Tag Info

New answers tagged

0

It comes from the (somehow abusive) software simplifications when computing the CRT. Here is the simplified code (as in pkcs#1 v2.1) m1 = (c^dP) % p m2 = (c^dQ) % q h = (q_inv*(m1 - m2)) % p m = m2 + h*q Agggh, Outch. when m2 > m1, we enter the realm of negative numbers unfriendly to unsigned crypto libraries. Then many authors suggested this ...


0

Have a look to Shanks-Tonelli algorithms about modular square root. Here is one link ( http://en.wikipedia.org/wiki/Tonelli%E2%80%93Shanks_algorithm ) On binary curves y^2 + (x)y - (x^3 + bx^2 + b) = 0, you can rewrite it as y^2 + Ay + B = 0 you need to solve a quadratic equation in F(2^m) ( ...


0

Well, all representations of the field $GF(2^8)$ are isomorphic. What that means is that there is a mapping between one representation of that field to another, where that mapping preserves all field properties. That is, if we had two representations $A$ and $B$, there exists a mapping $M$ from elements of $A$ to elements of $B$ such that, for any two ...


1

Here is a plot of secp256k1 over the reals. That I'll use for illustration purposes. What happens at $x=-3$, well, we get $y^2 = (-3)^3+7$ which reduces to $y^2=-20$. Solving for $y$ we get $y=\sqrt{-20}$, which is not in the reals, so, we cannot have a point on that curve for $x=-3$. This is what is happening. In the case of the real secp256k1 used in ...


0

I've allready replied to the question posted some days before. Montgomery multiplication is another way to perform modular multiplication in the residue system representation. The operation induced is in fact a group morphism. In GF(p), p prime, or in the multiplicative group $Z/nZ$, the transformation allows to perform modular multiplication without ...


0


0

The confusion comes from the choice of representation. I'd a quick look to the referenced paper, where the autors use a 2-radix representation. Then you shoud initialise $e=\frac{m+15}{w}$ instead of $e=\frac{m+1}{w}$ as you use a 16 bit adder! The best is to read again the seminal paper of P.L. ...


0

Suppose an adversary can collect all $k$ ciphertexts created for some unknown plaintext. It is clear that product of all $r_i$ is an invariant under any permutation. So this adversary would multiply ciphertexts collected, reducing to previous question with repeated $r$. To avoid such an attack, one needs non-standard assumption(s) on capability of the ...


3

You have to worry not just about a pair of blinding values being equal, but more complex relationships between them. Thus, finding a proof of security for this approach looks non-trivial to me. Let me elaborate. Suppose $R_j$ is the $j$th blinding variable you use. If $R_i = R_j$, that's a problem, but as you say, that can be made very unlikely. ...


0

Even though this is off-topic, I'll mention that depending on which factoring algorithms you want to implement, the ablity to work with integers of arbitrary sizes may not be sufficient. For example, the sieving algorithms require the ability to do some linear algebra over finite fields, and the Quadratic/Number Field sieves require the ability to work in ...


2

The first obvious objection is that it would do a lousy job of blinding values; if you reuse the blinding factor, then it would be practical to correlate the blinded values with their original ones (and the entire point of blinding values is to prevent anyone from doing so). Suppose we had two original encrypted values $c$, $d$, and the corresponded blinded ...


0

There are many libraries that allow you to do that in almost any language. There is BigInt/BigInteger class for Java/Scala. (The Scala's class is sjust a wrapper around the Java class.) Haskell has type Integer. Do not confuse it with Int, which is for small numbers only.


2

Yours is a perfectly legitimate question. I know that C#, F#, Java and Scala have an in-built support to handle arbitrarily large numbers, i.e. as large as your computer’s memory.


2

There are some errors in the basic assumptions or in their descriptions. So, we start with the group $\mathbb{Z}_p^*$, with $p$ prime. This is a cyclic group with order $p-1$. if a number is said to be a subgroup of a quadratic residue of Z∗p, can I affirm that it is a generator of a cyclic group ? First, a number (or more formally an element of the ...


6

GF$(2^8)$ or $\mathbb F_{2^8}$ can also be viewed as the vector space $\mathbb F_2^8$ of $8$-bit vectors (or bytes) over GF$(2)$ or $\mathbb F_2$. Suppose $\{\beta_0, \beta_1, \cdots, \beta_7\}$ is a basis of $\mathbb F_2^8$ over $\mathbb F_2$, that is, the sum $$a_0\beta_0 \oplus a_1\beta_1 \oplus \cdots \oplus a_7\beta_7, ~ a_i \in \mathbb F_2$$ equals ...


-1

You can begin by enumerating all the irreducible polynomials of degree 8. This gives you all the possible fields representations. If I remember Eisenstein criterium is one of the algorithm for testing irreducibility of polynomials All these field are isomorphic to each other.


3

Let $x\in\mathbb Z/p\mathbb Z$ be the point's first coordinate, and define $z := x^3+ax+b$. We know that there exists a square root $y\in\mathbb Z/p\mathbb Z$ of $z$, i.e. $y^2=z$. Let's assume we have already found such an $y$. Since the order of $(\mathbb Z/p\mathbb Z)^\ast$ is $p-1$, Lagrange's theorem implies $y^p=y\text,$ hence ...



Top 50 recent answers are included