4 ms·
The top answer tries to brush off the difference in hardness assumptions as "semi-valid", and I think that's rather odd. Assumptions about hardness are pretty d
by mistercow 13y ago
The top answer tries to brush off the difference in hardness assumptions as "semi-valid", and I think that's rather odd. Assumptions about hardness are pretty damned important in cryptography, and 25 years is not really all that long for mathematicians to have been thinking about a problem.
- btilly 13y agoAs another answer points out, the mathematics of the discrete logarithm on elliptic curves is closely related to factoring, and most factoring algorithms have close analogs for the discrete logarithm, so the difference is actually not that great. However it does have a subtle consequence. We've developed some very good sieve based algorithms for factoring in recent decades that do not have obvious analogs for elliptic curves. A large part of the performance advantage that elliptic curves have is that you can get away with shorter keys. However if we developed an analog to our best factoring algorithms, then that size (and therefore performance) benefit becomes much less. If you choose key size to "be good enough that people won't be able to break this for X years" you really should assume that such analogs exist, and will be discovered within X years.
- tptacek 13y agoIn additional to the NFS algorithms, we also have the index calculus algorithms for DLP; see Joux this year.