# Tag Info

14

The answer is about the difficulty of discrete logarithm. The notion of isomorphism does not capture all that matters in cryptography; we also need to consider computing costs. Suppose that we have an abelian group $\mathbb{G}$ with additive notation. Let $G$ be a conventional element of $\mathbb{G}$ of order $n$. The subgroup generated by $G$ is: $$\langle ... 6 First off, your equation is correct and there seems to be no calculation mistake. To understand on how to get from$$(2+d)x^{2}+dy^{2}=d+(d-2)x^{2}y^{2}$$to$$x^{2}+y^{2}=1+e\cdot x^{2}y^{2}$$one first needs to observe that e=(d-2)/(d+2)=121665/121666 holds. The next step is to consider: "What operations are actually allowed with birational ... 5 Bits of entropy The assumption for all cryptographic operations is that a random key of n bits has n bits of entropy. If it doesn't (due to PRNG defect or implementation error) then the key will be weaker than expected but the underlying assumption of all cryptographic primitives is that an n bit key has n bits of entropy. This is the same for all types ... 4 DSA relies on k being independent from d. You define k as: k=z^\prime d\mod n Substituting k in the signing equation you get: s = k^{-1} (z+rd) \mod n s z^\prime d = z + rd \mod n d=z (sz^\prime -r)^{-1} \mod n The attacker knows everything on the right side and can recover the private key. 4 MQV has been standardized by IEEE P1363 (specified in P1363 2000, and amended in P1363a 2004), but it does not involve hashing, and therefore can't provide an answer to the OP's question. HMQV standardization proposal has been submitted to IEEE, but it does not contain the specific details that @jww is asking for. I went through the relevant P1363 docs and ... 4 Yes, exponentiation by squaring can be applied to any associative binary operation with identity (that is, to any monoid, which includes groups like elliptic curves as a special case), independent of the particular representation. However, the main advantage of Montgomery curves is that there is an improved algorithm (appropriately named Montgomery ladder) ... 3 The best option you have is TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA. This is likely to provide most security, as the AES keylength is maximal and ECDSA keys tend to provide more security than RSA keys, as a 128-bit security level is quite common with ECDSA (field size: 256 bit) whereas 112-bit is the standard with RSA (keylength: 2048 bit). However in practice ... 2 ECDH is not for signing. Your sign method using ecdh does not look like any valid signature scheme I have ever seen, and is therefore likely wildly insecure. Note that the Q&A you link to is asking a very different question. 2 Note: For y^2 \equiv x^3 + ax + b, you want$$m\equiv(3x^2+a)*(2y)^{-1}$$which is a shortcut that only makes sense once you understand how elliptic curves work. "Why does it say y=1 and 4 for x=1?" Like you said, plug in & solve:$$y^2 \equiv 1^3 + 2(1) + 3 \equiv 6 \equiv 1\space(mod\space5) Ask yourself "Is there a square such that it is ...

1

Is it deliberate that point addition isn't mentioned anywhere in the API or documentation? Yes. The idea is to offer a minimal API that makes doing the right thing for security easy, while avoiding low level operations that allow shooting yourself in the foot. To quote this primer (pdf) on NaCl: A typical cryptographic library is a collection of ...

1

In elliptic curves you don't have index calculus method. Only the generic algorithms (Shank's, Pollard) as the previous poster said. In order to elaborate a little, why you don't have index calculus, you have to see the steps of index calculus. The first step is to construct a factor base (in $GF(p^n)$ is consisting from polynomials) the second is to find ...

1

There is no standard "multiply two group elements" operation in an additive group. So you first need to define what you mean by $P*Q$. From the comments I gather that you want $P*Q = q P = p Q = (p \cdot q) G$. The computational Diffie-Hellman (CDH) problem is: Given $P=pG$ and $Q=qG$ compute $(p\cdot q)G$. which is clearly equivalent to your problem. ...

1

First, a bit of background. If we refer to the size of an elliptic curve group as $n$, we select an elliptic curve with $n = hq$, where $q$ is a large prime, and $h$ is a small integer called the cofactor; it is typically either 1, 4 or 8. The values of $q$ and $h$ will be part of the curve definition. As you know, with straight DH, we agree on a point ...

Only top voted, non community-wiki answers of a minimum length are eligible