New answers tagged

1 vote

Does a list of discrete log equations reveal information?

A little notation: we'll write $\mathrm{DLOG}(h,y)$ for a magic, general purpose discrete logarithm solver that returns $z$ where $h^z=y$ in our group of order $q$ and $\mathrm{DH}(h,c,d)$ for a magic,...
user avatar
  • 10.4k
2 votes

Can one prove that a particular public key is part of an aggregated (MuSig) public key?

The MuSig (and MuSig2) key aggregation function, for the purpose of this question, is a hash function from multisets of public keys to public keys. Proving that a particular key is a member of an ...
user avatar
2 votes
Accepted

If a curve $E/\mathbb{F}_q$ is secure, what can be said about $E/\mathbb{F}_{q^2}$

If you can solve DLP in $E(\mathbb F_{p^2})$, you can solve DLP in $E(\mathbb F_p)$. The "proof" is simply that $E(\mathbb F_p)\subseteq E(\mathbb F_{p^2})$. What's more, the subgroup of $E(\...
user avatar
  • 11.1k

Top 50 recent answers are included