Questions tagged [homomorphic-signatures]
A homomorphic signature scheme (also malleable signature scheme) is a digital signature scheme that allows computations on signed data (without access to the secret signing key) while preserving the authenticity of the data.
41 questions
0
votes
0
answers
45
views
Set union homomorphic hash function that ignores duplicates
Does a hash function with set(not multi-set) union homomorphism exist? LT-hash is very close to what I am looking for where items could be added/removed from the set in arbitrary order but adding the ...
- 1
0
votes
0
answers
22
views
Unknown specific generator on a non-invertible semigroup homomorphic signature valid?
There's a quantum polynomial time algorithm to solve DLPs in semigroups, without inverses, so apparently there's nothing to research with those semigroups.
I don't know if this is an area of research ...
- 565
4
votes
2
answers
236
views
Why is the sum of hashes not a proper homomorphic hash function?
Let $H:X \to \{0,1\}^b$ denote a cryptographically secure, $b$-bits hash function on a set $X$. Let $H^∗:\mathcal P(X) \to \{0,1\}^b$ be a function on the power set of $X$ defined by
$H^∗(\{x_1,…,x_n\}...
- 59
0
votes
0
answers
28
views
Homomorphic signature for linear combination
Say I have an element $g$ of a cyclic group. Are there homomorphic signature schemes that allow deriving signatures of $g^{ax+by}$ from signatures of $g^a$ and $g^b$?
- 283
1
vote
2
answers
114
views
Proving addition of secret values in a small field
Suppose that a prover holds two secret values $x,y\in\mathbb{F}$ and both the prover and verifier have $z\in\mathbb{F}$. The prover wishes to prove that $z=x+y$ without revealing $x,y$ to the verifier....
- 155
0
votes
1
answer
42
views
Deriving a signature without the signer
Say we have an element $g=H(m)$ in a group (this element may or may not be a generator of the group).
Are there signature schemes that enable to sign this element, and then to be able to derive a ...
- 283
2
votes
1
answer
341
views
Shamir's secret sharing homomorphism for different degree polynomials
The $(t,n)$ Shamir’s polynomial based secret sharing scheme is $(+,+)$-homomorphic in which the addition of two polynomials secrets equals the Lagrange’s interpolation of the sum-of-shares for the ...
- 327
1
vote
1
answer
182
views
What arithmetic operations are supported from fully homomorphic encryptions(FHE)?
I'm wondered about what arithmetic operations are supported from FHE.
I want to know for 2nd Gen(BGV,BFV), 3rd GEN(GSW,CGGI), 4th GEN(CKKS)!
Is 3rd can support more than and/or/not? I heard it is for ...
- 31
0
votes
0
answers
72
views
Assumptions used for Designing Homomorphic CRHF
What are the possible assumptions that have been used or can be used for designing the homomorphic Collision Resistant Hash function (CRHF)? I know Short Integer Solution (SIS) is one of the ...
0
votes
0
answers
35
views
Trustless deterministic fingerprint of additive subgroup of $GF(2^n)$
Suppose I have $k$ blocks $B_i$ each consisting of $n$ bits. For erasure code purposes I'd like to be able to produce a computationally binding deterministic hash/fingerprint/digest $H$ such that $\...
- 4,355
1
vote
0
answers
248
views
Proving the range of a blinded value in a Pedersen commitment in zero knowledge
A prover has the following value:
$$C = (h^ag^x)^b$$
and he needs to prove in zero knowledge to a verifier that $x < t$, for some public threshold $t$.
The verifier knows $h$, $g$, $C$, and $t$. ...
- 23
1
vote
0
answers
70
views
Self-blindable certificates + group signatures
I am searching for a scheme supporting group signatures and at the same time permitting the blinding of the message-signature pair. Let me explain.
There is a certification scheme proposed by Verheul: ...
- 11
1
vote
1
answer
83
views
Checking equivalence among distributed sets
I have elements from $\{0, 1\}^{n}$ (range of a hash function)
The master $A$ can have any subset of this range.
There are clients that each have a subset from the space, too.
I want to make sure that ...
