# Tag Info

Accepted

### Why using q = (p - 1)/2 for discrete log Diffie-Hellman scalar operations and not p?

Diffie-Hellman in the multiplicative group modulo $p$ performs all operations modulo $p$: Alice chooses random secret $u$, sends $U=g^u\bmod p$ Bob chooses random secret $v$, sends $V=g^v\bmod p$ ...
• 143k

### Why using q = (p - 1)/2 for discrete log Diffie-Hellman scalar operations and not p?

Why Diffie-Hellman uses $\bmod q$ for scalar operations, where $q=(p-1)/2$ and for elements' operation it uses $\bmod p$ Other than the fact that DH doesn't actually do operations on scalars (it ...
• 149k

### Is MOV attack against ECDLP fundamentally impossible?

Actually, the multiplicative group of the extension field $GF(p^k)$ does have order $p^k-1$. In particular, for any $m$ that does not have $p$ as a factor, there will exist a $k$ such that $GF(p^k)$ ...
• 149k

### RSA like problem with unknown e and d

If I understand correctly, it's a DLP (Discrete Logarithm Problem) to find that value. I may make it somewhat easier if I try to solve the DLP for p and q respectively, but for ~500 bits, it's still a ...
• 149k
Accepted

### Given a random point on a curve defined over a prime field, is it possible to compute 2 different scalar that will lead to the same result?

Consider an Edwards curve with equation $x^2+y^2=d\,x^2y^2$ in the field $\mathbb F_p$, with prime $p\bmod 4=1$, integer $d$ with $d^{(p-1)/2}\bmod p=p-1$. The group law is \bigl(x_1,y_1\bigr)+\bigl(...
• 143k
does 2 scalars $S1$ $S2$ exist such as $packed(S1\cdot P)= packed(S2\cdot P$) $S1 = S2$ is equivalent to the statement that $S1 - S2$ is an integer multiple of the order of $P$. $S1 \ne S2$ If ...