10 votes
Accepted

"Cropping" the resulting shared secret from ECDH

You should apply the hash. If one follows the specification there are only roughly $2^{251}$ possible shared secret values and there is a simple test to see if a putative 32 bytes represents a ...
  • 14.6k
3 votes
Accepted

Do we always choose a generator of prime order for ECDH? If yes, then why?

In broad generality we can solve the discrete logarithm $nG=R$ problem for a point of order $m$ by solving for $n\pmod q$ for every prime power that divides $m$ and combining them with the Chinese ...
  • 14.6k
3 votes
Accepted

Trying to understand the 2nd subgroup in the Weil Pairing used for the MOV attack

Firstly, I think that some terminology may be causing some problems. The Frobenius automorphism in a field of characteristic $p$ is the map $x\mapsto x^p$ and respects all of the field operations and ...
  • 14.6k
2 votes
Accepted

The Uniqueness of Baby-step-Giant-step Algorithm on DLP

It's unique modulo the multiplicative order of $a$ modulo $N$. Suppose that there were two solutions: $$a^{n_1}\equiv ba^{-m_1k}\mod N;\quad\quad a^{n_1}\equiv ba^{-m_2k}\mod N$$ this would tells us ...
  • 14.6k
2 votes

"Cropping" the resulting shared secret from ECDH

You should hash your secret. (In fact, you should not just hash it, but process it with a key derivation function such as HKDF that has been specifically designed for this purpose.) Doing so ...
1 vote

Proof of Pohlig-Hellman Algorithm on Elliptic Curve

This is the case of the chinese remainder theorem (CRT) for the relatively prime moduli $m_i=p_i^{e_i}.$ They have decomposed the group order $p-1$ into $p-1=m=m_1 m_2 \cdots m_k.$ There are many ...
  • 17.7k
1 vote

Small subgroup confinement attack on Diffie-Hellman: shared key is 1

Diffie Hellman is vulnerable to an active man in the middle (MITM) attack, and this is one version of such an attack, since Eve is modifying the transmitted values and forwarding them on. See for ...
  • 17.7k

Only top scored, non community-wiki answers of a minimum length are eligible