DrLecter
  • Member for 8 years, 4 months
  • Last seen this week
  • Vienna, Austria
What is Attribute Based Encryption?
Accepted answer
65 votes

I try to provide a brief intro. ABE Attribute-based encryption (ABE) is a relatively recent approach that reconsiders the concept of public-key cryptography. In traditional public-key cryptography, ...

View answer
Why hash the message before signing it with RSA?
Accepted answer
34 votes

In addition to the performance problems poncho already mentioned when using RSA signatures without hashing I just want to add on the security warning of poncho: Reordering If you have a message $m>...

View answer
What is the difference between uniformly and at random in crypto definitions?
Accepted answer
28 votes

If you sample a random element, then you sample it according to some distribution. Uniformly then means that you sample from the uniform distribution, i.e., you sample it from a set where drawing ...

View answer
Advantages using Diffie-Hellman or ElGamal
22 votes

Diffie Hellman Diffie Hellman is a key exchange protocol. It is an interactive protocol with the aim that two parties can compute a common secret which can then be used to derive a secret key ...

View answer
what is the difference between proofs and arguments of knowledge?
Accepted answer
22 votes

Yes, you are right. In a proof, the soundness holds against a computationally unbounded prover and in an argument, the soundness only holds against a polynomially bounded prover. Arguments are thus ...

View answer
Proofs by reduction and times of adversaries
Accepted answer
16 votes

Reductionist security In a reductionist security proof for some cryptographic protocol $\Pi$ to some alleged hard problem $P$ means, that we can build an algorithm $\cal B$ for solving $P$ if we have ...

View answer
Relation between attack and attack model for signatures
16 votes

I hope I got your point and try to answer your question. Actually, if I understand you right, then what you call an attack actually means an adversary acting in a specific attack model. To clarify ...

View answer
Difference between Pedersen commitment and commitment based on ElGamal
Accepted answer
15 votes

The main difference is that Pedersen commitments are unconditionally hiding, as given $g^mh^r$ represents an information theoretic hiding commitment, i.e., even an unbounded adversary will not be able ...

View answer
Is pairing based cryptography ready for productive use?
Accepted answer
14 votes

Type-1 (symmetric pairings) are dead for curves over fields of small characteristic. Over prime fields of large prime characteristic they are not really dead, but as they only offer small embedding ...

View answer
What are Cryptographic Multi-linear Maps?
Accepted answer
14 votes

Ok, I will start with a cryptographic bilinear map. Cryptographic Bilinear Map A cryptographic bilinear map $e: G_1\times G_2 \rightarrow G_T$ as the name says is a map that is linear in both ...

View answer
in Bilinear pairings, what is the difference between Type 2 and Type 3?
Accepted answer
13 votes

Note that you do not have an efficiently computable homomorphism from $G_1$ to $G_2$, but in Type-2 you have an efficiently computable homomorphism $\psi: G_2 \rightarrow G_1$ and in Type-3 you do not ...

View answer
uniform vs. non-uniform PPT
Accepted answer
12 votes

Your observations are basically correct. Informally it is as follows: For a uniform PPT algorithm think of a fixed Turing machine that has access to some random tape and the output of the algorithm is ...

View answer
What is a q-type assumption?
Accepted answer
12 votes

The classic standard assumptions (such as DDH, CDH) are not parametrized and always have constant size (are static). Consequently, the assumption when used in a reductionist proof is independent of ...

View answer
How does Random Oracle and Standard Model differ?
12 votes

The random oracle model is a heuristic that assumes the existence of a truly random function to which all parties involved in a protocol, good and bad alike, have access. Since in reality no such ...

View answer
Why is DDH not hard over $\mathbb{Z}^*_p$?
Accepted answer
11 votes

If the DDH is hard in a group $G$ with generator $g$, then it is hard to decide given $(g,g^a,g^b,g^c)$ whether $ab\equiv c\pmod{ord(G)}$. If you take as $G$ the group $Z_p^*$ of order $p-1$ with $p$ ...

