4 ms·

https://en.wikipedia.org/wiki/McEliece_cryptosystem https://en.wikipedia.org/wiki/McEliece_cryptosystem Yes, it's reasonably fast even at very long lengths, bu

by Vecr 3y ago

https://en.wikipedia.org/wiki/McEliece_cryptosystem https://en.wikipedia.org/wiki/McEliece_cryptosystem Yes, it's reasonably fast even at very long lengths, but the main problem is the very long lengths. Code based and not hash based though. Edit: not very fast to generate a key though. It's mostly used for non-ephemeral stuff.

amluto 3y ago
The new algorithm purports to solve LWE with certain choices of parameters. LWE is the problem of solving a linear system of equations over a finite ring, where each equation has an additive error from a certain distribution. McEliece has a public key that is a general linear code. A code is a bunch of linear equations constraining codewords, and codewords are vectors over a finite field, and decoding a code is solving those equations subject to errors from a given distribution. Sounds familiar? They’re not the same problem, and the distributions are different in rather fundamental ways (which may or may not make a difference), but they are quite related. I would not move my eggs to the McEliece basket right now. Hash-based signatures sound as safe as ever.