A Concrete NIDV EDL Proof System Sample Clauses

A Concrete NIDV EDL Proof System. The NIDV proof we present is a modification of the scheme of Xxxxxxxxx et al. [70]. The modification repairs a flaw in the original proof, which was discovered by Xxxx [112]. q Since our NIDV EDL proof will be used with the above undeniable signature scheme, the Setup algorithm will be identical to that in Section 4.6.1 except that in addition we require another cryptographic hash function H2 : {0, 1}∗ → Zq, and we define the spaces E = M × S and P = Z4. KeyGen will be exactly as in Section 4.6.1. The family of languages will be defined by the USign algorithm of the concrete scheme as described above in Section 4.6.2. We still need to define the PGen and PVerify algorithms. NIDV EDL PGen(XP , XV , xP , m, σ): On input XP , XV ∈ PK, XV ƒ= XP , xP ∈ SK, m ∈ M and σ ∈ S, the algorithm picks random w, r, t ∈ Zq and computes: V c = gwXr mod p G = gt mod p D = H1(m)t mod p h = H2(c, G, D, m, σ, XP , XV ) d = t − xP (h + w) mod q The algorithm outputs π = (w, r, h, d). NIDV EDL PVerify(XP , XV , m, σ, π): On input XP , XV ∈ PK, XV ƒ= XP , message m ∈ M, signature σ ∈ S, and proof π = (w, r, h, d) ∈ P, the algorithm computes: V c = gwXr mod p P G = gdX(h+w) mod p D = H1(m)dσ(h+w) mod p and verifies that h = H2(c, G, D, m, σ, XP , XV ). If the last equation holds, then the algorithm outputs accept, otherwise it outputs reject. Comparison to the scheme of Xxxxxxxxx et al. The main difference is that we include the values σ, XP and XV in the input of H2. Our proof π also has one less element than the NIDV EDL proof of [70].