New answers tagged

1

Then is computing $g^z\bmod p$ from $g^{z^2}\bmod p$ doable in polynomial time? If we assume that we know the order $q$ of $g$, and that it is prime, then yes, it is feasible. Then, we can treat members of this subgroup as an abstract group, where each member is $g^a$ for some $a$. Within this abstract group, we can perform multiplication with the Oracle, ...


2

This curve is thoroughly insecure. These researchers performed a computation to break discrete log on this exact curve. All small characteristic pairing-friendly curves are insecure under modern knowledge. Here is another paper breaking discrete log on a curve over $\operatorname{GF}(3^{6\cdot 509})$ -- note that this field size is much bigger than your ...


1

Let see the details of the curve; Let $K = \operatorname{GF}(3^m)$ and the curve be defined by the equation $$E(K):y^2 = x^3 + 2x + 1 \quad\quad ;-1 \equiv 2 \bmod 3$$ Yes, it is supersingular The group of rational points has order $$n = 19088056323407827075424725586944833310200239047$$ The order has two factors; $7 \cdot ...


0

This answer compleat "PaĆ­lo Ebermann" answer with a grafical view. Let's show it for 4 parties: The public values are: g: generator. Let's make it a bit more hard and assume that each of them can talk only to the next one: P_0 -> P_1 -> P_2 -> P_3 -> (cycle) P_0 -> ... Assuming no "man_in_the_middle" attack, you can do ...


1

You can assign each device its own unique certificate with a signature issued by the CA (for example, could be the manufacturer) on the certificate. So each device stores the following: its own unique certificate (its public key), its corresponding secret key, and the signature on its certificate issued by the CA. During key exchange, 2 devices would send ...


2

No, it is not possible to mix domain parameters / curves when performing key derivation. First of all, the implementations are likely to fail if they find curve identifiers. These can be single protocol specific bytes, OID's or named curves or full parameter sets, depending on the protocol. Second, it is very likely that implementations will reject the ...


3

Arnaud asked me to clarify this issue. It is true that one should use an authenticated encryption mode or encrypt-then-MAC, and the paper says that explicitly. Indeed, the explanatory text in the paper following the figure shown above (Section 5.2 of https://webee.technion.ac.il/~hugo/sigma-pdf.pdf) addresses this issue. It says: We stress that the ...


1

This is somewhat of a speculation, but I would assume that this is due to the modular way in which Sigma was designed. Namely, when Hugo Krawczyk designed Sigma, the main security property he was after was AKE security which basically consists of two things: Session key indistinguishability: the adversary shouldn't be able to distinguish real session keys ...


3

To extend kelalaka's answer, if $p$ is a safe prime (that is, if $p = 2q+1$ with $q$ prime), then: If $p \equiv 7 \pmod 8$, then the order of $g=2$ will be $q$ If $p \equiv 3 \pmod 8$, then the order of $g=2$ will be $2q$ If $p = 5$ (the only other possibility), then the order of $g=2$ is 4 (that is, $2q$)


1

A generator $g$ means that $g$ generates the group $\langle g \rangle =G$. Therefore the order of the group $ord(G)$ is equal to the order of the generator $ord(g)$. If $2$ ( or any other element) is not a generator that is $\langle 2 \rangle \neq G$ then the element $2$ forms a subgroup under the group operation. Then the order of $2$ must divide the order ...


2

This homework is about constructing a tiny finite Elliptic Curve group over a prime finite field, then showing Diffie-Hellman key exchange on that. It's needed to understand Modular arithmetic$\pmod p$, that is computation (including division) in the finite field of integers modulo $p$ (here $p=223$ but the same techniques apply for any prime $p$). The ...


Top 50 recent answers are included