Skip to main content
The 2024 Developer Survey results are live! See the results

Questions tagged [homomorphic-signatures]

A homomorphic signature scheme (also malleable signature scheme) is a digital signature scheme that allows computations on signed data (without access to the secret signing key) while preserving the authenticity of the data.

Filter by
Sorted by
Tagged with
0 votes
0 answers
21 views

Unknown specific generator on a non-invertible semigroup homomorphic signature valid?

There's a quantum polynomial time algorithm to solve DLPs in semigroups, without inverses, so apparently there's nothing to research with those semigroups. I don't know if this is an area of research ...
daniel's user avatar
  • 565
4 votes
2 answers
214 views

Why is the sum of hashes not a proper homomorphic hash function?

Let $H:X \to \{0,1\}^b$ denote a cryptographically secure, $b$-bits hash function on a set $X$. Let $H^∗:\mathcal P(X) \to \{0,1\}^b$ be a function on the power set of $X$ defined by $H^∗(\{x_1,…,x_n\}...
Philippe's user avatar
0 votes
0 answers
28 views

Homomorphic signature for linear combination

Say I have an element $g$ of a cyclic group. Are there homomorphic signature schemes that allow deriving signatures of $g^{ax+by}$ from signatures of $g^a$ and $g^b$?
Adam54's user avatar
  • 283
1 vote
2 answers
102 views

Proving addition of secret values in a small field

Suppose that a prover holds two secret values $x,y\in\mathbb{F}$ and both the prover and verifier have $z\in\mathbb{F}$. The prover wishes to prove that $z=x+y$ without revealing $x,y$ to the verifier....
Kolja's user avatar
  • 143
0 votes
1 answer
42 views

Deriving a signature without the signer

Say we have an element $g=H(m)$ in a group (this element may or may not be a generator of the group). Are there signature schemes that enable to sign this element, and then to be able to derive a ...
Adam54's user avatar
  • 283
2 votes
1 answer
306 views

Shamir's secret sharing homomorphism for different degree polynomials

The $(t,n)$ Shamir’s polynomial based secret sharing scheme is $(+,+)$-homomorphic in which the addition of two polynomials secrets equals the Lagrange’s interpolation of the sum-of-shares for the ...
Mona's user avatar
  • 307
1 vote
1 answer
144 views

What arithmetic operations are supported from fully homomorphic encryptions(FHE)?

I'm wondered about what arithmetic operations are supported from FHE. I want to know for 2nd Gen(BGV,BFV), 3rd GEN(GSW,CGGI), 4th GEN(CKKS)! Is 3rd can support more than and/or/not? I heard it is for ...
user97821's user avatar
0 votes
0 answers
69 views

Assumptions used for Designing Homomorphic CRHF

What are the possible assumptions that have been used or can be used for designing the homomorphic Collision Resistant Hash function (CRHF)? I know Short Integer Solution (SIS) is one of the ...
Crypto_researcher's user avatar
0 votes
0 answers
33 views

Trustless deterministic fingerprint of additive subgroup of $GF(2^n)$

Suppose I have $k$ blocks $B_i$ each consisting of $n$ bits. For erasure code purposes I'd like to be able to produce a computationally binding deterministic hash/fingerprint/digest $H$ such that $\...
orlp's user avatar
  • 4,310
1 vote
0 answers
240 views

Proving the range of a blinded value in a Pedersen commitment in zero knowledge

A prover has the following value: $$C = (h^ag^x)^b$$ and he needs to prove in zero knowledge to a verifier that $x < t$, for some public threshold $t$. The verifier knows $h$, $g$, $C$, and $t$. ...
John N.'s user avatar
  • 23
1 vote
0 answers
68 views

Self-blindable certificates + group signatures

I am searching for a scheme supporting group signatures and at the same time permitting the blinding of the message-signature pair. Let me explain. There is a certification scheme proposed by Verheul: ...
Karina Am's user avatar
1 vote
1 answer
81 views

Checking equivalence among distributed sets

I have elements from $\{0, 1\}^{n}$ (range of a hash function) The master $A$ can have any subset of this range. There are clients that each have a subset from the space, too. I want to make sure that ...
zetaprime's user avatar
  • 591
1 vote
0 answers
184 views

