2,612 reputation
719
bio website
location
age
visits member for 2 years, 11 months
seen 5 hours ago

May
31
comment What do recent announcements about solving the DLP in $GF(2^{6120})$ mean for RSA
One tiny detail: DSA usually works over subgroups of order $q$ modulo $p$. So the primes are often of the form $qr + 1$, where $q \approx 2^{2b}$, $b$ being the target security level.
May
31
awarded  Excavator
May
30
revised How robust is discrete logarithm in $GF(2^n)$?
added 519 characters in body
May
30
answered Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?
May
29
comment Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?
Yes, the shape of the field has much to do with the efficiency of the new algorithms. For example $6120$ was represented as $\mathbb{F}_{ {2^{24}}^{255} }$, and more generally the method currently requires that the base field ($2^{24}$) be larger than the extension degree ($255$). For primes like $4099$, we can't just change the representation of the field to match our needs. One possible solution, suggested by Joux, is to embed $\mathbb{F}_{2^{4099}}$ in $\mathbb{F}_{{2^{4100}}^{2\cdot 4099}}$, which doesn't look too good in practice. So prime exponents are safe for now.
May
29
comment Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?
It's worth pointing out that these new results have effectively killed pairings over binary curves (as seen on this question)
May
26
comment Key sizes for discrete logarithm based methods
I suspect he misused the terminology, and is actually asking about the group (modulus) size.
May
13
answered Trying to better understand the failure of the Index Calculus for ECDLP
Apr
2
comment “Weaknesses” in SHA-256d?
By find colliding $m, m'$, you can forge $H(m \, || \, K)$ authenticators in $2^{n/2}$ time instead of $2^n$.
Mar
28
comment Solving hard problems in $\mathbb Z_{p}^{*}$ when $\mathbb p$ is close to $\mathbb 2^{n}$
I cannot. It is possible that with clever methods (tuning the regular polynomial selection methods) we can can come up with better bounded polynomials easily, but I have found no existing work on this.
Mar
26
comment Solving hard problems in $\mathbb Z_{p}^{*}$ when $\mathbb p$ is close to $\mathbb 2^{n}$
Thanks, the notation was indeed suboptimal.
Mar
26
answered Solving hard problems in $\mathbb Z_{p}^{*}$ when $\mathbb p$ is close to $\mathbb 2^{n}$
Mar
25
comment Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?
You're right, fixed.
Mar
25
revised Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?
added 7 characters in body
Mar
14
answered How to perform Multiplicative Inverse Modulo in IDEA
Jan
31
answered Is (2^333)-1 a prime number?
Jan
24
comment Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack
I used SAGE, it has all kids of useful things. I've posted the code to do the above here.
Jan
22
answered Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack
Jan
10
comment Is it possible to break a hash-based block cipher?
CBC doesn't help you; what you get is something like Block 0: IV Block 1: IV ^ M[0] ^ H(K, 0) Block 2: (IV ^ M[0] ^ H(K, 0)) ^ M[1] ^ H(K, 1) ... By XORing IV with the first block, the first with the second, etc, you are able to recover M[i] ^ H(K, i)
Jan
10
comment Is it possible to break a hash-based block cipher?
What you describe is not a block cipher, as a block cipher by definition has no notion of position (i.e. $n$). What you're describing is a stream cipher made out of a hash in counter mode (see Salsa20 for a similar construction).