Timeline for Can Pohlig-Hellman encryption be done over elliptic curves?
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 20, 2019 at 4:18 | vote | accept | Meir Maor | ||
| Apr 7, 2018 at 7:00 | comment | added | Squeamish Ossifrage | @fgrieu It is very easy: Is $x^3 + 486662 x^2 + x$ a quadratic residue modulo $2^{255} - 19$ or not? | |
| Apr 7, 2018 at 6:23 | history | edited | fgrieu♦ | CC BY-SA 3.0 |
Add link, make that nice answer even so slightly nicer.
|
| Apr 7, 2018 at 6:15 | comment | added | fgrieu♦ | I'm trying to figure out how to use "Curve25519 point multiplication can be done only using the $x$ coordinate, and so we can treat arbitrary values between 0 and $2^{255}-19$ as points" to get that full interval as both plaintext and ciphertext space. It looks like, for decryption at least, we need to be able to recognize an $x$ giving a point on the curve from one giving a point on the twist. Is that easy? | |
| Apr 7, 2018 at 5:07 | comment | added | Meir Maor | So the trouble with merging two keys only comes from using the twist as well? (which I didn't follow). But that was only to solve the mapping problem, without that we would get the desired property, couldn't we just pad to ensure the point is on the curve? or would the padding cause a leak? | |
| Apr 6, 2018 at 19:00 | comment | added | poncho | @ThomasPornin: true, but a similar leakage was also inherent in the original PH scheme, which would leak whether the plaintext was a Quadratic Residue | |
| Apr 6, 2018 at 18:58 | comment | added | Thomas Pornin | Also, if plaintext is on the curve, then so is ciphertext; and if plaintext is on the twist, then so is ciphertext. Thus, one bit of information leaks. This can be an issue, depending on usage context. | |
| Apr 6, 2018 at 18:56 | history | answered | poncho | CC BY-SA 3.0 |