# Tag Info

Accepted

### Intuitive explanation of the $\varepsilon$ parameter in differential privacy

A colleague gave me the following explanation that I think makes a lot of intuitive sense, so I'm reproducing it here. Skip to the last paragraph it you don't care about the proof. Suppose you're ...
Accepted

### Is there a hash tree scheme designed for complex data structures?

The general technique for tree hashing (independently of the issue of partially revealing content) is to define the hash of nodes as the hash of the concatenation of the hash of their leaves, with a ...

### Integrity with anti-confidentiality

Sending information covertly when using legitimate systems is a well-studied field. As another question mentions, key words are covert channel and subliminal channel. Designing systems with no covert ...
Accepted

### Difference between ε-differential privacy and (ε, δ)-differential privacy

The $\delta$ item is a relaxation of the $\epsilon$-differential privacy notion. The latter is a strong security notion because it requires an algorithm $\mathcal{A}$ to have very close output ...

### Integrity with anti-confidentiality

RSA with PKCS#1 v1.5 padding for signature genernation would work, as the algorithm is fully deterministic. The random padding is only used for RSA with PKCS#1 v1.5 padding for encryption which is ...
Accepted

### Applying machine learning algorithms to homomorphic encrypted data

Homomorphic Encryption on Reals In theory, homomorphic encryption can be done on real numbers. This answer describes two options you have when dealing with real numbers or operations that will result ...
Accepted

### Differential Privacy: why $\delta$ negligible on the row numbers?

$\varepsilon$-differential privacy is absolute: for any pair of databases, you cannot gain more than a small amount of probabilistic information about a single individual. When you add or remove an ...

### Ensuring integrity and confidentiality together with symmetric encryption

Do not invent your own authenticated encryption mode. Use a standardized one, and use a well-supported library to implement it in your code. AES-GCM, AES-CCM, AES-OCB, and AES-CBC with HMAC-SHA256 ...

### On the privacy of perfect hash functions

The definition of perfect hash functions do not have any security/cryptographic requirements. For example, the hash function that simply outputs the first n bits of any string is a perfect hash ...

### Secure multiparty computation of conjunction

They could use 1 out of 2 oblivious transfer. Alice offers the messages $0$ and $a$ and Bob uses $b$ as his choice bit (I.e., choosing the first message if $b = 0$ and the second if $b = 1$.). It ...
Accepted

### Why the definition in $\epsilon$-differential privacy is multiplicative rather than additive？

In short, with this multiplicative definition, it could be ruled out the possibility that an individual's record would be randomly selected and published. Consider a malicious algorithm $M^*$ that ...
Accepted

### Disk/File modes of encryption and authentication

Beside XTS and CBC-ESSIV, are there any other modes of encryption that are commonly used? No. Just look at software like Veracrypt (XTS only) or dmcrypt. There was a third notable scheme for ...

### Hiding identifying data while allowing matching?

Any transformation of the identifier, including those in the question, is bound to have at least one drawback: after a transformation of cryptographic quality, it will be next to impossible to re-...
Accepted

### Is zero IV with AES-CBC safe if CPA is not possible and indistinguishability is not an issue?

Furthermore, is using AES-CBC this way any safer than using AES-ECB? Yes, using CBC mode is (almost?) always safer than using ECB mode. Is using zero IVs with AES-CBC safe[...]? No it is not safe, ...

### Data Security and Encryption

What is the "unknown attack" the reviewer is referring to? The reviewer did not say "the unknown attack", but "in front of unknown attacks". That refers to no attack in ...
Accepted

### Prove that $x$ is the sum of digitally signed numbers without revealing the summands

As Mark has said, it's, in theory, a solvable problem (we know how to do it; the known methods are not simple). However, by tweaking things around a bit, we can make this problem easy. My solution is ...
Accepted

### How do we select values for parameters when using Differential Privacy?

In the 2019 paper Differential Privacy in Practice: Expose Your Epsilons!, the authors Dwork, Kohli, Mulligan summarize the state of affairs thusly: We found no clear consensus on how to choose ε, ...

### If the symmetric key is stolen; can I key revoke without reencrypted data?

If one's key is correctly used to encrypt data, and the key is stolen (that is all physical media containing it are stolen and thus become unavailable; as in "my last bike lock key got stolen&...

Accepted

### Lemma KL-Divergence (Differential Privacy)

I don't understand why: $$\sum_{y\in T}(\Pr[Z=y]-\Pr[Y=y]) = \sum _{y \notin T}(\Pr[Y=y]-\Pr[Z=y])$$ Well the domain is partitioned into $T$ and its complement. So the sum over the full domain of the ...
Accepted

### Differential privacy noise that scales with $L_p$-sensitivity with $p>2$?

You can measure your sensitivity in an arbitrary norm. The exponential mechanism, that samples from the distribution proportional to $\exp(-\epsilon |z-f(x)|_p / 2)$ will give pure DP. This is more ...

### Public-key/asymmetric encryption where you can only leak the decrypted message by leaking your password

Your idea of an encryption method including a nonce, and in a way that Alice cannot recover the nonce is practical; however it doesn't solve your problem. One possibility would be a variant of El ...