Citation Context

...huffles. Subsequent papers on mix-nets [6, 48, 28, 22, 31, 15, 29, 42, 30, 46, 48, 52] have tried in many ways to guarantee correctness of a shuffle, most of which have been partially or fully broken =-=[3, 39, 53, 49]-=-. Remaining are suggestions [15, 48, 28, 52], of which the first three have various drawbacks. Desmedt and Kurosawa [15] require that at most a small fraction of the mix-servers is corrupt. Peng et al...

Citation Context

...g [24,25,26] focusing on efficiency. Furukawa and Sako [15], and Neff [33] respectively have recently found efficient proofs of a correct shuffle, but these proposals have incomplete or flawed analysis. Groth [23] builds on Neff’s ideas to form an abstract protocol for any homomorphic cryptosystem. Desmedt and Kurosawa [10] describe an attack on a protocol by Jakobsson [24]. Similarly Mitomo and Kurosawa [32] exhibit a weakness in another protocol by Jakobsson [25]. Pfitzmann has given some general attacks on mix-nets [40,39], and Michels and Horster give additional attacks in [31]. Wikstrom [46] gives several attacks for a protocol by Golle et al. [22]. He also gives attacks for the protocols by Jakobsson [25] and Jakobsson and Juels [27]. Abe [2] has independently found related attacks. Canetti [6] and independently Pfitzmann and Waidner [41], proposed security frameworks for reactive processes. We use the former framework. Both frameworks has composition theorems, and are based on older definitional work. The initial ideal-model based definitional approach for secure function evaluation is informally proposed by Goldreich, Micali, and Wigderson in [18]. The first formalizations app...

Citation Context

...orks is for mix servers to prove the shuffle. There have been some attempts to improve efficiency. Some repetitive robust mixnets are interesting, e.g. [31, 32, 27], but most of them have been broken =-=[19, 39, 1, 55]-=-. We advocate choosing one from [25, 41, 28] 2 . Schemes based on homomorphic encryption were first introduced by Benaloh [15, 10, 7]. To cast a vote, each voter generates an encrypted value of her de...

Citation Context

...nd Sako [7]. 1Many other works in the field aim to improve the efficiency of mix-nets, e.g., [11, 10, 8, 12, 13], but vulnerabilities have been found in most mix-nets not based on proofs of shuffles =-=[18, 15, 4, 22, 14]-=-. Puiggalí and Guasch [20] proposed a heuristically secure mix-net at EVOTE 2010 (called the Scytl mix-net in the rest of the paper) which combines ideas of Golle et al. [8] and Jakobsson et al. [13]....

Citation Context

...suggested a fix; this in turn, in addition to the schemes of Jakobsson and Juels [11], of Golle, Zong, Boneh, Jakobsson and Juels [7] were all shown to be vulnerable (to various attacks) by Wikström =-=[23]-=-. While a formal proof of security is not an iron-clad guarantee that no vulnerabilities will ever be found (proofs may have subtle errors, and assumptions may be shown to be wrong), they do significa...

Citation Context

...often be broken, and this seems to be particularly true for mix-nets. Historically the proposals of heuristically secure mix-nets [20, 11, 12, 14, 9] have been followed by discovery of security flaws =-=[22, 21, 5, 17, 24]-=-. A formal proof of security does not guarantee that no attack will ever be found (proofs can have subtle errors, assumptions can be wrong, and the adversarial model can be unrealistic), but it increa...