6
The discrete logarithm problem can be defined for any finite cyclic group, not just the multiplicative group modulo a prime number. The most famous instance is the problem that you describe, but it is not the only one.
Groups can be written with multiplicative notation (as with the multiplicative group modulo $p$), so that the group operation is written as $*...
5
NSA removed EC-256 and SHA-256 from CNSA recently--should we be alarmed by this?
No.
There is one overwhelming reason why, as stated in the document:
The cryptographic systems that NSA produces, certifies, and supports often have very long lifecycles. NSA has to produce requirements today for systems that will be used for many decades in the future, and ...
4
The private key data is encoded in ASN.1, so you need to decode that to get the various fields out. openssl asn1parse can do this, but by default it'll parse the "EC PARAMETERS" section of the file (since that comes before the "EC PRIVATE KEY" section), so you need to strip that off first. You can do that with sed, and then pipe the ...
4
The answer really depends on the Cryptographic Elliptic Curves that we know!
Prime order Cryptographic EC: Since the order of the subgroup generated by an element must divide the order, then there is the full group and the group of $\mathcal{O}$ of order $1$ ( NIST curves has prime order).
Cryptographic EC with a small factor: In Cryptography the curves ...
3
There is already good scheme for this, Elliptic Curve Integrated Encryption Scheme (ECIES);
Once you exchanged the keys with ECDH, then you can use a KDF to derive any key length, HKDF is fine.
ECIES also authenticates the ciphertext as Encrypted-then-MAC. In order to use MAC, you need another key. You can use HKDF to derive many keys by providing different ...
3
In general no. For some specific instances, (if $\mathbb{G}$ is of order $q_1 q_2$ and $g$ of order $q_1$ with $q_1, q_2$ two big primes) the problem is even considered enough hard to be used as a cryptographic assumption called the subgroup decision assumption.
You can look more details in this paper:
https://crypto.stanford.edu/~dabo/papers/2dnf.pdf
But it ...
3
For any finite field $\mathbb{F}_q$ of odd characteristic, there is a unique nontrivial morphism $\mathbb{F}_q^*\to\{-1,1\}$: it takes the value $1$ on squares and $-1$ on nonsquares (and it is usually extended to $0$ on $0$). This is the Legendre symbol when $q$ is prime, but it's called the quadratic character in general.
2
Theoretical answer here
How to determine the order of an elliptic curve group from its parameters?
Schoof's algorithm, René Schoof, 1985 with complexity $\mathcal{O}(\log^8 q)$
Schoof–Elkies–Atkin algorithm (SEA) with complexity $\mathcal{O}(\log^6 q)$
Practically, one can use SageMath to find it;
a = 1
b = ...
2
I want a hash function as $H_4: G_2\to \{0, 1\}^n$ for some length $n$ i.e., mapping from group element to a binary string of length $n$. In this case the group $G_2$ consists of points on an elliptic curve.
If $r\in G_2$, we can define $H_4(r)$ as $\operatorname{SHAKE256}(R,n)$ where $R$ is a unique representation of $r$ as bitstring, and $\operatorname{...
2
There is no substitute for modular multiplication in the question's cryptosystems. Some languages like Python make that easy for educational purposes, only.
In RSA and DSA, and to a lesser degree ECC crypto on secp256k1 or secp256r1, one needs to compute $b^e\bmod m$ for large $e$. The fastest algorithms (e.g. sliding window exponentiation) perform about $\...
2
FE2OSP and OS2FEP convert between finite field element (such as the X or Y coordinate of a point on an Elliptic Curve) and octet string (equivalently bytestring). They were originally defined by IEEE Std 1363-2000 and revised by IEEE P1363a-2004.
Finite field are sets with $q$ elements noted $\operatorname{GF}(q)$ or $\mathbb F_q$, where $q$ is a large ...
2
There do exist proofs of the associativity of the elliptic curve group law based on the geometric definition (together with some results in projective geometry), but they are definitely non trivial. Cassels' little book on elliptic curves contains such a proof (and it's a nice introduction to the theory of elliptic curves in general, so I would definitely ...
1
A group by definition has only one operation. You would need at least a semiring with the new “multiplication” operation also being compatible with the Elliptic Curve addition.
To the best of my knowledge no such meaningful definition exists.
1
The impact on security from 1 and 2 can be considered as not significant. Say you have 256 Bit security, that implies $2^{256}$ different keys to chose from. If you know the key is odd, this is reduced to $2^{255}$ different keys. For 2 it is similar.
Knowing how many ones and zeros there are can be considered as a significant risk. Let's assume you have a ...
1
If the private key is available: see this answer.
If it's not (which appear to be the hypothesis): forget about it using the computing power available. The best known attack (Pollard's rho) would require in the order of $2^{129}$ point additions. It the machine could perform these at a rate of $2^{36}$ per second (which is wildly optimistic), the division ...
Only top voted, non community-wiki answers of a minimum length are eligible