New answers tagged

1

Here's a summary of the situation: Q1. The primary reason some key-exchange systems cannot be used with static keys are chosen-ciphertext attacks. The general theme is that malicious clients send manipulated key-exchange messages to a server, which allows them to extract partial information about the server's static secret key with each such query. Perhaps ...


2

This is a standard computation in number theory. The idea behind it is that the matrix you have written down is a basis of the lattice as an $\mathcal{O}_K$-module, but to find the volume you first find a $\mathbb{Z}$-basis for the lattice, and then do "standard" computations with this. If $B$ is a $\mathbb{Z}$-basis of $\mathcal{O}_K$, then one ...


2

The theorem of the dual isogeny states that for every isogeny $ψ:E→E'$ of degree n there exists an associated isogeny $\hat{ψ}:E'→E$ of the same degree such that $ψ∘\hat{ψ}$ and $\hat{ψ}∘ψ$ are equal to multiplication by $n$ on the respective curves. See Silverman, The Arithmetic of Elliptic Curves, Chapter III. On top of that, there are efficient algorithms ...


3

TL;DR: Yes, it is. While it is weakened by quantum computers because of Grover's algorithm, it still has enough security margin to be considered "quantum safe". Does Grover's Search Algorithm weaken the XSalsa20 / XChacha20 stream ciphers? Yes, it does, but it only provides a quadratic speed-up compared to classical bruteforce, since both ...


3

If you look at the GGH paper, they explicitly say that they reduce to a random instance of CVP. At the end of the paragraph on CVP in Section 2.1, it explicitly says: "As we explain in Section 3, an attack against our trapdoor function amounts to finding an exact solution for some random instance of CVP." Peikert is referring to worst-case ...


Top 50 recent answers are included