# Tag Info

5

Recently I've found out on this website that brainpoolP256t1 and brainpoolP384t1 aren't secure. Actually, that website doesn't say that, it says they aren't safe, where their definition of "safe" means it meets all of a series of requirements. If you go through the table they give, brainpoolP384t1 fails the safe requirements at three points: ladder; ...

3

That tells us those problems are in BQP. This answer describes a way of reducing factoring to SAT. More elaborate approaches will give reductions from ​ RSA or ECC ​ to SAT. On the other hand, if there is a polynomial-time reduction from an NP-hard problem to ​ RSA or ECC ​ ​ then ​ ​ ​ BQP ∩ UP ∩ coUP ​ = ​ NP ​ .

2

Is this approach secure or there is some naive issue? There are some issues, see below. Most naive ones at the top. You need to trust the public keys to create an authenticated connection. I don't see any part of the protocol where you verify public keys. Instead of signing "the message" you need to sign the key agreement parameters. If you just sign the ...

2

The size we speak of with regard to elliptic curves is the size of the field over which the elliptic curve is defined. This is not necessarily exactly the size of the private key. For example: Curve25519 is a 255-bit elliptic curve and has, effectively, 252-bit private keys, though they are usually encoded as 256-bit values with four fixed bits. Public keys ...

2

The keychain was moved to the Secure Enclave, the Apple WWDC 2015 Session 766 transcript states: "We also moved the KeyStore component from the kernel into Secure Enclave and it's that component which controls the cryptography around Keychain items and the data protection."" Thus both symmetric and asymmetric keys are now in the Secure Enclave if the ...

1

No, it's no easier than the standard DBDH problem. Here's the reduction that shows that: suppose that we have an Oracle that solves your problem (given $g^s, g^y, g^r, g^t, g^{st-rs}, g^{(yr+d)/t}, e(g,g)^x$ is $e(g,g)^x = e(g,g)^{syr}$?) Now, suppose we're given $g^s, g^y, g^r, e(g,g)^x$, and are asked whether $e(g,g)^x = e(g,g)^{syr}$. What we do is ...

1

There are some possible advantages to threshold signing. First, it enables a more flexible setting where the key can be divided into $n$ parts and any subset of $t$ can be used to sign. Second, you can go from holding a single key in one place to distributing it and back without making any changes. Third, you can achieve a type of proactive security by ...

1

I'm sorry, but chances are this doesn't work. The reason is of course that ECDSA signatures are usually fully randomized, meaning that there's randomness introduced in between the private key and the final signature. If you're looking at an ECDSA specification, the relevant value usually is called $k$. What you'd rather need would be an RSA encryption / ...

Only top voted, non community-wiki answers of a minimum length are eligible