- 591
1
vote
0
answers
199
views
Classic secret sharing schemes vs Homomorphic secret sharing schemes
What is the difference between the classic secret sharing schemes that are used in the protocols of Ben-or and Rabin, Ben-Or, M., Goldwasser, S., Wigderson (that is the Shamir's secret sharing scheme) ...
- 279
0
votes
1
answer
198
views
Homomorphic hash from prime order group $G$ to $Z_p$
Let $G$ be a cyclic group with the generator $g$ and of prime order $p$ such that the discrete-logarithm problem is hard in $G$.
A hash function is homomorphic if $H(a\ast b)=H(a)\cdot H(b)$ (where ...
- 415
0
votes
0
answers
39
views
Verify encrypted signature using encrypted version of publickey without decrypt them
I try to explain the problem (maybe it's trivial): is there a way to do the following: sign a message with private key, send encrypted version of signature and an encrypted version of publickey to ...
- 1
1
vote
0
answers
135
views
Prove Paillier cryptosystem decryption $M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$
How can we prove mathematically that in Paillier cryptosystem decryption, our message is equal to the right side of
$$M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$$
- 21
5
votes
1
answer
569
views
How expensive would running a practical application on full homomorphic encryption be?
This is a multidisciplinary question, hopefully I can stay on topic.
It has been published that we can now use (try?) fully homomorphic encryption computation on cipher text inputs. But I'd like to ...
- 171
0
votes
1
answer
66
views
Functional signatures vs homomorphic signatures
I found that homomorphic signatures allows an agency to carry out arbitrary computation $f$ on the signed data $m$ and accordingly gain a signature for the computation result $f(m)$ with respect to $f$...
- 61
0
votes
0
answers
76
views
Hash chain based secret revealing using homorphic princples?
I have recently been looking into Homomorphic encryption and I am looking for a specific hash-based encryption/decryption scheme.
I don't need a full implementation but I am not sure if what I want ...
- 155
4
votes
2
answers
430
views
Do any probabilistic hashing algorithms have additive homomorphism?
What I am looking for is a function that meets the following criteria:
For each possible input (assume integers from [0, 255]), there must be trillions of possible outputs so as to prevent preimage ...
2
votes
1
answer
76
views
Why is the function $f$ one of the inputs of the verification algorithm in homomorphic signature?
As we known, a homomorphic signature scheme consists of the usual algorithms $(\text{KeyGen} , \text{Sign} , \text{Verify})$ as well as an additional algorithm $\text{Evaluate}$ that “translates” ...
- 1,632
1
vote
0
answers
27
views
Is there a fast signature scheme homomorphic over $GF(2^b)$ with $b > 1$?
Is there a signature scheme that given $x, y \in \mathbb{Z}_p^k$ and signatures $S(x)$ and $S(y)$ allows any linear combination of $x, y$ to be successfully verified, and nothing else?
I'm aware of ...
- 4,355
0
votes
0
answers
64
views
Is it possible using homomorphic encryption (or some other technique)
Is the following possible with homomorphic encryption (or some other technique)?
Suppose the cloud server keeps a key-value list for a user with each value field encrypted (prv key with user). Now, ...
- 307
0
votes
0
answers
46
views
Homomorphic Encryption Verification
How much is it possibile to devide $E(m_1+m_2)$ by $E (m_1)$ to obtain $E (m_2)$ based on the fully Homomorphic-encryption property which says;
$$E (m_1) * E (m_2) = E (m_1 + m_2)$$. And if yes what ...
- 1
6
votes
0
answers
154
views
Is it possible to derive a homomorphic signature from homomorphic encryption
At the moment I am trying to find a practical way to implement a linearly homomorphic signature.
Background:
"In a homomorphic signature scheme, a user Alice signs some large dataset x using her ...
- 61
0
votes
0
answers
60
views
Where are labels of a Labeled data used in homomorphic message authenticator stored?
In a fully homomorphic message authenticator, Alice can authenticate
some large data $D$ using her secret key $s$k. She chooses a label $\tau$ for it, and the authentication algorithm authenticates ...
