Skip to main content

All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
141 views

State of the art on attempts to solve the elliptic curve discrete logarithm problem through transfering the problem to a weaker curve

Let an elliptic curve $E$, and 2 points on such curve $P$ and $O$ the methods I’m talking about consist in creating a weaker elliptic curve $F$ and mapping $P$ and $O$ to $F$ while successfully ...
user2284570's user avatar
1 vote
0 answers
212 views

Generate algorithmically an elliptic curve with its exact class group structure?

Is it possible to generate an elliptic curve $E$ (randomly), together with knowing its class group $\mathrm{Cl}(\mathcal{O})$ structure? where $\mathcal{O}$ is its endomorphism rings $\mathsf{End}(E)$ ...
Taylor Huang's user avatar
3 votes
1 answer
137 views

Subexponential algorithms that apply only one of factoring and discrete logarithm?

Shor (quantum polynomial), Number Field Sieve (subexponential), Pollard rho (square root) all have both factoring and discrete logarithm over $\mathbb F_p^*$ variants. What are the subexponential ...
Turbo's user avatar
  • 13.9k
4 votes
1 answer
288 views

Is total degree version and $x,y$ degree version of Coppersmith's theorem correct?

The notes here https://web.eecs.umich.edu/~cpeikert/lic13/lec04.pdf have the note 'Small decryption exponent $d$: so far the best known attack recovers $d$ if it is less than $N^{.292}$. This uses a ...
Turbo's user avatar
  • 13.9k
5 votes
0 answers
317 views

Elliptic curve sequences needed for universal forgery

Elliptic Curve Digital Signature Algorithm (ECDSA) admits universal forgery (UF) if the Attacker can solve the equation $$z=\frac{f_{k-1}(x,y)f_{k+1}(x,y)}{f_{k}(x,y)^2},$$ where $k$ is unknown, $f_{k}...
Alexey Ustinov's user avatar