Reputation
3,407
Top tag
Next privilege 3,500 Rep.
Protect questions
Badges
11 25
Newest
 Revival
Impact
~41k people reached

  • 0 posts edited
  • 2 helpful flags
  • 540 votes cast
May
24
revised Logjam on Elliptic Curves?
Fix formula
May
23
comment Logjam on Elliptic Curves?
The first logarithm requires $\sqrt{\pi n / 2} / 2^k$ storage, where $k$ is, as above, the number of bits defining a distinguished point. For a 256-bit curve, your $2^{60}$ storage bound implies $k \ge 68$, since that is the amount of storage needed for a single discrete log. Bernstein and Lange suggested (eprint.iacr.org/2012/318) $k = 86$ and a precomputation of $2^{86}$ distinguished points---at a cost of $2^{172}$---making individual logarithms computable with $2^{86}$ effort. Reducing $k$ greatly increases the amount of work; I doubt $2^{30}$ speedup would be achievable.
May
23
revised Logjam on Elliptic Curves?
added 83 characters in body
May
23
answered Logjam on Elliptic Curves?
May
8
awarded  Revival
May
7
answered Encoding a message to a point of curve y^2=x^3+7 and Bitcoin Core
May
7
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
Thanks, changed. Also added a note stressing the importance of padding.
May
7
revised How is HMAC(message,key) more secure than Hash(key1+message+key2)
Stress the importance of padding; edited body
May
6
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
Correct; that applies to the version without the $10^t$ padding. Yasuda notes: "We note that it is the lack of appropriate filling between the message M and the last key K, rather than the usage of a single key, that contributes to this key recovery attack."
May
6
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
Being the envelope MAC was the point! A single key is enough to be secure, though two independent keys are also fine.
May
6
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
OK, changed it to a less confusing formula, that matches Yasuda's paper.
May
6
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
$1$, followed by enough $0$s to pad out to block length. I think it should be intelligible now?
May
6
revised How is HMAC(message,key) more secure than Hash(key1+message+key2)
Use Yasuda's notation
May
6
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
Right, I got the message padding wrong. Fixed now.
May
6
revised How is HMAC(message,key) more secure than Hash(key1+message+key2)
added 1 character in body
May
6
answered How is HMAC(message,key) more secure than Hash(key1+message+key2)
May
4
revised Factoring two RSA moduli $N_i=p_i\cdot q_i$ knowing that $p_2=p_1+2$?
deleted 4 characters in body
May
4
revised Factoring two RSA moduli $N_i=p_i\cdot q_i$ knowing that $p_2=p_1+2$?
edited body
May
4
answered Factoring two RSA moduli $N_i=p_i\cdot q_i$ knowing that $p_2=p_1+2$?
Apr
20
awarded  Enlightened