Hot answers tagged

30

This question is quite broad by specifying a sudden fall to cryptanalysis and therefore my answer might not be as complete as you wish it to be. If by "become practically attackable, or close enough that use is strongly discouraged" you imply not an academic breach but assume a weaker attacker such as a single ciphertext attack, then there are quite a few ...


11

This is true of any group of prime order, over elliptic curves or not. This is due to Lagrange's Theorem which states that the order of a subgroup $H$ of group $G$ divides the order of $G$. Since orders are elements of the ring of integers and since this is a principal ideal domain, unique factorization exists and primes make sense. Or put another way, ...


1

EDIT: The answer below answers the RSA modulus case… There is some related discussion in the answers to the Crypto.SE question “Why is the following RSA PRNG cryptographically secure?”. Edit: As pointed out in comments, this answer is about the zRSA The consensus among the answers seems to be that the required security assumption is too strong (strong RSA ...


1

While there is a sub-exponential attack to compute isogenies on ORDINARY elliptic curves (the basis for the Rostovev and Stulbunov paper that you reference) there is not (yet at least) a sub-exponential attack to compute isogenies on SUPERSINGULAR elliptic curves. The cryptosystem proposed by DeFeo, Jao, and Plut back in 2011 is based on Supersingular ...



Only top voted, non community-wiki answers of a minimum length are eligible