Hot answers tagged

6

In the context of the papers you reference, Generalized Mersenne prime numbers and Pseudo-Mersenne prime numbers are indeed two different things. A Pseudo-Mersenne prime number has the form $2^{\alpha}-\gamma$ for a small integer $\gamma \gt 0$. The term Generalized Mersenne prime number is defined by example in the referenced paper, and the examples given ...


4

You can do something like what you are suggesting. But, the EC_Dual_DBRG also has biases in the stream and so you cannot use it without changes (e.g., truncating much more). However, this is based on the same operations as ElGamal. The public key is set up exactly as proposed. Then, to encrypt a message $m$ of any length, do: Choose a random ...


3

The problem is that, imagine you sign a message $m$ using ECDSA and SHA-1 as hash algorithm. If an attacker manages to find a message $m'$ such as SHA-1$(m)$ = SHA-1$(m')$ then the computed signature for $m$ will be valid for $m'$. So the attacker can substitute $m$ for $m'$ while keeping the same signature value. The receiver who will try to validate the ...


3

As yyyyyyy mentioned for counting number of points on elliptic curve over $\mathbb F_p$ we can use Elkies method. But for extension of fields use of this theorem make it so easy: Theorem : Let $E$ be an elliptic curve defined over $F_q$, and let $\#E(F_q ) = q +1−t$. Then $\#E(F_{q^n} ) = q^n + 1 − V_n$ for all $n ≥ 2$, where $\{V_n\}$ is the sequence ...


3

This is a rather open ended question, but I'll try to answer: Limitations: most ECDSA implementations require a secure random generator - if the same random value is reused (for different plaintext) then the private key parameter can simply be calculated; ECDSA requires a hash function and cannot be (easily?) used for signatures with message recovery ...


1

I think that I've found a good solution to your problem. In short terms it consists in generating an ECDSA signature using the point $R$ as generator, $s$ as private key and the result of $s*R$ as public key. So the $r$ part of the signature would be revealed but the $s$ part is still kept secret. The usual ECDSA signature generation consists in proving ...



Only top voted, non community-wiki answers of a minimum length are eligible