New answers tagged discrete-logarithm
1
The point is that even though $p - 1 = tq$ may be large, the discrete log security of $(\mathbb Z/p\mathbb Z)^\times$ against Pohlig–Hellman depends on the size of $q$, not on the (possibly much larger) size of $p$ or $tq$. If $q$ is the largest prime factor, then the cost of computing discrete logs modulo $p$ is essentially at most the cost of computing ...
2
$G = [b^{-1} \bmod q]B$ where $q$ is the order of the group generated by $G$, assuming $\gcd(b, q) = 1$.
2
Here is what I believe Sagemath is doing:
Given the problem of finding $x$ s.t. $xP = Q$, one step is computing $x' = x \bmod 5888291787538299579505114081452341011$; it does this by computing $P' = (2\cdot 3 \cdot 5)P$, and $Q' = (2 \cdot 3 \cdot 5)Q$, and trying to solve $x'P' = Q'$
As the order of $P'$ is circa $2^{122}$, we would normally expect this ...
Top 50 recent answers are included
