People who code: we want your input. Take the Survey
6

This answer is assuming you are not removing the private key $a$ from the computation of $S$, and instead actually meant what is said in the title of the question: $S = r + a H(A, M)$ Removing $a$ from the computation would be terrible. The first issue that comes to mind is malleability, on top of collision resistance. The signature process for EdDSA ...


5

would using S = r + H(A, M) be a secure variant? Actually, it would become trivial to generate a signature for an abitrary message with just the public key. The verification check would be: $$2^h s G = 2^h R + 2^h H(A, M) A$$ where $h$ is the curve cofactor, $G$ is the curve generator, $A$ is the public key, $M$ is the message and $(R, s)$ is the signature. ...


3

Using the S-box package of SageMath used S = SBox(1, 10, 4, 12, 6, 15, 3, 9, 2, 13, 11, 7, 5, 0, 8, 14); f0 = S.component_function(1) f1 = S.component_function(2) f2 = S.component_function(4) f3 = S.component_function(8) print ( "y0 = ", f0.algebraic_normal_form()) print ( "y1 = ", f1.algebraic_normal_form()) print ( "y2 = ", ...


3

It seems that the question you're asking is about how to add a public (unmasked?) value to a secret-shared value. I suggest you edit the question a bit to clarify that this is not related to AES directly. With that aside, adding a public value to a secret-shared value depends heavily on what secret-sharing scheme you're using, and also the algebraic ...


1

Normally, coin tosses are random variables $r$ drawn (usually uniformly unless otherwise specified) from a finite set $R.$ In this case however $R=g^{k^{-1}}$ where $r=H’(R)$ and $H’$ is a hash function from a cyclic group of prime order into $Z_q$ and $k$ is a uniformly distributed random variable from $Z_q.$ So $R$ is a random variable which is a function ...


1

There are $p^k$ possible polynomials and $p^k$ possible tuples of shares, each of which uniquely determines a polynomial, so the distribution of share values is a permutation of the distribution of polynomials. If you know nothing about $s$, i.e. you model it as uniformly distributed like the $t_i$, then all polynomials are equiprobable and therefore so are ...


1

In general this is not possible. Assuming a finite group, for any $A$ in the group and for any $x$ in the group, the pair $(x,A-x)$ is a possible solution. You cannot do any better. If you have some side information which enables you test a value $x$ for being valid, you would at worst still need to test every $x$ in the group. This property follows from the ...


1

I am not too familiar with this paper, but there is (at least) the following reason. They define $\Delta = l!$, then require (right after equation 6) that $1 = \mathsf{gcd}(e', e) = \mathsf{gcd}(4\Delta^2, e) = \mathsf{gcd}(4(l!)^2, e)$. This is not possible if $e \leq l$ (as then the GCD is $e\neq 1$).


1

Here are two implementations, I haven't used any of them though. https://github.com/baonq-me/bgn https://github.com/nasimmaleki/Cryptography


Only top voted, non community-wiki answers of a minimum length are eligible