2,727 reputation
921
bio website
location
age
visits member for 3 years, 2 months
seen Oct 18 at 2:32

Jul
31
comment Practical consequences of using functional encryption for software obfuscation
There's nothing practical about that paper. Notice the use of multilinear maps and fully homomorphic encryption. I suspect this will only be practical when FHE is also practical.
Jul
15
answered What prevents continued hashing of a key from being used as a cipher when xored with plaintext?
Jul
6
comment Snowden Challenge II: Can we solve Snowden challenge quantumly?
The classical attack on the original 1978 parameters of McEliece is hardly evidence of weakness of the scheme. In comparison, RSA key size was originally proposed to be 200 digits (665 bits), and estimated to take billions of years to factor.
Jul
6
comment Snowden Challenge II: Can we solve Snowden challenge quantumly?
There are known quantum computer-resistant asymmetric cryptosystems out there (e.g., McEliece). Look up "post-quantum cryptography".
Jun
29
comment inverse problem about scalar multiplication on elliptic curve
You can recover $P$ by computing $(n^{-1} \bmod l)\cdot Q$, where $l$ is the order of $Q$.
Jun
1
comment Complex Numbers on Elliptic Curves & Usage in Tate Pairing
Watson is correct. Here's the example you mention spelled out in Sage.
May
31
comment What do recent announcements about solving the DLP in $GF(2^{6120})$ mean for RSA
One tiny detail: DSA usually works over subgroups of order $q$ modulo $p$. So the primes are often of the form $qr + 1$, where $q \approx 2^{2b}$, $b$ being the target security level.
May
31
awarded  Excavator
May
30
revised How robust is discrete logarithm in $GF(2^n)$?
added 519 characters in body
May
30
answered Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?
May
29
comment Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?
Yes, the shape of the field has much to do with the efficiency of the new algorithms. For example $6120$ was represented as $\mathbb{F}_{ {2^{24}}^{255} }$, and more generally the method currently requires that the base field ($2^{24}$) be larger than the extension degree ($255$). For primes like $4099$, we can't just change the representation of the field to match our needs. One possible solution, suggested by Joux, is to embed $\mathbb{F}_{2^{4099}}$ in $\mathbb{F}_{{2^{4100}}^{2\cdot 4099}}$, which doesn't look too good in practice. So prime exponents are safe for now.
May
29
comment Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?
It's worth pointing out that these new results have effectively killed pairings over binary curves (as seen on this question)
May
26
comment Key sizes for discrete logarithm based methods
I suspect he misused the terminology, and is actually asking about the group (modulus) size.
May
13
answered Trying to better understand the failure of the Index Calculus for ECDLP
Apr
2
comment “Weaknesses” in SHA-256d?
By find colliding $m, m'$, you can forge $H(m \, || \, K)$ authenticators in $2^{n/2}$ time instead of $2^n$.
Mar
28
comment Solving hard problems in $\mathbb Z_{p}^{*}$ when $\mathbb p$ is close to $\mathbb 2^{n}$
I cannot. It is possible that with clever methods (tuning the regular polynomial selection methods) we can can come up with better bounded polynomials easily, but I have found no existing work on this.
Mar
26
comment Solving hard problems in $\mathbb Z_{p}^{*}$ when $\mathbb p$ is close to $\mathbb 2^{n}$
Thanks, the notation was indeed suboptimal.
Mar
26
answered Solving hard problems in $\mathbb Z_{p}^{*}$ when $\mathbb p$ is close to $\mathbb 2^{n}$
Mar
25
comment Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?
You're right, fixed.
Mar
25
revised Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?
added 7 characters in body