0
$\begingroup$

Are there any known and feasible ECDSA attacks on secp256k1 which can reduce the bit security of the algorithm? For example from 256 bits of security down to 192 bits?

$\endgroup$
1
$\begingroup$

Yes. Pollard's $\rho$, a generic method to compute discrete logs, costs only about $2^{128}$ group operations for a group of order about $2^{256}$ so secp256k1 should be considered to have a ‘128-bit security level’, not a ‘256-bit security level’, against discrete logs. But a 128-bit security level is enough to thwart all adversaries—at least, the ones who don't have a quantum computer or a cryptanalytic breakthrough against secp256k1 in particular.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.