# Tag Info

1

If I understand it right, you want a way to prove, given a list $\{A, B, C, D, \cdots\}$ of public keys, that some given key $K$ is "the tag" corresponding to a pair of key from this list, without revealing which one. Let me call this a "valid tag". For simplicity, suppose that $K$ is the tag of Alice and Bob. Either Alice or Bob can ...

0

I never know the practical case for ECDH to be used for a group of key pairs like that. There are formal ways to split secrete for a group of people more than 2. e.g. https://en.wikipedia.org/wiki/Secret_sharing AFAIK, ECDH should be used to create shared secrete between exactly 2 parties. From the computational DH assumption, K is meaningless for the other ...

1

Client derives private key from the password, using a strong hash algorithm Server has the client's public key stored So the server has a hash of the password. This defeats your goal that the server wouldn't have a password hash. All you've done is making your own password hashing function. A password hash is any value derived deterministically from the ...

2

Assuming that by “primary order” you mean “prime order”, this is called the static Diffie-Hellman problem, and there are some known attacks against it. The main ones to consider off the top of my head would be: the Cheon DLP with auxiliary inputs attack: there are several variants, but for example if the prime order $p$ of your elliptic curves satisfies ...

3

If I understand your quantifies (for any given irreducible $f(x)$, there does not exist such an algorithm), then it’s a stronger assumption and one that is unlikely to be true as $n$ grows. First, note that if we write $x_i$ for $g^{s_i}$ then the degree (at most) $n$ polynomial $\sum c_is^i$ gives $$g^{\sum c_is^i}=\prod x_i^{c_i}$$ as easily calculable. ...

0

So this is how I solved my problem : My keys in strings : public A : co2D0pNxZJIeQ4RZlCRJYBDzNXSLluETdztid0M+HGzN1uGJ4JWZsenjWgRrmkLh3yqHQqzOBMl/wHVH97A6+g== private A : TXxii5Ka8LMvuc9arHu63qTmNKxGlgti+wpR3YhBGew= public B : nUblC+OKdl94iBiWk0941wmYBiMt7C90CjOJPI2BPr8K7xGuC1XsR5DtwFCoM3Iew2BjBG+5SqrYwAPTJF7gdA== private B : sm6V7+hChvkFSeLNoR+...

1

Coppersmith, Odlyzko, and Schroeppel originally set $B = L[1/2, 1/2]$ for both the linear and Gaussian sieves. Pomerance set $B = L[1/2, 1/\sqrt{2}]$ for a rigorous index calculus variant using the elliptic curve method as the smoothness testing method. These bounds are only asymptotic; the bound in an implementation will usually be adjusted to account for ...

Top 50 recent answers are included