New answers tagged

2

I've included some discussion in general, but "El Gamal" here is a red herring. Your confusion is with the difference between "division" in $\mathbb{R}$, and "division" in $\mathbb{F}_p$. I discuss this more in detail at the end. El Gamal's ciphertexts are of the form: $$\mathsf{Enc}_{g, h}(m) = (g^y, mh^y)$$ Note that $h = g^x$...


0

The answer to the GitHub issue specifically mentions what you're looking for The reason why SEAL does not support bit operations is that bit operations require a non-power-of-two polynomial ring degree which leads to much less efficient polynomial arithmetic and hurts the performance of either homomorphic evaluation or encryption or both. This states that ...


2

We are given some $b^t = s^t A + e^t$ for $A$ of the above form and short $e$, and wish to recover $s$ (which will immediately give us $e$ as well). If $e$ is short enough, then $\hat{b}^t = (s^t H) G + \hat{e}$ for some sufficiently short $\hat{e}$. (This is where we use the bound on the expansion, or top singular value, of $R$.) Therefore, the LWE inverter ...


1

From here, it says that encryption in Benaloh's scheme takes the form: $$E_r(m) = y^mu^r\bmod n$$ I'll actually write it as: $$E_r(m;u) = y^mu^r\bmod n$$ Where $m$ is the message (in $\mathbb{Z}_r$) to be encrypted, and $u\in\mathbb{Z}_n^*$ should be uniformly random. The other parameters $y, r, n$ are of course important for the scheme, but will not be ...


Top 50 recent answers are included