- 13
2
votes
0
answers
88
views
Possibility of applying a homomorphic MAC on vectors
The basic idea of homomorphic MACs is that a user can use a secret key to generate a set of tags $σ_1 \dots σ_n$ authenticating values $D_1 \dots D_n$ respectively. so, anyone can homomorphically ...
- 115
0
votes
1
answer
110
views
Efficient Aggregate Signatures With Same Key
Suppose Alice has a set of messages $\mathcal M$ and generates signature pairs for each message $(m_1,s_1)$, $(m_2,s_2)$, ... $(m_n,s_n)$ using the same key. She then transfers these signature pairs ...
- 1
1
vote
1
answer
156
views
Comparable or partially homomorphic public key derivation for signatures?
Are there any public key signature schemes that can be compared blindly or partially homomorphically based on the private key without knowing the private key?
Example: let's say I derive a public key ...
- 906
2
votes
2
answers
181
views
Limiting how many key pairs someone can generate without compromising their keys
Is there any way to assign someone a limited quota for how many cryptographic key pairs they can generate (ECC, RSA, any algorithm), and preferably non-interactively? By non-interactively I mean there ...
- 906
1
vote
0
answers
49
views
Is there a hash function h(M + t1) = c1 that relates to h(M + t2) = c2 in a way that can be verified without knowing M? [duplicate]
Is there a hash function h(M + t1) = c1 that relates to h(M + t2) = c2 in a way that, knowing t1, t2, c1, c2, and with no knowledge of M, it can be verified whether both use the same M?
- 53
1
vote
0
answers
48
views
A qusetion about the security game of Certificateless signatures
Recently I read Certificateless Public Auditing for Data Integrity in the Cloud , I have a question about the security of proposed HOMOMORPHIC AUTHENTICABLE CLS. （Sec. IV）. For the Type-I Adversary, ...
- 11
0
votes
0
answers
116
views
How to authenticate indivisual value after applying homomorphic encryption using Paillier homomorphic
Assuming I have three parties in a system: Alice, Bob, and a Server. Alice and Bob needs to aggregate some messages $m1$ for Alice, and $m2$ for Bob. And send the aggregate $m1+m2$ to the Server.
I ...
- 452
1
vote
1
answer
341
views
Embedding a secret private key in a homomorphic encryption system
Is there a way to create a homomorphic encryption function F such that given an input it would produce an output and also cryptographically sign the input and output? More formally, an F such that: F(...
- 11
2
votes
1
answer
285
views
Time efficiency of Bitcoin Multi-signature Vs. threshold signature
I read this paper (Securing Bitcoin wallets via a new DSA/ECDSA threshold signature scheme) that illustrated that threshold signature is the best solution to avoid single point of failure
but I think ...
- 41
10
votes
1
answer
363
views
Are there any signatures based on matrix multiplication with noise?
Are there any signatures based on matrix multiplication with noise? Representing the message as a matrix and multiplying with some randomness coming from another matrix such that the signature itself ...
- 6,250
5
votes
1
answer
965
views
Proving membership of a group without revealing identity?
I have an interesting problem for which I've failed, so far, to find an elegant solution.
Imagine that a user needs to repeatedly prove to public observers that they are a member of a trusted set ...
- 153
1
vote
0
answers
163
views
Is the half-homomorphic property of RSA a problem for blind RSA signatures?
For blind RSA signatures, is it problematic that RSA is half-homomorph?
Take a scenario where blind RSA signatures are used for something like a voting procedure or this proposal: Lots of people, ...
- 111
2
votes
0
answers
127
views
Homomorphic proxy re-signature
Alice has a value $a$ and she signs it using her secret key $d_1$ as: $s_1 = (r_1 * g^a)^{d_1} \bmod p$, and Bob has a value $b$ and he signs it using his secret key $d_2$ as: $s_2 = (r_2 * g^b)^{d_2} ...
- 1,583
-2
votes
2
answers
2k
views
What is the difference between homomorphic encryption and homomorphic signature? [closed]
I want to apply homomorphic signature instead of homomorphic encryption in Provable data possession.
So I want to know about homomorphic signature and homomorphic encryption.