by the key ends up in a small-order subgroup of $\mathbb{F}_{2^{128}}$. Poly1305 ...
user avatar
  • 2,214
4 votes
1 answer
134 views

Why does Index Calculus work?

I understand how the Index Calculus algorithm works - I know & understand the steps. I understand how the steps are derived. However, I am not able to figure out why it works. I can understand why ...
user avatar
  • 1,637
0 votes
1 answer
53 views

what does "product of two cyclic groups" mean

I am reading "Elliptic curve cryptosystems" and the link is here(https://www.ams.org/journals/mcom/1987-48-177/S0025-5718-1987-0866109-5/S0025-5718-1987-0866109-5.pdf). I don't understand ...
user avatar
1 vote
0 answers
28 views

A finite group with a threshold functionality

I am trying to find a generator of a finite group that its powers devides the group into two parts. For example look at the last row of this table that shows the powers of 10 in the group Z_19. You ...
user avatar

1
2 3 4 5
7