Classic secret sharing schemes vs Homomorphic secret sharing schemes

What is the difference between the classic secret sharing schemes that are used in the protocols of Ben-or and Rabin, Ben-Or, M., Goldwasser, S., Wigderson (that is the Shamir's secret sharing scheme) ...
Hunger Learn's user avatar
0 votes
1 answer
184 views

Homomorphic hash from prime order group $G$ to $Z_p$

Let $G$ be a cyclic group with the generator $g$ and of prime order $p$ such that the discrete-logarithm problem is hard in $G$. A hash function is homomorphic if $H(a\ast b)=H(a)\cdot H(b)$ (where ...
A.Solei's user avatar
  • 405
0 votes
0 answers
37 views

Verify encrypted signature using encrypted version of publickey without decrypt them

I try to explain the problem (maybe it's trivial): is there a way to do the following: sign a message with private key, send encrypted version of signature and an encrypted version of publickey to ...
An Ca's user avatar
  • 1
1 vote
0 answers
133 views

Prove Paillier cryptosystem decryption $M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$

How can we prove mathematically that in Paillier cryptosystem decryption, our message is equal to the right side of $$M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$$
xyz's user avatar
  • 21
5 votes
1 answer
530 views

How expensive would running a practical application on full homomorphic encryption be?

This is a multidisciplinary question, hopefully I can stay on topic. It has been published that we can now use (try?) fully homomorphic encryption computation on cipher text inputs. But I'd like to ...
William Entriken's user avatar
0 votes
1 answer
65 views

Functional signatures vs homomorphic signatures

I found that homomorphic signatures allows an agency to carry out arbitrary computation $f$ on the signed data $m$ and accordingly gain a signature for the computation result $f(m)$ with respect to $f$...
sof's user avatar
  • 61
0 votes
0 answers
76 views

Hash chain based secret revealing using homorphic princples?

I have recently been looking into Homomorphic encryption and I am looking for a specific hash-based encryption/decryption scheme. I don't need a full implementation but I am not sure if what I want ...
ovanwijk's user avatar
  • 155
4 votes
2 answers
391 views

Do any probabilistic hashing algorithms have additive homomorphism?

What I am looking for is a function that meets the following criteria: For each possible input (assume integers from [0, 255]), there must be trillions of possible outputs so as to prevent preimage ...
Chandler Freeman's user avatar
2 votes
1 answer
76 views

Why is the function $f$ one of the inputs of the verification algorithm in homomorphic signature?

As we known, a homomorphic signature scheme consists of the usual algorithms $(\text{KeyGen} , \text{Sign} , \text{Verify})$ as well as an additional algorithm $\text{Evaluate}$ that “translates” ...
Blanco's user avatar
  • 1,622
1 vote
0 answers
27 views

Is there a fast signature scheme homomorphic over $GF(2^b)$ with $b > 1$?

Is there a signature scheme that given $x, y \in \mathbb{Z}_p^k$ and signatures $S(x)$ and $S(y)$ allows any linear combination of $x, y$ to be successfully verified, and nothing else? I'm aware of ...
orlp's user avatar
  • 4,310
0 votes
0 answers
63 views

Is it possible using homomorphic encryption (or some other technique)

Is the following possible with homomorphic encryption (or some other technique)? Suppose the cloud server keeps a key-value list for a user with each value field encrypted (prv key with user). Now, ...
user60588's user avatar
  • 307
0 votes
0 answers
45 views

Homomorphic Encryption Verification

How much is it possibile to devide $E(m_1+m_2)$ by $E (m_1)$ to obtain $E (m_2)$ based on the fully Homomorphic-encryption property which says; $$E (m_1) * E (m_2) = E (m_1 + m_2)$$. And if yes what ...
Slim 's user avatar
6 votes
0 answers
147 views

Is it possible to derive a homomorphic signature from homomorphic encryption

At the moment I am trying to find a practical way to implement a linearly homomorphic signature. Background: "In a homomorphic signature scheme, a user Alice signs some large dataset x using her ...
Tom Hamer's user avatar
0 votes
0 answers
60 views

Where are labels of a Labeled data used in homomorphic message authenticator stored?

