# Tag Info

4

If you can generate uniform random numbers, you can use a variant of Fisher-Yates. //given an array s with the elements to be permuted for i from n-1 to 1: t = rand(0, i) # inclusive swap(s[i], s[t])

3

Yes, but it's different and not as cost-efficient. The discrete log variant of the number field sieve goes (very loosely) like this: Collect logarithms of many small primes using sieving and linear algebra (the precomputation stage) Represent the target field element as a product of small primes and use the small logarithms to recover it (the individual ...

2

Essentially, instead of checking against a (salted) hash of a password, you suggest using the hash (since you can choose hashing = keygen) as a key to encrypt a kind of test value. The main question is whether this adds or reduces security. If you store the hash/key directly, the chance of a randomly chosen password hashing to the same value is $2^{-n}$, ...

2

I see no reason to expect your construction to be cryptographically secure. A single MWC generator is not something that was ever designed to be cryptographically secure. A cryptographically-strong PRNG needs to be designed in a very different way from a non-crypto PRNG. In particular, it sounds like MWC was designed to have a long period. But having a ...

2

Sure you can do. There are many lattice attacks, using your second assumption, to ECDSA (which also applied to DSA). For instance see Smart and Howgrave-Graham and Shparlinski and Nguyen. All the lattice attacks base on finding small solutions (for the ephemeral key $k$ and the private key $a$) to the signing equation $sk-ra\equiv H(m)\pmod q.$ If you have ...

1

You can do this slightly better with an additional $\mathcal{0}(2^{56})$ memory and with $\mathcal{0}(2^{56})$ time. You can notice that the relation $c \leftarrow E_{k_1}(E_{k_2}(m))$ can be rewritten as $D_{k_1}(c) = E_{k_2}(m)$ (just apply the decrypt function on both sides. First step consists in the generation of every pair $(k_2, E_{k_2}(m))$ and ...

Only top voted, non community-wiki answers of a minimum length are eligible