Skip to main content

New answers tagged

0 votes

Decryption of LWE-based Inner-Product Fuctional Encryption of Agrawal-Libert-Stehle Crypto 2016

Yes. The inner product must be non-negative, but the decryption algorithm may return a negative value. But, this can be easily fixed by returning $|\mu|$. In Regev's cryptosystem, the message is ...
Mahesh S R's user avatar
1 vote

How do I prove that a bit by bit PKE scheme (that is IND-CPA secure) for an n-bit message is not IND-CCA-2 secure?

An encryption scheme is said to be malleable if it is possible to change a valid ciphertext $c$ (i.e., a ciphertext generated by the encryption algorithm) to another valid ciphertext $c' \neq c$ (...
Mahesh S R's user avatar
1 vote

Protecting a message with two private keys

If I have understood the question correctly. Encryption: Step 1: The user(eve) with the secret generates a RSA key pair and then encrypts the secret with the public key Step 2: The user(eve) then ...
termcap's user avatar
  • 11
0 votes

Protecting a message with two private keys

You can use secret-sharing along with a PKE scheme as follows. Each custodian generates a pair of public-secret key $(pk_b, sk_b) \gets \mathsf{PKE.Setup}(1^{\lambda})$ by themselves and publish their ...
Mahesh S R's user avatar
0 votes

How do I interpret the CADO-NFS output for discrete logarithm calculation in GF(p)?

It was hard for me to make sense of the answers as I'm not very familiar with the tool, but finally this is what has worked for me: I had $q, p = 2q + 1$, both $q, p$ are primes. I needed to find $x$ ...
Denis's user avatar
  • 1
0 votes
Accepted

Question of section 1.3 Intuition for Aborting in "Fiat-Shamir With Aborts: Applications to Lattice and Factoring-Based Signatures"

Yes, $sc+y$ is insecure in the full range. This is because inverting $AZ+TC$ to find a valid $Z$ is trivial using standard linear algerbra tools such as Gaussian elimination. However, it's very ...
DannyNiu's user avatar
  • 9,490
1 vote
Accepted

Forgeable and unconfidential short-term signature

I see a problem with the wording of this requirement: Private key safety (needed): It should be practically impossible to derive the private key from many plaintext & signature pairs. That's not ...
fgrieu's user avatar
  • 142k

Top 50 recent answers are included