Reputation
3,727
Top tag
Next privilege 4,000 Rep.
Access 'trusted user' tools
Badges
13 26
Newest
 Yearling
Impact
~45k people reached

  • 0 posts edited
  • 2 helpful flags
  • 558 votes cast
Aug
19
awarded  Yearling
Aug
18
comment Why not to use curve over field of $p^m$ with $p > 2$ for ECDSA?
$\mathbb{F}_{p^m}$ can work, but it is a more brittle choice since a larger number of attacks have to be considered. It is not idiotic, but the (speed) advantages had better be worth it. As of right now, the only fields where there are considerable advantages are of the form $\mathbb{F}_{p^2}$ for large $p$.
Aug
18
comment Why not to use curve over field of $p^m$ with $p > 2$ for ECDSA?
Which ECDSA paper is that? The NIST one? If so, it is likely that it restricts to $\mathbb{F}_p$ and $\mathbb{F}_{{2}^{m}}$ because those are the only standardized curves.
Jul
22
revised Logjam-style attack on Factoring?
added 33 characters in body
Jul
22
answered Logjam-style attack on Factoring?
Jul
17
awarded  Enlightened
Jul
17
awarded  Nice Answer
Jun
13
answered Can we reduce Diffie-Hellman problem to “Discrete-log inversion” problem?
Jun
11
comment RSA public key recovery from signatures
Vanilla Python will likely be too slow here. Instead, try Sage or, if you do not want a gigantic package, use gmpy to use GMP for the arithmetic. It will be much faster than Python's native quadratic algorithms.
Jun
10
comment RSA public key recovery from signatures
With $e=3$ it should be nearly instantaneous---the $\gcd$ of two $1536$-bit numbers is pretty cheap. $e = 65537$ takes around 30 seconds in my machine.
Jun
8
answered RSA public key recovery from signatures
Jun
5
revised Why does anyone use elliptic curves for a CSPRNG?
added 27 characters in body
Jun
5
answered Why does anyone use elliptic curves for a CSPRNG?
May
24
revised Logjam on Elliptic Curves?
Fix formula
May
23
comment Logjam on Elliptic Curves?
The first logarithm requires $\sqrt{\pi n / 2} / 2^k$ storage, where $k$ is, as above, the number of bits defining a distinguished point. For a 256-bit curve, your $2^{60}$ storage bound implies $k \ge 68$, since that is the amount of storage needed for a single discrete log. Bernstein and Lange suggested (eprint.iacr.org/2012/318) $k = 86$ and a precomputation of $2^{86}$ distinguished points---at a cost of $2^{172}$---making individual logarithms computable with $2^{86}$ effort. Reducing $k$ greatly increases the amount of work; I doubt $2^{30}$ speedup would be achievable.
May
23
revised Logjam on Elliptic Curves?
added 83 characters in body
May
23
answered Logjam on Elliptic Curves?
May
8
awarded  Revival
May
7
answered Encoding a message to a point of curve y^2=x^3+7 and Bitcoin Core
May
7
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
Thanks, changed. Also added a note stressing the importance of padding.