In a fully homomorphic message authenticator, Alice can authenticate some large data $D$ using her secret key $s$k. She chooses a label $\tau$ for it, and the authentication algorithm authenticates ...
safyg's user avatar
  • 13
2 votes
0 answers
84 views

Possibility of applying a homomorphic MAC on vectors

The basic idea of homomorphic MACs is that a user can use a secret key to generate a set of tags $σ_1 \dots σ_n$ authenticating values $D_1 \dots D_n$ respectively. so, anyone can homomorphically ...
kawsaw's user avatar
  • 115
0 votes
1 answer
107 views

Efficient Aggregate Signatures With Same Key

Suppose Alice has a set of messages $\mathcal M$ and generates signature pairs for each message $(m_1,s_1)$, $(m_2,s_2)$, ... $(m_n,s_n)$ using the same key. She then transfers these signature pairs ...
sbt's user avatar
  • 1
1 vote
1 answer
153 views

Comparable or partially homomorphic public key derivation for signatures?

Are there any public key signature schemes that can be compared blindly or partially homomorphically based on the private key without knowing the private key? Example: let's say I derive a public key ...
Adam Ierymenko's user avatar
2 votes
2 answers
175 views

Limiting how many key pairs someone can generate without compromising their keys

Is there any way to assign someone a limited quota for how many cryptographic key pairs they can generate (ECC, RSA, any algorithm), and preferably non-interactively? By non-interactively I mean there ...
Adam Ierymenko's user avatar
1 vote
0 answers
49 views

Is there a hash function h(M + t1) = c1 that relates to h(M + t2) = c2 in a way that can be verified without knowing M? [duplicate]

Is there a hash function h(M + t1) = c1 that relates to h(M + t2) = c2 in a way that, knowing t1, t2, c1, c2, and with no knowledge of M, it can be verified whether both use the same M?
d29d4's user avatar
  • 53
1 vote
0 answers
47 views

A qusetion about the security game of Certificateless signatures

Recently I read Certificateless Public Auditing for Data Integrity in the Cloud , I have a question about the security of proposed HOMOMORPHIC AUTHENTICABLE CLS. (Sec. IV). For the Type-I Adversary, ...
JACK GAO's user avatar
0 votes
0 answers
115 views

How to authenticate indivisual value after applying homomorphic encryption using Paillier homomorphic

Assuming I have three parties in a system: Alice, Bob, and a Server. Alice and Bob needs to aggregate some messages $m1$ for Alice, and $m2$ for Bob. And send the aggregate $m1+m2$ to the Server. I ...
NuminousName's user avatar
1 vote
1 answer
338 views

Embedding a secret private key in a homomorphic encryption system

Is there a way to create a homomorphic encryption function F such that given an input it would produce an output and also cryptographically sign the input and output? More formally, an F such that: F(...
avuwa's user avatar
  • 11
2 votes
1 answer
283 views

Time efficiency of Bitcoin Multi-signature Vs. threshold signature

I read this paper (Securing Bitcoin wallets via a new DSA/ECDSA threshold signature scheme) that illustrated that threshold signature is the best solution to avoid single point of failure but I think ...
user36877's user avatar
10 votes
1 answer
357 views

Are there any signatures based on matrix multiplication with noise?

Are there any signatures based on matrix multiplication with noise? Representing the message as a matrix and multiplying with some randomness coming from another matrix such that the signature itself ...
curious's user avatar
  • 6,200
4 votes
1 answer
940 views

Proving membership of a group without revealing identity?

I have an interesting problem for which I've failed, so far, to find an elegant solution. Imagine that a user needs to repeatedly prove to public observers that they are a member of a trusted set ...
Andrew's user avatar
  • 143
1 vote
0 answers
158 views

Is the half-homomorphic property of RSA a problem for blind RSA signatures?

For blind RSA signatures, is it problematic that RSA is half-homomorph? Take a scenario where blind RSA signatures are used for something like a voting procedure or this proposal: Lots of people, ...
thejh's user avatar
  • 111
2 votes
0 answers
127 views

Homomorphic proxy re-signature

Alice has a value $a$ and she signs it using her secret key $d_1$ as: $s_1 = (r_1 * g^a)^{d_1} \bmod p$, and Bob has a value $b$ and he signs it using his secret key $d_2$ as: $s_2 = (r_2 * g^b)^{d_2} ...
user153465's user avatar
  • 1,583
-2 votes
2 answers
1k views

What is the difference between homomorphic encryption and homomorphic signature? [closed]

I want to apply homomorphic signature instead of homomorphic encryption in Provable data possession. So I want to know about homomorphic signature and homomorphic encryption.
user11236's user avatar