# Tag Info

Accepted

• 1,779
Accepted

### How to solve this ECDLP?

We begin with the singular curve $$y^2 = x^3 + 17230x + 22699\,.$$ This curve is singular, as can be immediately determined by its $0$ discriminant. Furthermore, it has a singular point $(23796, 0)$,...
• 12.6k

• 4,455
Accepted

• 49k
Accepted

### Is the one-more discrete log problem hard in the Generic Group Model?

More recent work by Bauer et al. [BFP] claims that the proof in a previous answer is flawed (and that Coretti et al. confirmed this). However, Bauer et al. prove hardness of OMDL in the GGM. They show ...
• 271
Accepted

### How is the difficulty of discrete logarithm problem related to elliptic curve cryptography?

The discrete logarithm problem can be defined for any finite cyclic group, not just the multiplicative group modulo a prime number. The most famous instance is the problem that you describe, but it is ...
• 24.1k
Accepted

### Small error in security proof on the paper On the Multi-User Security of Short Schnorr Signatures with Preprocessing

Yes, you've raised a flaw, you can contact the authors, they will probably update their proof in the paper. But as you've noticed, it's not a big deal because $2q$ is much smaller than $\frac{3q^2}{2}$...
• 2,615
Accepted

### How to prevent the solution of a discrete logarithm problem from being found in a collision way by accident

Even if all users are aware of the $h$ values of all others, avoiding collisions is not difficult, you just need to make sure the probability will be negligible. We simply need to ensure the size of ...
• 11.8k
Accepted

### What is a cyclic group of prime order $q$ such that the DLP is hard?

Cyclic group of prime order q such that the DLP is hard A simple technique to form a cyclic group $G$ of prime order $q$ such that the underlying discrete logarithm problem (DLP) is (conjecturally) ...
• 142k
Accepted

### ElGamal with elliptic curves II

I have a concern regarding the security of the scheme -- let's suppose that there are only two possible messages, $m_0$ and $m_1$. Then, the encryption is done by multiplying, in the field, the chosen ...
• 148k
### Hardness assumption: Extracting $g^y$ from $g^x, g^{x+y}$?
No, this is (nearly) never hard. To recover $g^y$ from $g^x,g^{x+y}$ all you need is a fast (ie polynomial-time) group operation (which is a given, because otherwise you'd have a hard time to come up ...