# Tag Info

1

While there is a sub-exponential attack to compute isogenies on ORDINARY elliptic curves (the basis for the Rostovev and Stulbunov paper that you reference) there is not (yet at least) a sub-exponential attack to compute isogenies on SUPERSINGULAR elliptic curves. The cryptosystem proposed by DeFeo, Jao, and Plut back in 2011 is based on Supersingular ...

1

EDIT: The answer below answers the RSA modulus case… There is some related discussion in the answers to the Crypto.SE question “Why is the following RSA PRNG cryptographically secure?”. Edit: As pointed out in comments, this answer is about the zRSA The consensus among the answers seems to be that the required security assumption is too strong (strong RSA ...

0

The latest version (1.6) can be found on http://www.gsma.com or http://dacas.iie.cas.cn/. Direct links: Specification of the 3GPP Confidentiality and Integrity Algorithms 128-EEA3 & 128-EIA3. Document 2: ZUC Specification (pdf) on gsma.com ZUC算法文档v1.6 (zip) on dacas.iie.cas.cn (contains a bit more information such as more test vectors)

0

Those are calculated using the "SHA-512/t IV Generation Function", as described in FIPS-180 (pdf, see 5.3.6), the Secure Hash Standard. The procedure is to first modify the normal SHA-512 IV, then calculate the hash of a string describing the truncation mode used, and use that as the IV. Those IVs are essentially just predefined hash outputs and so not any ...

11

This is true of any group of prime order, over elliptic curves or not. This is due to Lagrange's Theorem which states that the order of a subgroup $H$ of group $G$ divides the order of $G$. Since orders are elements of the ring of integers and since this is a principal ideal domain, unique factorization exists and primes make sense. Or put another way, ...

30

This question is quite broad by specifying a sudden fall to cryptanalysis and therefore my answer might not be as complete as you wish it to be. If by "become practically attackable, or close enough that use is strongly discouraged" you imply not an academic breach but assume a weaker attacker such as a single ciphertext attack, then there are quite a few ...

Top 50 recent answers are included