The elliptic curve only hash (ECOH) algorithm was submitted as a candidate for SHA-3 in the NIST hash function competition. However, it was rejected in the beginning of the competition since a second pre-image attack was found.
The ECOH is based on the MuHASH hash algorithm, that has not yet been successfully attacked. However, MuHASH is too inefficient for practical use and changes had to be made. The main difference is that where MuHASH applies a random oracle [clarification needed], ECOH applies a padding function. Assuming random oracles, finding a collision in MuHASH implies solving the discrete logarithm problem. MuHASH is thus a provably secure hash, i.e. we know that finding a collision is at least as hard as some hard known mathematical problem.
ECOH does not use random oracles and its security is not strictly directly related to the discrete logarithm problem, yet it is still based on mathematical functions. ECOH is related to the Semaev's problem of finding low degree solutions to the summation polynomial equations over binary field, called the Summation Polynomial Problem. An efficient algorithm to solve this problem has not been given so far. Although the problem was not proven to be NP-hard, it is assumed that such an algorithm does not exist. Under certain assumptions, finding a collision in ECOH may be also viewed as an instance of the subset sum problem. Besides solving the Summation Polynomial Problem, there exists another way how to find second pre-images and thus collisions, Wagner's generalized birthday attack.
ECOH is a good example of hash function that is based on mathematical functions (with the provable security approach) rather than on classical ad hoc mixing of bits to obtain the hash.
and 23 Related for: Elliptic curve only hash information
The ellipticcurveonlyhash (ECOH) algorithm was submitted as a candidate for SHA-3 in the NIST hash function competition. However, it was rejected in...
cryptography, the EllipticCurve Digital Signature Algorithm (ECDSA) offers a variant of the Digital Signature Algorithm (DSA) which uses elliptic-curve cryptography...
Ellipticcurve scalar multiplication is the operation of successively adding a point along an ellipticcurve to itself repeatedly. It is used in elliptic...
factoring n {\displaystyle n} ). MuHASH ECOH - EllipticCurveOnlyhash function - based on the concept of Ellipticcurves, Subset Sum Problem and summation...
for verification, and signatures are elements of an ellipticcurve group. Working in an ellipticcurve group provides some defense against index calculus...
Hyperelliptic curve cryptography is similar to ellipticcurve cryptography (ECC) insofar as the Jacobian of a hyperelliptic curve is an abelian group...
the conversion from key length to a security level estimate.: §7.5 Ellipticcurve cryptography requires shorter keys, so the recommendations for 128-bit...
algorithms, because no such algorithm is known to satisfy this property; ellipticcurve cryptography comes the closest with an effective security of roughly...
Encryption Standard with 256 bit keys Elliptic-curve Diffie–Hellman and EllipticCurve Digital Signature Algorithm with curve P-384 SHA-2 with 384 bits, Diffie–Hellman...
{\displaystyle \mathbb {F} _{q}} over odd prime power q {\displaystyle q} ; of ellipticcurve E {\displaystyle E} over F q {\displaystyle \mathbb {F} _{q}} whose...
the private key x {\displaystyle x} . This issue affects both DSA and EllipticCurve Digital Signature Algorithm (ECDSA) – in December 2010, the group fail0verflow...
by hashing this intermediate result). The following is pseudocode for the calculations performed by the client and server using an ellipticcurve based...
only in DEM construction w/SEC1 parameters ECIES – EllipticCurve Integrated Encryption System, Certicom Corporation ECIES-KEM ECDH – EllipticCurve Diffie-Hellman...
provider that implements CNG is housed in Bcrypt.dll. CNG also supports ellipticcurve cryptography which, because it uses shorter keys for the same expected...
description of "SRP5", a variant replacing the discrete logarithm with an ellipticcurve contributed by Yongge Wang in 2001. It also describes SRP-3 as found...
discrete log on the cyclic group of order p {\displaystyle p} on ellipticcurves to Hash-Collision. If r = 2 {\displaystyle r=2} , then we get x P + y Q...
established, a new hash ratchet gets initialized. As cryptographic primitives, the Double Ratchet Algorithm uses for the DH ratchet Ellipticcurve Diffie-Hellman...
be an ellipticcurve over a finite field, as is common in elliptic-curve cryptography. Then, the division assumption is called the ellipticcurve discrete...
Global Information