New answers tagged

2

Everything you write looks correct. However, you may be expecting the distributed decryption protocol to have a security property that it does not (and was not intended to, and really cannot in your example) have. Specifically, the Mukherjee-Wichs paper you linked defines security to say (roughly) that, given the evaluated ciphertext, its underlying ...


1

TL;DR: as pointed by DrLecter in comment¹, the question's formula is for exponential ElGamal encryption, with per-encryption random $r$ explicit. I'll first describe (straight) ElGamal encryption. It works in an arbitrary finite cyclic group of generator $g$ and order $q$ (with the internal law noted multiplicatively). That is, $q$ is the smallest strictly ...


1

I guess the latest real production grade homomorphic library is Microsoft SEAL, which implements the BFV and the CKKS encryption schemes. I'm not a big MS fan. There are other options to explore: HELib implements the BGV scheme with GHS optimizations. NuFHE implements a GPU reference of fully homomorphic encryption on torus Also checkout the open group ...


2

As hinted by @kelalaka in the comments, note that $q$ is odd, and $\gcd(2,q)=1.$ Therefore within $Z_q$ we have that $2e\neq 0,$ if and only if $e \neq 0,$ so the noise is never masked.


0

A simple way to achieve this is with asymmetric cryptography, by letting both Alice and then Bob broadcast a message to the network with the shared private key. This message should be a digital signature, proving that both Alice and Bob have knowledge of that private key.


0

Its depend on the protocol used. The last and more efficient is Groth16 that use only 3 curve points in its proofs. You can see the size of the keys and the the proofs in the table 2 of Groth's paper. The computation complexity of the pairing depends of whats curve is used. In general ZoKrates/Ethereum and ZCash use the bn256 curve paramters and the pairing ...


Top 50 recent answers are included