Talk:Cramer–Shoup cryptosystem

{{WikiProject banner shell|class=Start|

{{WikiProject Cryptography|importance=High}}

}}

The following is incorrect. Elgamal is also a probabilistic cryptosystem. The advantage of Cramer-Shoup is the verification stage in the decryption algorithm:

:In contrast to ElGamal, which is extremely malleable, Cramer-Shoup introduces a random element into the encryption process, such that a given plaintext will produce different ciphertexts on subsequent runs of the system. The consequence is that, unlike ElGamal and RSA (without padding), Cramer-Shoup is not susceptible to chosen ciphertext attack.

Anyone know the licensing information? This would probably be good to include.--Wpegden 07:07, 16 July 2006 (UTC)

H(u1, u2, e)

Every cryptographic hash function that I know of takes one argument. How does one pass three arguments? 141.149.207.158 04:17, 27 August 2006 (UTC)

:It makes a hash of the combination. I guess you could say H(u1 || u2 || e) would do the trick. 129.241.211.76 (talk)

Collision resistance vs. UOWHF

Hmm, I have just taken a look at the original paper, and I found out that the property required from the hash function is not exactly collision resistance, but being drawn from a Universal One-Way Hash Function family, which is more like second preimage resistance (it is easier to achieve than collision resistance)... charles bouillaguet