The Stack Overflow podcast is back! Listen to an interview with our new CEO.

New answers tagged


Actually, a well known result is that, for any cryptosystem that relies on the hardness of the DLog problem (including ECDlog), there is no such reduction in strength if you have $k$ keys. That is, the problem of "here are $k$ keys, break any one" is essentially as hard as the problem "here is one key, break it". The proof is straight-forward; first off, ...


TLDR: The scheme is symmetric only, its "provable security" argument is flawed, and it is practically insecure when even a modest amount of plaintext is available to attackers. I'm commenting on the scheme in: Josep Domingo-Ferrer, A Provably Secure Additive and Multiplicative Privacy Homomorphism, published in proceedings of ISC 2002. I ignore the 1996 ...

Top 50 recent answers are included