Tag Info

Hot answers tagged


The twist attack is best explained in Fouque et al's paper. While the (quadratic) twist of the curve $E : y^2 = x^3 + ax + b \in \mathbb{F}_p$ is indeed of the form $E^t : y^2 = x^3 + d^2ax + d^3b \in \mathbb{F}_{p}$ for nonsquare $d$, you can also think of the twist as the set of points $(x, y)$ in $E^2 : y^2 = x^3 + ax + b \in \mathbb{F}_{p^2}$ where $x$ ...


I don't consider the following a complete answer, but it is a start, and best I can do with my very limited knowledge. I hope someone could fix it or improve it. These type of attacks are only possible against specific implementation of higher level protocols. I will start by describing an invalid-curve attack against a specific ECDH based protocol. ...

Only top voted, non community-wiki answers of a minimum length are eligible