Elliptic curves discrete log in O(2^(b/(log(b)^(1/4))) (asymptotically, probably not faster for cryptographic-sized curves): github.com/bochum-crypto/subexponential-ecdl/blob…
20 likes · 4 reposts
turns out the Elliptic-Curve Discrete-Logarithm-Problem can probably be solved in just very very slightly under exponential time: github.com/bochum-crypto/subexponential-ecdl/blob…
imo won't mean anything relevant before a cryptographically relevant quantum […]
The subexponential ECDLP algorithm is another oracle-versus-code gap.
It needs a compact description of valid points and the group operation, but nothing else specific to elliptic curves.
“Generic” in spirit, yet outside the generic group model! 1/2
github.com/bochum-crypto/subexponential-ecdl/blob…
38 likes · 8 reposts · 2,370 views
github.com/bochum-crypto/subexponential-ecdl/blob… - amazing (and written by humans - if you can call @kiltz.bsky.social a human). it's quite galactic, for now
4 likes · 2 reposts
OpenAI’s Boolean tensor contraction result, ECDLP on b-bit prime-order curves is solvable in expected 2^{O(b/(\log b)^{1/4})} time (vs. generic 2^{b/2}).
Purely asymptotic, no impact on current curves.
github.com/bochum-crypto/subexponential-ecdl/blob…
2 likes · 73 views
For the record, this is a very non-serious joke based on: github.com/bochum-crypto/subexponential-ecdl/blob…
15 likes · 1 repost · 1,445 views
Elliptic curves are not generic. Long time coming. Congrats @crypto_theory and collaborators github.com/bochum-crypto/subexponential-ecdl/blob…
What I said a week ago: It wouldn't surprise me in the least bit if there were a better factoring or discrete logarithm alg. For factoring: what is the chance that exp(n^1/3) is the right bound? who are we kidding? For discrete log over finite fields: better algorithms over Z_p have followed a decade or so behind those for small-char fields (Coppersmith'84 vs NFS a decade-ish later). Joux gave a quasi-poly alg over small-char fields in the 2010s. Porting to finite fields long overdue. For discrete log over elliptic curves: assuming that elliptic curve groups were "generic" is particularly preposterous given the rich structure they have. All of these ripe for disruption. Unstructured LPN would take me by real surprise, also unstructured LWE to a slightly lesser extent.
100 likes · 22 reposts · 7,252 views
A Subexponential Time Algorithm for Elliptic Curve Discrete Logarithm
7 points · 1 comment
A Subexponential Time Algorithm for Elliptic Curve Discrete Logarithm Problem
32 points · 1 comment
Subexponential algorithm for breaking elliptic curve discrete logarithm? If true It would challenge one of the central assumptions behind elliptic-curve cryptography (ECC), which protects cryptocurrency wallets, digital signatures and secure communications. github.com/bochum-crypto/subexponential-ecdl/blob…
4 likes · 3 reposts
Mentions
Elliptic curves discrete log in O(2^(b/(log(b)^(1/4))) (asymptotically, probably not faster for cryptographic-sized curves): github.com/bochum-crypto/subexponential-ecdl/blob…
turns out the Elliptic-Curve Discrete-Logarithm-Problem can probably be solved in just very very slightly under exponential time: github.com/bochum-crypto/subexponential-ecdl/blob… imo won't mean anything relevant before a cryptographically relevant quantum […]
The subexponential ECDLP algorithm is another oracle-versus-code gap. It needs a compact description of valid points and the group operation, but nothing else specific to elliptic curves. “Generic” in spirit, yet outside the generic group model! 1/2 github.com/bochum-crypto/subexponential-ecdl/blob…
github.com/bochum-crypto/subexponential-ecdl/blob… - amazing (and written by humans - if you can call @kiltz.bsky.social a human). it's quite galactic, for now
OpenAI’s Boolean tensor contraction result, ECDLP on b-bit prime-order curves is solvable in expected 2^{O(b/(\log b)^{1/4})} time (vs. generic 2^{b/2}). Purely asymptotic, no impact on current curves. github.com/bochum-crypto/subexponential-ecdl/blob…
For the record, this is a very non-serious joke based on: github.com/bochum-crypto/subexponential-ecdl/blob…
Elliptic curves are not generic. Long time coming. Congrats @crypto_theory and collaborators github.com/bochum-crypto/subexponential-ecdl/blob… What I said a week ago: It wouldn't surprise me in the least bit if there were a better factoring or discrete logarithm alg. For factoring: what is the chance that exp(n^1/3) is the right bound? who are we kidding? For discrete log over finite fields: better algorithms over Z_p have followed a decade or so behind those for small-char fields (Coppersmith'84 vs NFS a decade-ish later). Joux gave a quasi-poly alg over small-char fields in the 2010s. Porting to finite fields long overdue. For discrete log over elliptic curves: assuming that elliptic curve groups were "generic" is particularly preposterous given the rich structure they have. All of these ripe for disruption. Unstructured LPN would take me by real surprise, also unstructured LWE to a slightly lesser extent.
A Subexponential Time Algorithm for Elliptic Curve Discrete Logarithm
A Subexponential Time Algorithm for Elliptic Curve Discrete Logarithm Problem
Subexponential algorithm for breaking elliptic curve discrete logarithm? If true It would challenge one of the central assumptions behind elliptic-curve cryptography (ECC), which protects cryptocurrency wallets, digital signatures and secure communications. github.com/bochum-crypto/subexponential-ecdl/blob…