Bitcoin Forum
May 10, 2024, 10:13:17 PM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: Why does 256-bit ECC offers equivalent security of 128-bit symmetric encryption?  (Read 823 times)
BusyBeaverHP (OP)
Full Member
***
Offline Offline

Activity: 209
Merit: 100


View Profile
March 31, 2015, 01:33:00 AM
 #1

I've been studying ECDSA from Royal Fork for a few weeks now, and I think I'm starting to get it. Some question remains.

Why is it that 256-bits of ECC only offers equivalent security of say, 128-bit AES?

Is it because of the birthday paradox? Or is it something else?
"The nature of Bitcoin is such that once version 0.1 was released, the core design was set in stone for the rest of its lifetime." -- Satoshi
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
1715379197
Hero Member
*
Offline Offline

Posts: 1715379197

View Profile Personal Message (Offline)

Ignore
1715379197
Reply with quote  #2

1715379197
Report to moderator
1715379197
Hero Member
*
Offline Offline

Posts: 1715379197

View Profile Personal Message (Offline)

Ignore
1715379197
Reply with quote  #2

1715379197
Report to moderator
hhanh00
Sr. Member
****
Offline Offline

Activity: 467
Merit: 266


View Profile
March 31, 2015, 01:53:04 AM
 #2

It's because the best algo that solves the EC discrete log problem is in O(sqrt(N)).

DeathAndTaxes
Donator
Legendary
*
Offline Offline

Activity: 1218
Merit: 1079


Gerald Davis


View Profile
March 31, 2015, 02:08:31 AM
Last edit: March 31, 2015, 02:27:51 AM by DeathAndTaxes
 #3

Everything is compared to symmetric encryption because baring a flaw in the algorithm there is no method to find a symmetric encryption key faster than O(n) steps.  All other algorithms have solutions than can be found in less steps.

ECC is "secure" because the Elliptic Curve Discrete Logarithm Problem is infeasible for large sets however there are solutions to the ECDLP which are faster than O(n) but the fastest (such as pollard's rho) is still O(n1/2).  Since the solution can be found in faster than O(n) steps it requires a larger key for an equivalent level of security.

Keep in mind that the ratio of relationship of O(n1/2) between key size and bit strength only applies to ECC and only because there no faster solution is currently known.   This can change over time.  The strength of a given RSA key has declined over time as faster solutions to the integer factorization problem have been found.  Today to achieve '128 bit security' requires a 3,072 bit RSA key.
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!