Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

# Tag Info

The answer indicates that the order of all points on the curve over the finite field $2^{255} - 19$ is 8 times the size of the subgroup formed by $G$. Obviously, this is incorrect, and Samuel never claims it. This curve defines a group with $8q$ elements (with $q = 2^{252} + 27742317777372353535851937790883648493$ prime), and the factorization of $8q = 2 \... 1 Any finite setting with addition that distributes over multiplication where neither operation loses information—except multiplying by zero—necessarily has a prime characteristic, which is the number of times you can add 1 to itself before you get back 0. Further, the size of any finite field is some power of its characteristic, so the size of any finite ... 1 The problem 'given a group and the elements$g, g^x, g^y$, find$g^{xy}$' is known as the Diffie-Hellman problem (or, more precisely, the computational Diffie-Hellman problem). As for how difficult it is, well, we typically work with groups where this is difficult (by design; we often need to assume that the DH problem is hard). As for how it might be ... 1 The key point in RSA is the fact that inversion in modulo$|G|$is hard, of course other groups are a priori okay to build a secure encryption scheme. For example$U_{pqr}$, with$p, q, r$large primes seems to be okay. But it will be probably less efficient (keys and ciphertexts will be probably larger for the same level of security). Of course, it is not ... 1 A GUESS: the author meant that three numbers$a,b,c \in \mathbb{Z}$such that $$g^a\cdot h_1^n \cdot h_2^c =1$$ are infeasible to compute. While the term "orthogonal" seems inappropriate, This is a fairly standard assumption. 1 To the best of my knowledge, this hard assumption is introduced by Boneh and Boyen in this paper. But I don't think so the assumption that you mention being hard, because$c=0$is a simple solution for it. Then the element$g^{\frac{1}{s}}$should not publish. Also, this assumption is not bilinear because the challenge is an element in the cyclic group of$...