Proving in Zero-Knowledge that a Number is the Product of Two Safe Primes

Camenisch, Jan; Michels, Markus

doi:10.7146/brics.v5i29.19435

Cited by 101 publications

(160 citation statements)

References 28 publications

Supporting

Mentioning

159

Contrasting

Order By: Relevance

“…First, we need to ensure that the server's public key was generated correctly (to ensure that the homomorphic operations truly hide each parties' individual input). This can be carried out efficiently and non-interactively using [3]. Next, we need to make sure that each party updates c * j correctly.…”

Section: A Protocol For the Sum Functionmentioning

confidence: 99%

See 1 more Smart Citation

Secure Computation on the Web: Computing without Simultaneous Interaction

Halevi¹,

Lindell

Pinkas

2011

Lecture Notes in Computer Science

118

109

View full text Add to dashboard Cite

Secure computation enables mutually suspicious parties to compute a joint function of their private inputs while providing strong security guarantees. Amongst other things, even if some of the participants are corrupted the output is still correctly computed, and parties do not learn anything about each other's inputs except for that output. Despite the power and generality of secure computation, its use in practice seems limited. We argue that one of the reasons for this is that the model of computation on the web is not suited to the type of communication patterns needed for secure computation. Specifically, in most web scenarios clients independently connect to servers, interact with them and then leave. This rules out the use of secure computation protocols that require that all participants interact simultaneously.In this paper, we initiate the study of secure computation in a client-server model where each client connects to the server once and interacts with it, without any other client necessarily being connected at the same time. We point out some inherent limitations in this model and present definitions that capture what can be done. We also present a general feasibility result and several truly practical protocols for a number of functions of interest. All our protocols are based on standard assumptions, and we achieve security both in the semi-honest and malicious adversary models.

show abstract

Section: A Protocol For the Sum Functionmentioning

confidence: 99%

“…, r n+1 ). 3 We define: Definition 4.1. A public-key scheme (G, E, D) is layer rerandomizable if there exists a procedure R such that for every x ∈ {0, 1} * and every r ∈ ({0, 1} * ) n , pk ,Ē pk (x; r),Ē pk (x; r ) ≡ pk,Ē pk (x; r), R( pk,Ē pk (x; r))…”

Section: The Semi-honest Casementioning

confidence: 99%

Secure Computation on the Web: Computing without Simultaneous Interaction

Halevi¹,

Lindell

Pinkas

2011

Lecture Notes in Computer Science

118

109

View full text Add to dashboard Cite

show abstract

“…For both schemes, the signer must first prove to the CA that its modulus N is the product of two safe primes. A zero-knowledge protocol for this was proposed by Camenish and Michels [CM99]. Though expensive, this protocol must be run only once at key registration time.…”

Section: Theorem 4 When Instantiated With a Static Tddh Group With Pmentioning

confidence: 99%

New Constructions and Applications of Trapdoor DDH Groups

Seurin

2013

Public-Key Cryptography – PKC 2013

View full text Add to dashboard Cite

Abstract. Trapdoor Decisional Diffie-Hellman (TDDH) groups, introduced by Dent and Galbraith (ANTS 2006), are groups where the DDH problem is hard, unless one is in possession of a secret trapdoor which enables solving it efficiently. Despite their intuitively appealing properties, they have found up to now very few cryptographic applications. Moreover, among the two constructions of such groups proposed by Dent and Galbraith, only a single one based on hidden pairings remains unbroken. In this paper, we extend the set of trapdoor DDH groups by giving a construction based on composite residuosity. We also introduce a more restrictive variant of these groups that we name static trapdoor DDH groups, where the trapdoor only enables to solve the DDH problem with respect to a fixed pair (G, G x ) of group elements. We give two constructions for such groups whose security relies respectively on the RSA and the factoring assumptions. Then, we show that static trapdoor DDH groups yield elementary constructions of convertible undeniable signature schemes allowing delegatable verification. Using our constructions of static trapdoor DDH groups from the RSA or the factoring assumption, we obtain slightly simpler variants of the undeniable signature schemes of respectively Gennaro, Rabin, and Krawczyk (J. Cryptology, 2000) and Galbraith and Mao (CT-RSA 2003). These new schemes are conceptually more satisfying since they can strictly be viewed as instantiations, in an adequate group, of the original undeniable signature scheme of Chaum and van Antwerpen (CRYPTO '89).

show abstract

“…It is assumed that the user provides a proof of n being a product of safe primes (see [8]). The signature CERT T :U is a publicly known certificate and, in a real-world implementation, will contain relevant information including protocol headers, timestamp, transaction ID, and certificate lifetime.…”

Section: Our Setting and Verifiable Encryption Of Rsa Signaturesmentioning

confidence: 99%

Stateless-Recipient Certified E-Mail System Based on Verifiable Encryption

Ateniese

Nita-Rotaru

2002

Topics in Cryptology — CT-RSA 2002

View full text Add to dashboard Cite

Abstract. In this paper we present a certified e-mail system which provides fairness while making use of a T T P only in exceptional circumstances. Our system guarantees that the recipient gets the content of the e-mail if and only if the sender receives an incontestable proof-of-receipt. Our protocol involves two communicating parties, a sender and a recipient, but only the recipient is allowed to misbehave. Therefore, in case of dispute, the sender solicits T T P 's arbitration without involving the recipient. This feature makes our protocols very attractive in real-world environments in which recipients would prefer to assume a passive role rather than being actively involved in dispute resolutions caused by malicious senders. In addition, in our protocol, the recipient can be stateless, i.e., it does not need to keep state to ensure fairness.

show abstract

Proving in Zero-Knowledge that a Number is the Product of Two Safe Primes

Cited by 101 publications

References 28 publications

Secure Computation on the Web: Computing without Simultaneous Interaction

Secure Computation on the Web: Computing without Simultaneous Interaction

New Constructions and Applications of Trapdoor DDH Groups

Stateless-Recipient Certified E-Mail System Based on Verifiable Encryption

Contact Info

Product

Resources

About