7

Not sure if hash trees miss some of your requirements, but many of requirements you have could be satisfied with hash trees. Note: The scheme described below is essentially "Merkle Hash Tree-based Storage Enforcing Scheme (MHT-SE)[Golle et al. 2002]". So my question is, if we relax the requirement of being able to perform an unbounded number of ...


7

I do not know of any approaches in context of proofs or retrievability (PoRs)/provable data possession (PDP) that use homomorphic encryption. However, many of those schemes employ homomorphic (linear) authenticators/tags for the metadata such that the proofs delivered by the server can be of constant size, i.e., by aggregating single tags. Now to some ...


2

Not all elliptic curves are suitable for use with pairings - you need to choose a pairing-friendly curve. There are several families of pairing-friendly curves; one of these is the set of Barreto-Naehrig curves. They are a good place to start. For pairings that require that $G_1$ be distinct from $G_2$ (type 3 pairings, including the optimal Ate pairing), $...


1

I want to know if the below algorithm , secure against quantum computing attack No, it's not secure against Quantum Computers. To quote the text: the secret key is $sk = x \in_R \mathbb{Z}_p$ and the public key is $pk = (g, v = g^x)$. Shor's algorithm will directly recover the secret key from the public key; that runs in polynomial time.


1

Let's start from the beginning. We have symmetric encryption, an AES128 for example is said to have a security level $128$ because we need $2^{128}$ operations to recover the key (brute force). However, symmetric encryption has the vulnerability of symmetric key storage. As a solution we have asymmetric encryption; the first schemes were DH, RSA and ElGamal. ...


1

There are slim chances to "just choose proper $G_2$". There are families of specific curves such that $G_2$ will have proper number of points. Supersingular curves with $(p+1)$ points for the curve over the base prime field could be an easy example. MNT and BN curves would be better examples. "Specific instantiation" part means a few more papers to read.


1

I'd say that like with the naive variant of simply asking for the hash of the data, the server can just throw away the data and store the hashes and still answer queries. It is important for such schemes that a query requires the server to use sufficient randomness together with the data in the computation of the answers. Then precomputing the potential ...


1

What do you mean that you keep the root of the merkle tree locally? Is the merkle tree signed? If i understand what you are saying correctly, then the server can choose not to display to the public the changes you have made and keep presenting the merkle tree for the values before you updated them. Even if you sign the merkle tree the server can still do ...


1

From your question, I believe that what you are looking for is a proof of storage. I will point you in the direction of one paper, and you can use that to look for other work on the topic.


Only top voted, non community-wiki answers of a minimum length are eligible