A sender verifiable mix-net and a new proof of a shuffle
D Wikström - International Conference on the Theory and …, 2005 - Springer
International Conference on the Theory and Application of Cryptology and …, 2005•Springer
We introduce the first El Gamal based mix-net in which each mix-server partially decrypts
and permutes its input, ie, no re-encryption is necessary. An interesting property of the
construction is that a sender can verify non-interactively that its message is processed
correctly. We call this sender verifiability. The mix-net is provably UC-secure against static
adversaries corrupting any minority of the mix-servers. The result holds under the decision
Diffie-Hellman assumption, and assuming an ideal bulletin board and an ideal zero …
and permutes its input, ie, no re-encryption is necessary. An interesting property of the
construction is that a sender can verify non-interactively that its message is processed
correctly. We call this sender verifiability. The mix-net is provably UC-secure against static
adversaries corrupting any minority of the mix-servers. The result holds under the decision
Diffie-Hellman assumption, and assuming an ideal bulletin board and an ideal zero …
Abstract
We introduce the first El Gamal based mix-net in which each mix-server partially decrypts and permutes its input, i.e., no re-encryption is necessary. An interesting property of the construction is that a sender can verify non-interactively that its message is processed correctly. We call this sender verifiability.
The mix-net is provably UC-secure against static adversaries corrupting any minority of the mix-servers. The result holds under the decision Diffie-Hellman assumption, and assuming an ideal bulletin board and an ideal zero-knowledge proof of knowledge of a correct shuffle.
Then we construct the first proof of a decryption-permutation shuffle, and show how this can be transformed into a zero-knowledge proof of knowledge in the UC-framework. The protocol is sound under the strong RSA-assumption and the discrete logarithm assumption.
Our proof of a shuffle is not a variation of existing methods. It is based on a novel idea of independent interest, and we argue that it is at least as efficient as previous constructions.
Springer
以上显示的是最相近的搜索结果。 查看全部搜索结果