1:03 PM
0

The other answer does not detail how to make the result in \$\mathbb Z_q^*\$, and that was unclear to the OP. Since \$q\$ is prime, \$\mathbb Z_q^*\$ is the integers in the interval \$[1,q)\$. In the paper's example, \$q\$ is a 192-bit integer¹. We can use a much larger hash function such as SHA‑512 (or ev...

You mean (result mod (q-1))+1?

@Chai Ma: yes, see updated answer.

Thank you.. Can I ask you another question kinda off topic of the posted question?

@ChaiMa Please do, in this chatroom (add @fgrieu in the text so that I get pinged).

@fgrieu Thanks, in the article TA chooses a symmetric encryption function but they didn't mention which symmetric function is used, can you suggest me a secure symmetric function to work with ?

1:17 PM
@ChaiMa The symmetric scheme is not used later in the paper (at least, all uses of capital E are for the Elliptic Curve, and there's no other use of the sybol π), thus it's impossible to guess the requirement of the scheme. To me it looks like yet another telltale sign that the paper should not be trusted.
I'm really curious to know how you have come to study this paper, and why this and similar paper get written and published (which if I get it correctly costs real money).

1:36 PM
@fgrieu I see, unfortunately I have no other choice but to study this paper. I will appreciate it if you suggest me a symmetric scheme that fits into this solution

@ChaiMa You can't get wrong with AES-CTR if you need only confidentiality and have a good randomness source for the IV. You can't get wrong in general with AES-GCM if you have a good randomness source for the IV. You nearly can't get wrong with AES-GCM-SIV.
It's really sad that you are in a situation to have to study this parody of a scientific paper. Try to escape from that education system.