| ▲ | edelbitter 6 hours ago |
| >they can be hit randomly with 2^30 tries More precisely: not very random tries. |
|
| ▲ | mswphd 5 hours ago | parent [-] |
| unless your guess is that the hypothetical ECC weakness is somehow correlated with the LCG structure, the draws from the LCG are as good as random. It is possible such a correlation could occur. but it would be much weirder than this being the result of a random search, which would already be very weird. |
| |
| ▲ | edelbitter 4 hours ago | parent [-] | | I find it slightly less weird because I see potential for indirect attacks on the not-quite-so-ECC parts of actual implementations. Wherever a network client can ask many times for each of the different, but somehow not entirely uncorrelated curves, it might be able to expose previously not deemed critical side channels. Following in the general direction of the discoveries that so far resulted in IV and padding determinism/randomness being considered as important as the "actual crypto" itself. In that case the structures that would need to somehow interact would not be ECC and LCG, but merely LCG and key derivation.. |
|