# Tag Info

Accepted

Accepted

### How to solve this ECDLP?

We begin with the singular curve $$y^2 = x^3 + 17230x + 22699\,.$$ This curve is singular, as can be immediately determined by its $0$ discriminant. Furthermore, it has a singular point $(23796, 0)$,...

Accepted

### Why do the discriminant and primality of the group order of an elliptic curve affect security?

$y^2 = x^3 + ax + b\bmod p$ is the Short Weierstrass equation. The theory behind it is here Using Bezout’s Theorem, it can be shown that every irreducible cubic has a flex (a point where the tangent ...
Accepted

### Do I understand (below) why Q = dP is easy while finding d is hard

Computing $d$ given $P$ and $Q$, with $Q = dP$ is known as the "elliptic curve discrete logarithm problem" and is considered to be infeasible under some hypothesis. The security of Elliptic Curves ...
Accepted

### Using Pedersen commitment for a vector

Yes, you got the scheme essentially right - except that the group cannot be $\mathbb{Z}_p^*$, as the latter does not have prime order. It can however be many other things - like the multiplicative ...
Accepted

### Is the one-more discrete log problem hard in the Generic Group Model?

More recent work by Bauer et al. [BFP] claims that the proof in a previous answer is flawed (and that Coretti et al. confirmed this). However, Bauer et al. prove hardness of OMDL in the GGM. They show ...
Accepted

### Small error in security proof on the paper On the Multi-User Security of Short Schnorr Signatures with Preprocessing

Yes, you've raised a flaw, you can contact the authors, they will probably update their proof in the paper. But as you've noticed, it's not a big deal because $2q$ is much smaller than $\frac{3q^2}{2}$...
Accepted

### How to prevent the solution of a discrete logarithm problem from being found in a collision way by accident

Even if all users are aware of the $h$ values of all others, avoiding collisions is not difficult, you just need to make sure the probability will be negligible. We simply need to ensure the size of ...
Accepted

Accepted

### What is a cyclic group of prime order $q$ such that the DLP is hard?

Cyclic group of prime order q such that the DLP is hard A simple technique to form a cyclic group $G$ of prime order $q$ such that the underlying discrete logarithm problem (DLP) is (conjecturally) ...
I have a concern regarding the security of the scheme -- let's suppose that there are only two possible messages, $m_0$ and $m_1$. Then, the encryption is done by multiplying, in the field, the chosen ...
### Hardness assumption: Extracting $g^y$ from $g^x, g^{x+y}$?
No, this is (nearly) never hard. To recover $g^y$ from $g^x,g^{x+y}$ all you need is a fast (ie polynomial-time) group operation (which is a given, because otherwise you'd have a hard time to come up ...