i read in paper public key encryption with keyword search that PEKS algorithm used tuple what mean by using c coin .
Just a brief explanation.
In the proof B needs to do 3 things:
In the query phase, hi is constructed in two ways: either u2*g^{a_i} or g^{a_i}. This is necessary in order to be able to both answer trapdoor queries and incorporate the BDH tuple in the challenge reply.
If hi is constructed in the first way then B can use it in the challenge reply but cannot use this entry to answer trapdoor queries (hence you see an abortion in the trapdoor query phase); if hi is constructed in the second way then B can answer trapdoor queries but this hi contains no information about the BDH tuple hence cannot be used in the challenge reply (in challenge phase there is another abortion).
The problem then is how to maintain the abortion probability to an acceptable level. The coins actually provide a mechanism to bound the abortion probability. ci is generated according to a distribution. If ci=0 then hi is generated in the first way and if ci=1 then hi is generated in the second way. This ensures that H1-list contains a proper mixture of both types of hi so there is a high probability that the game won't abort prematurely.
As the authors proved in claim 1 and 2, the probabilities of not aborting are sufficiently high if the coins are generated with Pr[ci = 0] = 1/(qT + 1).
thanks alot this very helpful to me but why if c=0 not used to reply trapdoor and how come that pr[ci=0]=1/qt+1
- Badges
- Science topic
- Similar topics
- Correction