New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Tag Info

Accepted

What is largest prime factor in Diffie-Hellman?

How to determine if the largest prime factor of $p-1$ is in fact large? Most often, it is not determined from $p$ that $p-1$ has a large prime factor. Rather, a large prime factor $q$ is chosen, ...
• 142k
Accepted

Is it insecure to sign the value 0 with ElGamal?

Is it insecure to sign the plaintext 0 with ElGamal signature algorithm? It is insecure to verify the plaintext that hashes to 0 with the ElGamal signature algorithm, because anyone can generate such ...
• 148k

Recovering private key from Secp256k1 signatures

In ECDSA, each signature has its own ephemeral key $k$. If $k$ is generated properly, then no amount of signatures will help you recover the private key. "Proper" generation here means ...
• 87.1k

primitive root of a very big prime number (Elgamal DS)

When considering a big prime $p$, the group of invertible integers modulo $p$ are all integers from $1$ to $p-1$. There are $p-1$ of them. The order of an integer $g$ modulo $p$ is the smallest ...
• 87.1k
Accepted

RSA Digital Signature vs Elgamal Digital Signature

TL;DR: The main reasons to prefer RSA over ElGamal signatures boild down to speed, signature size, standardization, understandability of the method and historical establishment as the result of a lot ...
• 46.1k

What is largest prime factor in Diffie-Hellman?

My question is the following: how to determine if the largest prime factor of $p-1$ is in fact large? Yes, showing that $p-1$ is not smooth (terminology for "has a large prime factor") for random ...
• 148k

Is it possible to combine digital signature to provide message addition?

No, in textbook RSA signature with $\operatorname{Sig}(x)=x^d\bmod N$, there is no method to deduce $\operatorname{Sig}(15)$ from $\operatorname{Sig}(5)$ and $\operatorname{Sig}(10)$. It is possible ...
• 142k
Accepted

Why is the El Gamal commitment scheme information theoretically binding?

How is this impossible to be found? Since generators are cyclic, it should be possible to find an $r\neq r'$ that with $g^r = g^{r'}$, or am I overseeing something? Yes, you're probably thinking the ...
• 12.7k

How does hash function in Elgamal signature scheme prevent existential forgery attack?

Existential forgery attacks allow the attacker to choose (or calculate) a signature, and then the message is derived from this signature (and the public key) using the existential forgery attack ...
Accepted

Attacks on schemes based on elliptic curves when the transmitted points are not on the curve

In this state we have well known attack that is called invalid-curve attack. Let $E:y^2=x^3+ax+b$ and $E':y^2=x^3+ax+b'$ be two elliptic curves with reduced Weierstrass form. $E'$ is called an ...
• 2,313
Accepted

What can I do if I get private key of signing algorithm in Digital signiture

When talking about digital signatures, the private key is what proves the authenticity of the signature, precisely because it is private. The use case proceeds like this: I choose a private and ...
• 186

• 4,178

Using ElGamal instead of RSA in FDH

This had been reiterated many times before in this community. Digital signature is NOT encrypt with private key. RSA is the only bijection we know where both the public and the private operations are ...
• 9,409

Base Point on elliptic curve

The "base point" is conventional. When using El Gamal or similar algorithms with an elliptic curve, you want to work inside a group with a prime order (either the complete curve has a prime order, or ...
• 87.1k
Accepted

How to apply Pollard's Rho Method on elliptic curves to solve discrete logarithm problem in finite field?

In the question you said that $a^x\equiv b\ (mod\ p)$ and $P,Q\in E(\mathbb{F}_p)$. In general case, the number of elliptic curve points $\#E(\mathbb{F}_p)$ is not equal to $p$. So these two groups ...
• 2,313
Accepted

• 13.3k
1 vote

Find private key from knowing random exponents are an arithmetic series

We don't know if $s_1r_2−s_2r_1$ is coprime to $p−1$ so we can't immediately get $u$, but is it true that it would be coprime? I don't believe coprimality is guarranteed, however we don't need it. ...
• 148k

Only top scored, non community-wiki answers of a minimum length are eligible