Tag Info

New answers tagged

0

Your options are: Use secp192r1 and truncate the hash. Then you have 96-bit security. Use secp256r1 and full SHA-256. Then you have 128-bit security. Both elliptic curves and hashes usually* need to be twice the "effective security" bitlength. Even 96-bit security is most likely enough at the moment, but some estimates put it within reach in e.g. a few ...


1

NIST FIPS 186-4 at the end of section 6.4 states that: When the length of the output of the hash function is greater than the bit length of $n$, then the leftmost $n$ bits of the hash function output block shall be used in any calculation using the hash function output during the generation or verification of a digital signature. In section 6.1 ...



Top 50 recent answers are included