ByteCoin
Reputation
347
Top tag
Next privilege 500 Rep.
Access review queues
 Jan 19 comment Is it possible to figure out the public key from encrypted text? @yydl Let's take the concrete example of RSA where n=221 and e=11 so that's a 8-bit modulus. If the plaintexts only come from the set 54, 59, 61, 63, 70, 82, 92, 125, 166, 175, 181, 185, 208 then Eve, who just sees the ciphertexts might reasonably assume that the 4-bit modulus 15 is being used. Of course as fgrieu says it's inefficient but it's the best that can be done under the constraints of the original question. Jan 19 answered Is it possible to figure out the public key from encrypted text? Jan 19 comment How much can we compress RSA public keys? Is the goal to reduce the number of bits that need to be made public in order to publish the public key for a given RSA-like scheme or is the goal to reduce the number of bits that must be securely stored to allow one to regenerate one's own public key from scratch? Jan 19 comment How much can we compress RSA public keys? I don't follow this. In what interval are we expecting to find just one prime? For 1536 bit numbers, roughly .1% are primes. Jan 19 revised How much can we compress RSA public keys? added some stuff Jan 19 answered How much can we compress RSA public keys? Oct 16 comment How to practically find solutions to a discrete logarithm? This thread on mersenneforum is required reading. The author of a similar article in that thread is apparently "auditing a security protocol". The modulus is a "safe prime" which possibly represents a valuable real-world problem instance. The parameters are the ones posted here. Oct 16 awarded Commentator Oct 16 comment Would the ability to efficiently find Discrete Logs have any impact on the security of RSA? It's unlikely you'll find anything that shows there's no connection between solving the DLP for primes and factoring because they're very different problems with no obvious connection. You could similarly fruitlessly search for citations stating that an efficient solution to the TSP would not lead to a fast factoring algorithm or DLP solutions. Oct 16 answered An Elliptic curve cryptography implementation which can be terminated Oct 16 comment An Elliptic curve cryptography implementation which can be terminated Yes there are the problems you mention and the fact that n has to be hard to factor makes the signatures etc ridiculously large and slow. It was an idea for a particular implementation where it had to be ECC-based and security during operation was not terribly important but insecurity after termination was important. If there's a better way of getting this functionality then that would be interesting. Unfortunately I can't think of another way to generate an elliptic curve with some secret backdoor that would allow the rapid calculation of logarithms. Oct 15 comment An Elliptic curve cryptography implementation which can be terminated Ok. Thomas makes a good point. How about we choose curves where logs are easy to find? If the curves over $Z_p$, $Z_q$ etc are anomalous then the ECDLP can be solved in essentially linear time. This means that the factors can be chosen sufficiently large so that n can't be factored easily. Oct 15 comment An Elliptic curve cryptography implementation which can be terminated I know it's not a field but it behaves like one for most purposes. If one could not ignore this fact then elliptic curve factorization would be much faster. That being said - with this scheme you have more information than just knowing $n$ is composite. I want to know whether that introduces a flaw. Oct 15 revised An Elliptic curve cryptography implementation which can be terminated called the "ring" a "field" in one place Oct 15 comment Does AES have any fixed-points? Probability Distributions Related to Random Mappings by Bernard Harris from 1960 might be useful. Oct 15 comment Does AES have any fixed-points? How could it be "made to have fewer fixed points than expected" without introducing some exploitable structure? You had an idea in mind? Oct 15 asked An Elliptic curve cryptography implementation which can be terminated Oct 6 awarded Teacher Oct 6 awarded Editor Oct 6 revised How robust is discrete logarithm in $GF(2^n)$? Answer from Antoine Joux