# Tag Info

The answer is about the difficulty of discrete logarithm. The notion of isomorphism does not capture all that matters in cryptography; we also need to consider computing costs. Suppose that we have an abelian group $\mathbb{G}$ with additive notation. Let $G$ be a conventional element of $\mathbb{G}$ of order $n$. The subgroup generated by $G$ is: $$\langle ... 6 First off, your equation is correct and there seems to be no calculation mistake. To understand on how to get from$$(2+d)x^{2}+dy^{2}=d+(d-2)x^{2}y^{2}$$to$$x^{2}+y^{2}=1+e\cdot x^{2}y^{2}$$one first needs to observe that e=(d-2)/(d+2)=121665/121666 holds. The next step is to consider: "What operations are actually allowed with birational ... 4 DSA relies on k being independent from d. You define k as: k=z^\prime d\mod n Substituting k in the signing equation you get: s = k^{-1} (z+rd) \mod n s z^\prime d = z + rd \mod n d=z (sz^\prime -r)^{-1} \mod n The attacker knows everything on the right side and can recover the private key. 4 MQV has been standardized by IEEE P1363 (specified in P1363 2000, and amended in P1363a 2004), but it does not involve hashing, and therefore can't provide an answer to the OP's question. HMQV standardization proposal has been submitted to IEEE, but it does not contain the specific details that @jww is asking for. I went through the relevant P1363 docs and ... 4 Bits of entropy The assumption for all cryptographic operations is that a random key of n bits has n bits of entropy. If it doesn't (due to PRNG defect or implementation error) then the key will be weaker than expected but the underlying assumption of all cryptographic primitives is that an n bit key has n bits of entropy. This is the same for all types ... 4 Yes, exponentiation by squaring can be applied to any associative binary operation with identity (that is, to any monoid, which includes groups like elliptic curves as a special case), independent of the particular representation. However, the main advantage of Montgomery curves is that there is an improved algorithm (appropriately named Montgomery ladder) ... 3 The best option you have is TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA. This is likely to provide most security, as the AES keylength is maximal and ECDSA keys tend to provide more security than RSA keys, as a 128-bit security level is quite common with ECDSA (field size: 256 bit) whereas 112-bit is the standard with RSA (keylength: 2048 bit). However in practice ... 3 Ed25519 needs two secret values: The private scalar (~256 bits) A hash prefix used derive a secret nonce from the message (256 bits) Using the same value for these is bad style, as is deriving one of them from the other. You could also use their concatenation as private key, but that'd double its size to 512 bits. So Ed25519 chose the clean solution of ... 2 ECDH is not for signing. Your sign method using ecdh does not look like any valid signature scheme I have ever seen, and is therefore likely wildly insecure. Note that the Q&A you link to is asking a very different question. 1 In elliptic curves you don't have index calculus method. Only the generic algorithms (Shank's, Pollard) as the previous poster said. In order to elaborate a little, why you don't have index calculus, you have to see the steps of index calculus. The first step is to construct a factor base (in GF(p^n) is consisting from polynomials) the second is to find ... 1 There is no standard "multiply two group elements" operation in an additive group. So you first need to define what you mean by P*Q. From the comments I gather that you want P*Q = q P = p Q = (p \cdot q) G. The computational Diffie-Hellman (CDH) problem is: Given P=pG and Q=qG compute (p\cdot q)G. which is clearly equivalent to your problem. ... 1 First, a bit of background. If we refer to the size of an elliptic curve group as n, we select an elliptic curve with n = hq, where q is a large prime, and h is a small integer called the cofactor; it is typically either 1, 4 or 8. The values of q and h will be part of the curve definition. As you know, with straight DH, we agree on a point ... 1 Consider the rational functions f_P^k and f_P'. Since \operatorname{div} is a homomorphism of semigroups (i.e. \operatorname{div}(fg)=\operatorname{div}f+\operatorname{div}g), we have$$\operatorname{div}(f_P^k)=k\cdot\operatorname{div}f_P=k\cdot(m[P]-m[\mathcal O])=km[P]-km[\mathcal O]=\operatorname{div}f_P'\text. Now with theorem 5.36 of "An ...