CS 259C/Math 250: Elliptic Curves in Cryptography Homework 3 Solutions

Thus, both decryption algorithms correctly recover M (b) Suppose there is an adversary A with advantage at least in the real-or-random game. Then we can construct the following algorithm B which solves the BDDH problem: * On input (P,Q,R, S, γ), send (P,Q,R) to A, where Q is interpreted as QA and R is interpreted as QB. * When A send the challenge plaintext M , respond with (S,Mγ) as the challenge ciphertext. * Output the output of A Since Q = QA = [a]P and R = QB = [b]P for random a, b, the public parameters seen by A are distributed as they would be in the real-or-random game. If γ = ê(P, P ) where S = [c]P , then the challenge ciphertext (S,Mγ) = ([c]P,Mγ) is a correctly distributed encryption of M since c is random. Hence,