Linked Questions

89 votes
10 answers
19k views

In end-to-end encryption, doesn't the server need to be trusted?

Applications like WhatsApp use end to end encryption. WhatsApp says that only the users share a specific key and no third party can view the messages. But I do not understand how the two users agree ...
AV94's user avatar
  • 1,009
8 votes
1 answer
5k views

Curve25519 vs "Million Dollar Curve"

Quoting from the Million Dollar Curve website: By using publicly verifiable randomness produced in February 2016 by many national lotteries from all around the world, we propose to generate a ...
Tim McLean's user avatar
  • 2,844
5 votes
2 answers
413 views

DDH hardness with shared public parameters

DDH is believed hard for subgroup of $ℤ^*_p$ with order $q=(p-1)/2$ when $p$ is a safe prime chosen randomly. What if $p$ isn't random: When parameters are shared, $p$ mightn't have been chosen ...
bs-'s user avatar
  • 83
3 votes
1 answer
2k views

How to generate safe primes in a verifiable way?

FIPS 186-3 (APPENDIX A: Generation and Validation of FFC Domain Parameters) specifies how to generate Finite Field Cryptography Domain parameters and how to perform an explicit domain parameter ...
adarim's user avatar
  • 31
2 votes
2 answers
2k views

What prevents the successful use of the Giant-step/Baby-step algorithm solving a discrete log problem implemented with modulo arithmetic?

Does the size of base, exponent, and modulus thwart the Giant-step/Baby-step algorithm in solving DLP using modular arithmetic or is it the use of a property of a particular prime as the modulus, or ...
JohnGalt's user avatar
  • 546
3 votes
2 answers
2k views

Are there better alternatives to CRC32 for distributed download components hash calculation?

Given a server with with download resume capabilities (byte range), we can download a file chunk by chunk. Multiple people will download different parts of the file. If a file ...
JaDogg's user avatar
  • 135
0 votes
3 answers
2k views

Key lengths of asymmetric encryption: ElGamal and ECC

Recently I have been researching asymmetric encryption algorithms for a class, I cannot find any information anywhere on the key lengths used in any of the algorithms I'm looking into (ElGamal & ...
user avatar
4 votes
1 answer
536 views

Is there a problem using Diffie-Hellman over a Mersenne prime?

Reductions modulo Mersenne primes are extremely fast, and there are several of a suitable size for modp-based Diffie-Hellman (such as $2^{2281}-1$). Is there any reason such primes are not commonly ...
Jack Lloyd's user avatar
  • 1,694
8 votes
1 answer
276 views

Solving hard problems in $\mathbb Z_{p}^{*}$ when $\mathbb p$ is close to $\mathbb 2^{n}$

Suppose, for some security parameter $n$ you choose a prime $p$ such that $p = 2^n+c$ for some relatively small $|c| < 2^m << 2^n$. I have seen such primes being called Pseudo-Mersenne Primes ...
Henrick Hellström's user avatar
1 vote
1 answer
304 views

How is the recommended NIST modulus for DLP chosen/calculated?

NIST recommends a 256-bit private key exponent for DLP with a 3072-bit modulus. From this answer it appears that the range of private key numbers is derived by calculating a prime modulus via $2⋅p$ ...
JohnGalt's user avatar
  • 546
0 votes
2 answers
131 views

Public-key generation - primes reuse

Given the following Trap-door Commitment scheme Secret key receiver: $x_B \in_u Z_q$ Public key receiver: $y_B = g^{x_B} \mod p$ Here, $p=q*k+1$ for two primes $p,q$ and $k \in Z$. And $g$ is the ...
Crypto Learner's user avatar
3 votes
0 answers
302 views

How can the Number Field Sieve attack the discrete log in $\mathbb Z_p^*$ of DSA?

The Digital Signature Algorithm (DSA) uses $L$-bit prime $p$ and $N$-bit prime $q$ with $q| p-1$, i.e., $p = r\cdot q +1$ ( Schnorr group if $r>2$ and safe prime if $r=2$). In a way, the security ...
kelalaka's user avatar
  • 48.8k
2 votes
0 answers
38 views

Choosing a prime for discrete logarithm

When choosing a prime for discrete logarithm problem it is advised not to choose a prime of form $p\equiv3\bmod4$. Are there any other restrictions such as smoothness of $p-1$?
Turbo's user avatar
  • 930