Hot answers tagged

12

The security level of an elliptic curve group is approximately $\log_2{0.886\sqrt{2^n}}$. You can use this to approximate the security level of a $n$-bit key, eg: $\log_2{0.886\sqrt{2^{571}}} = 285.32537860389294$ The real computation (at least for curves over a finite field defined by a prime $p$) is $ \log_2{\sqrt{\pi/4}\sqrt{ℓ}} $, where $ℓ$ is the ...


6

The previous answer has the correct formula for estimating the security level of prime field elliptic curves. However, the table seems to just list the closest Koblitz curve sizes used, as Richie Frame points out. If you computed the actual security strength of the curves in question, you would not end up with exactly the values in the left column. For ...


4

By using the definition of $n$ bits of full entropy, NIST is abstracting away from the definition of a NRBG (or TRNG). They are basically trying to establish a minimum requirement for the quality of the random number generator, without going into the specifics on how this can be achieved. Basically this is NIST's way of saying: if we specify $n$ bits of full ...


4

"Entropy" is more accurately defined, in cryptography, as "that which the attacker does not know". For instance, suppose that every day you take all rates at the closure of the New York stock exchange, and hash them with SHA-256. The resulting value is very unpredictable (otherwise you could become very rich), so, from a "physics" point of view, there is a ...


4

The NIST source you link to is SP 800-90B. If you look at the other two publications in the series: 90A and 90C, you can find explanations of how you can use a TRNG to instantiate a DRBG or requirements on how to condition the entropy. Here is what section 7.1 of 90A says about entropy input to a DRBG: Ideally, the entropy input will have full entropy; ...


4

Yes, RSA encryption without padding as used by RSASVE in NIST SP800-56B is secure. The RSASVE Generate Operation in NIST SP800-56B §7.2.1.2 is given on input an RSA public key $(n,e)$; generates a random secret bitstring $Z$ uniformly distributed on range $[2,n-2]$; computes $C=Z^e\bmod n$ (as in textbook RSA encryption); outputs the secret $Z$ and the ...


3

The answer is simple. AES is in itself a pseudorandom function, so an output from a single block encryption will produce 128-bits of pseudorandom numbers. Now to use AES to generate longer sequences, you will have to use a block-cipher mode that lets you do the same. Here is a small list of a few very popular modes ment for PRNGs: Counter(CTR): Counter ...


2

http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf "... specifies the procedures involved in validating implementations of the Advanced Encryption Standard (AES) algorithm in FIPS 197 : Advanced Encryption Standard. The AESAVS is designed to perform automated testing on Implementations Under Test (IUTs). This publication provides the basic design ...


2

I'm not sure I got your question right, but it seems to me you are asking about modular reductions modulo $p=2^{192}-2^{64}-1$. If so, this answer from poncho, that I should have searched before writing this answer, might interests you. Note that in the following the choice of the base doesn't matter. If we have to reduce $2^{192} \mod{p}$ you can just ...


2

My question is how many more rounds would they have to use to keep this security margin on AES (other then adding a hash to AES 256 key schedule)? When AES was standardized, the best known attack (pdf, page 19) in terms of rounds broken was a related key attack that broke 9/14 rounds of AES-256. The best attack on AES-128 broke 7/10 rounds. Currently, ...


2

To my knowledge, NIST has not really decided or announced anything about successors to ECC. However, they do run workshops and such on post-quantum cryptography, so when the time is right something will probably move towards standardization. NSA, on the other hand, recently announced that they will soon push for a post-quantum system, going so far as to say ...


2

What is its signature length ? Depends on what algorithms you use, but with ECDSA the signature length is twice the length of the order of the base point. For P-521 that's 1042 bits, or 132 bytes when using whole bytes for each part. For E-521 it's 1038 bits or 130 bytes. How is it better ? The design criteria for E-521 are stated in A note on ...


1

3d multiplication is a simple multiplication not a mod multiplication. I suggest you to check IEEE Std 1363-2000 document and "A.10.3 Elliptic scalar multiplication" part of that document if you can. It has somewhat more explanation than Nist's document.


1

Except if you are picky with updates of references, there is such standard. DSA, RSA, ECDSA-$F_p$, ECDSA-$F_{2^n}$, are approved by ETSI TS 102 176-1 V2.1.1 (2011-07) (Electronic Signatures and Infrastructures (ESI); Algorithms and Parameters for Secure Electronic Signatures; Part 1: Hash functions and asymmetric algorithms), which essentially ...


1

Please refer the document at NIST site pointing to the document (800-22-rev 1a ) updated on April 2010 (http://csrc.nist.gov/publications/nistpubs/800-22-rev1a/SP800-22rev1a.pdf). The list of special published (SP) documents are available at (http://csrc.nist.gov/publications/PubsSPs.html) It involves some reading, but should get your answers. Since it ...



Only top voted, non community-wiki answers of a minimum length are eligible