cryptobiu/scapi — pull request #43 by meilof (2014-11-25 15:46:17+00:00)
Title: Damgard-Jurik: fixed length and \Sigma-protocols

I have implemented two functional additions to Scapi's Damg{\aa}-rd-Jurik encryption.

First, I propose a way for the user to fix the length parameter "s" (I discussed this with Moriya via e-mail some time ago). Having a fixed length parameter is useful for several reasons:

- the length of the encryption leaks information about the plaintext (namely, that N^l<=m<=N^{l+1}), setting all encryptions to the maximum possible plaintext length fixes this
- a fixed length parameter is required for the threshold variant from Jurik's PhD thesis

In my implementation, the length parameter can be set by calling enc.setLengthParameter, and checks are added to ensure that plaintexts conform to it.

Second, I have implemented two Sigma-protocols for Damg{\aa}rd-Jurik encryption:

- a proof of correct multiplication damgardJurikProduct2 for which it is not needed to know the plaintext of one of the encryptions, due to Cramer, Damg{\aa}rd and Nielsen (Eurocrypt'01): this is necessary for their protocol for multiparty computation
- a proof of equality of discrete logarithms dhExtendedStatistical in the RSA setting, due to Jurik (his 2003 PhD thesis, p.23): in this case, the modulus for the exponent is unknown by the RSA assumption, so one has to do stastistical security instead of modulo reduction

The implementation of the first one is analogous to the existing damgardJurikProduct proof; the implementation of the second one is analogous to the existing dhExtended proof.