Reputation
225
Top tag
Next privilege 250 Rep.
View close votes
Badges
1 6
Newest
 Commentator
Impact
~4k people reached

  • 0 posts edited
  • 0 helpful flags
  • 9 votes cast
Dec
28
comment Do I understand (below) why Q = dP is easy while finding d is hard
In his answer, @dddavidee pointed to the Silver-Pohlig-Hellman algorithm for computing the discrete log instead of Pollard's rho. Now you said that Pollard's rho is "commonly used" while ddddavidee said "One (of the best) ... S-P-H algorithm". Both appear to offer a worst case of $\mathop{O}(\sqrt{n})$, so I'm guessing that there are just a lot of finicky details involved in choosing among them. Is that largely correct?
Dec
28
comment Do I understand (below) why Q = dP is easy while finding d is hard
Another reason for sticking with EC when trying to explain the GDLP to a lay audience is that I can ignore multiplication. (Indeed, I'm forced to.) And by showing point addition on a curve over the reals, I can draw pictures instead of writing lots of algebraic expressions.
Dec
28
awarded  Commentator
Dec
28
comment Do I understand (below) why Q = dP is easy while finding d is hard
Thank you very much. Yes, there was a "not" missing from my original statement (now corrected). Oddly enough, I find I have stronger (better?) intuitions GDLP on elliptic curves than on $\mathbb{Z}_p$. I think it is because with elements of $\mathbb{Z}_p$ I can't help think of it a well-ordered. I get confused and misled by the similarity to ordinary arithmetic. But addition on ECs forces me to think about the Group properties in a more distilled form. I was at Usenix Security where that PoC was presented. Here I'm focusing on the GDLP on ECs, instead of the how to use the back door.
Dec
28
comment Do I understand (below) why Q = dP is easy while finding d is hard
Matthew Green is a major source for me on all things Dual_EC. (Despite the fact that I've lost count of the number of times he's written "this will be the last thing I write about Dual_EC_DBRG".
Dec
28
comment Do I understand (below) why Q = dP is easy while finding d is hard
Thank you very much. I am aiming to write a description of one aspect of the Dual EC backdoor, and am focusing on the contrast between the two Juniper backdoors. With the authentication one, once it was discovered that everyone has that "back door key", but with the Dual EC one, only the creator of the new Q has the key, even though P and Q are known.
Dec
28
accepted Do I understand (below) why Q = dP is easy while finding d is hard
Dec
28
revised Do I understand (below) why Q = dP is easy while finding d is hard
Inserted a crucial "not"
Dec
28
revised Do I understand (below) why Q = dP is easy while finding d is hard
I had said something backwards. I wanted to say that d CANNOT be computed efficiently from P and Q
Dec
28
awarded  Yearling
Dec
28
asked Do I understand (below) why Q = dP is easy while finding d is hard
Dec
16
comment Unit testing a library RNG and its seeding for practical security
Does any one know if people actually do run collision tests to identify badly seeded CSPRNGs? And in particular, anything I can cite?
Sep
26
comment Is it possible to make time-locked encrytion algorithm?
That is really cool. I take it that elliptic curve cryptography can be used in place of El Gamal throughout. (Though I don't fully grok the VSS mechanism, so I'm not certain that that carries over, but I think it does.)
Sep
26
comment What is the security loss from reducing Rijndael to 128 bits block size from 256 bits?
Changing a widely adopted standard is not something to do lightly. And there hasn't been a lot of demand to revise or develop a new standard, probably because under proper usage, related key attacks are irrelevant.
Sep
24
answered Achieving 256-bit encryption strength with PBKDF2 - HMAC-SHA1
Sep
24
comment Reusing keys with AES-CBC
I think a quick way to summarize this is: reusing a key/IV with CBC is bad. Reusing a key/nonce with CTR is catastrophic.
Sep
24
answered What is the security loss from reducing Rijndael to 128 bits block size from 256 bits?
Sep
9
revised Which PRNG security requirements do I need for key generation
s/SecGetRandomBytes/SecRandomCopyBytes/ and "Update 2"
Sep
9
comment Which PRNG security requirements do I need for key generation
KDF is way to go. Hardware device isn't a workable for this application. This is a consumer product. We can't expect end users to each have HW RNGs.
Sep
9
awarded  Scholar