573 reputation
36
bio website normalesup.org/~tibouchi
location
age
visits member for 2 years, 10 months
seen Nov 14 at 7:21

Jun
19
answered Is either brainpoolP320r1 or brainpoolP320t1 a SafeCurve?
Jun
19
answered Fast hashing into elliptic curve
Apr
10
comment Hill cipher key space
Actually, they're the same: $p^{k^2}(1-p^{-1})\cdots(1-p^{-k}) = p^{k^2}\prod_{i=1}^k(1-p^{-i}) = \prod_{i=1}^k p^k(1-p^{-i}) = \prod_{i=1}^k (p^k - p^{k-i})$ (this common value is indeed the number of invertible $k\times k$ matrices over $\mathbb{Z}/p\mathbb{Z}$).
Apr
6
awarded  Critic
Apr
6
awarded  Yearling
Apr
5
awarded  Editor
Apr
5
revised Side-channel attacks against ECDH for Weierstrass normal form curves
link to other relevant answer + comment re Montgomery curves
Apr
5
answered Side-channel attacks against ECDH for Weierstrass normal form curves
Jan
17
awarded  Yearling
Feb
23
awarded  Necromancer
Feb
22
comment Standardized parameters for elliptic curve cryptography
One can infer that indeed, but on the other hand, the Digital Signature Standard says that NIST-approved curves are randomly generated (and even “provably” so!) in the sense that the curve coefficients are chosen using a hash function (even though the base fields are quite special). So it seems difficult to tell what exactly randomly generated means in this context.
Feb
22
comment Standardized parameters for elliptic curve cryptography
Very useful, thanks.
Feb
22
awarded  Scholar
Feb
22
accepted Standardized parameters for elliptic curve cryptography
Feb
21
awarded  Student
Feb
21
asked Standardized parameters for elliptic curve cryptography
Feb
7
answered Does RSA padding have to be unpredictable if the payload is?
Feb
6
answered Anonymous trust/reputation system
Jan
26
awarded  Supporter
Jan
18
comment Pairing-friendly curves in small characteristic fields
I should perhaps note, however (and sorry for commenting twice), that in principle, it might be possible to construct pairing-friendly curves over extension fields of a form like $\mathbb{F}_{p^2}$ with the CM method (see e.g. the discussion in 4.1 of Barreto and Naehrig's paper). But $p$ still has to be large and you cannot fix it in advance, so it doesn't solve the problem in small characteristic.