New answers tagged


While this is not a total answer (it does not discuss polynomial arithmetic), the Big Integer Design section of the BearSSL page seems like a good resource to share on this problem. Many of the algorithms are roughly similar to those in chapter 14 of Handbook of Applied Cryptography, but care has been made to make them constant time (not all of the ...


I am the author of the paper. It is a stupid typo. $z_b$ should be $r_b$. I have corrected the error in my own copy but I can not correct the copy that is out there officially. Apologies. My bad!


Long to write as a comment; Look at the referenced paper 47 The user chooses uniformly at random $t$ numbers $y_1,\ldots,y_t \in Z_n^{+}$ such that $y_b$ is a $\text{QNR}$ and $y_j$ , for $j \neq b$, is a $\text{QR}$. It sends these $t$ numbers to DB (total of $t \cdot k$ bits). The database, DB, computes for every row $r$ a number $z_r \in Z_N^*$ as ...

Top 50 recent answers are included