View answer
Certificateless cryptography
11 votes

If the KGC gets compromised it will break security, so why should a KGC generate private keys. Certificateless crypto tries to overcome the problem which exists in identity based crypto, i.e., that ...

View answer
What characters does AES output?
Accepted answer
11 votes

AES is a block cipher that operates on 128 bit blocks and for any messages (plaintexts) of other size than 128 bit one uses AES in some mode of operation, e.g., CBC considering the message as a ...

View answer
What is Perceptual Encryption?
10 votes

Perceptual encryption is a term used to describe various applications of encryption methods intended for audio, speech, image and video data. The basic idea is that one performs encryption for ...

View answer
Can a homomorphic encryption scheme be made CCA2 Secure?
Accepted answer
9 votes

The best you can get for homomorphic encryption schemes is non-adaptive chosen ciphertext security (IND-CCA1 security), see e.g. here for a quite up to date characterization. As you rightly observe ...

View answer
Chosen plaintext attack on textbook RSA decryption
8 votes

You seem to have some misconception here. Obviously, you are investigating chosen ciphertext attacks (CCAs) on textbook RSA instead of chosen plaintext attacks (CPAs). To help you with your ...

View answer
Disadvantages of one-way accumulators?
Accepted answer
8 votes

An advantage of a cryptographic accumulator and actually the reason to use them is that due to the quasi commutativity you can compute witnesses for membership of values in the accumulator where the ...

View answer
Can anyone give an example where (asymmetric) crypto can go wrong due to selection of wrong groups?
Accepted answer
8 votes

Basically, every time you choose a group where the required hard problem is not hard, then you will run into a problem. Even if we have a problem instance that is of size that is considered secure in ...

View answer
Mapping of message onto elliptic curve and reverse it?
Accepted answer
8 votes

When using ElGamal on elliptic curves you have two possibilities: Encoding free Version of El Gamal Use a version of ElGamal such as "hashed ElGamal" that avoids the task of mapping messages to ...

View answer
Which blind signature schemes exist, and how do they compare?
8 votes

Conceptually comparable to Chaums RSA blind signature scheme, is another elegant two move blind signature scheme called the blind Gap-DH signature scheme, which can be instantiated with pairing ...

View answer
What does "Inverting the RSA function is as hard as factoring" mean (a rigorous explanation or intuitive will do)?
Accepted answer
8 votes

We are dealing here with two assumptions and we always refer to $N=pq$ the product of two $n$ bit primes $p$ and $q$. The one is factoring and the second is the so called RSA assumption which is a ...

View answer
what's the advantages of identity-based systems over certificate-based ones?
8 votes

Public key crypto vs. identity-based crypto made short: In traditional public key cryptography, a user $A$ generates a private/public key pair $(sk_A,pk_A)$ and since this key pair has absolutely no ...

View answer
Explanation of the Fiat-Shamir heuristic
7 votes

The initial idea of Fiat and Shamir was to eliminate the interaction in public coin protocols (note that public coin means that the random choices of the verifier are made public) and was used to ...

View answer
Do I need to prepare plain text before encryption?
Accepted answer
7 votes

As Stephen already said in his answer, if you use a modern secure encryption scheme, then you do not have to worry about the confidentiality of the messages. However, as you say your application is a ...

View answer
How to select $g$ in Paillier Cryptosystem
Accepted answer
7 votes

The requirement is that your element $g$ is in $\mathbb{Z}_{n^2}^*$ and not in $(\mathbb{Z}_{n}^*)^2$. The set $\mathbb{Z}_{n^2}^*$ is the set of integers smaller than $n^2$ that are relatively prime ...

View answer
Why is a simple hash into $G_2$ for (certain) pairing based crypto not possible?
Accepted answer
7 votes

What the authors of the paper cited by you certainly mean by secure is "treat the hash function to $G_2$ as a random oracle". The problem is that hashing to $G_2$ can only be realized by taking some ...

View answer
1
2 3 4 5
7