# Tag Info

0

Since "crypto_scalarmult is the function crypto_scalarmult_curve25519", does this mean that Curve25519 does not provide any guarantees for the DDH problem to be hard? No, it just means, that the NaCl specification or API, which is different from the NaCl implementation / library, makes no guarantees about the DDH problem being hard in the group being ...

1

A.Toumantsev had it right in his comment that 'it depends'; I'll try to expand on that. First of all, there's no one 'window method', there are a bunch of different variations, and which $w$ works best for you would depend on the exact version you're using. With the most basic window method, to compute $a^e \bmod p$, you: compute $a^0 \bmod p, a^1 \bmod ... 0 Window Size (W) for many practical implementation of RSA Algorithm (like OpenSSL) is related to key length.for example in openSSL library for insecure 80 bits key, W is 4 or for insecure 320 bits key , W is 5 and for 1024 or 2048 bits key (length), W is 6. note:Maximum of Window size in openSSL Library is "6" 7 I purposefully did not look at the details of the change you are proposing because whatever the change is, the answer is a resounding YES. If you make any change to a cryptographic construction, then you must prove the security of the modified scheme. If you are lucky, you may be able to reduce the security of the modified scheme to the original scheme, or ... 2 The size we speak of with regard to elliptic curves is the size of the field over which the elliptic curve is defined. This is not necessarily exactly the size of the private key. For example: Curve25519 is a 255-bit elliptic curve and has, effectively, 252-bit private keys, though they are usually encoded as 256-bit values with four fixed bits. Public keys ... 1 No, it's no easier than the standard DBDH problem. Here's the reduction that shows that: suppose that we have an Oracle that solves your problem (given$g^s, g^y, g^r, g^t, g^{st-rs}, g^{(yr+d)/t}, e(g,g)^x$is$e(g,g)^x = e(g,g)^{syr}$?) Now, suppose we're given$g^s, g^y, g^r, e(g,g)^x$, and are asked whether$e(g,g)^x = e(g,g)^{syr}$. What we do is ... 0 I'll assume that the attacker has the value$g$as well. If so, we can rewrite$M \cdot e(g, g)^{ab} = M \cdot e(g^a, g)^b = M \cdot h^b$(where the attacker knows the value$h = e(g^a, g)$. Assuming that$a$is relatively prime to the size of the subgroup generated by$e(g, g)$, and that$M$is a member of that subgroup,then, yes, it is indistinguishable; ... 1 There are some possible advantages to threshold signing. First, it enables a more flexible setting where the key can be divided into$n$parts and any subset of$t$can be used to sign. Second, you can go from holding a single key in one place to distributing it and back without making any changes. Third, you can achieve a type of proactive security by ... 2 The keychain was moved to the Secure Enclave, the Apple WWDC 2015 Session 766 transcript states: "We also moved the KeyStore component from the kernel into Secure Enclave and it's that component which controls the cryptography around Keychain items and the data protection."" Thus both symmetric and asymmetric keys are now in the Secure Enclave if the ... 1 I'm sorry, but chances are this doesn't work. The reason is of course that ECDSA signatures are usually fully randomized, meaning that there's randomness introduced in between the private key and the final signature. If you're looking at an ECDSA specification, the relevant value usually is called$k\$. What you'd rather need would be an RSA encryption / ...

2

Is this approach secure or there is some naive issue? There are some issues, see below. Most naive ones at the top. You need to trust the public keys to create an authenticated connection. I don't see any part of the protocol where you verify public keys. Instead of signing "the message" you need to sign the key agreement parameters. If you just sign the ...

0

Building such a table would be very difficult, because certificate-sizes depend on a lot of (variable-sized) things, including but not limited to: usage constraints signatures public keys URLs to CRLs and OCSP-servers Name, location and other identifiers of the key-holder Name, location and other identifiers of the issuing CA However, you can estimate ...

3

That tells us those problems are in BQP. This answer describes a way of reducing factoring to SAT. More elaborate approaches will give reductions from ​ RSA or ECC ​ to SAT. On the other hand, if there is a polynomial-time reduction from an NP-hard problem to ​ RSA or ECC ​ ​ then ​ ​ ​ BQP ∩ UP ∩ coUP ​ = ​ NP ​ .

5

Recently I've found out on this website that brainpoolP256t1 and brainpoolP384t1 aren't secure. Actually, that website doesn't say that, it says they aren't safe, where their definition of "safe" means it meets all of a series of requirements. If you go through the table they give, brainpoolP384t1 fails the safe requirements at three points: ladder; ...

Top 50 recent answers are included