New answers tagged

2

You cannot modify $\mathcal A$ in this way. If you need $\alpha$ and $\beta$ for the reduction, then you will need to use a zero-knowledge proof of knowledge from which you can extract them. I understand that you want to use a NIZK. However, this actually isn't a problem. If you take a Sigma-protocol (3-round proof) for Pedersen commitments (which is ...


4

This relates how I dealt with this issue in 1999. I had found an attack on the ISO/IEC 9796(-1) signature scheme. It was closer to practical than another line of effort¹ to break that scheme. The signature scheme was used by indirect business partners of my employer. It was thus a professional necessity not to make an hostile disclosure. I got internal ...


Top 50 recent answers are included