[HN Gopher] Schnorr confirms paper is his, claims it "destroys R...
___________________________________________________________________
Schnorr confirms paper is his, claims it "destroys RSA
cryptosystem"
Author : EthanHeilman
Score : 206 points
Date : 2021-03-03 15:41 UTC (7 hours ago)
(HTM) web link (twitter.com)
(TXT) w3m dump (twitter.com)
| stefantalpalaru wrote:
| The proof of the pudding is in factoring these numbers and
| collecting the prize money:
| https://en.wikipedia.org/wiki/RSA_Factoring_Challenge
| bcaa7f3a8bbc wrote:
| If my understanding is correct, Schnorr converts the integer
| factorization problem to lattice problems: SVP and CVP. Then he
| claims he had an efficient algorithm to solve this particular
| instance of SVP and CVP, thus RSA is destroyed. But, the hardness
| assumption of SVP and CVP in general is the very foundation that
| another branch of public-key cryptosystems - lattice-based
| cryptography - is built upon. So, if Schnorr's claims are true
| (uncertain and still to be determined), I can't stop to think
| about its impact on lattice cryptosystems: Can we use the same
| technique to attack them? I think it's a more important question
| than RSA [0] - lattice cryptosystems are the candidate for Post-
| Quantum Cryptography, meant to replace all of the existing
| public-key cryptosystems of today (e.g. RSA and ECC). Even if the
| attack is purely theoretical, if it can solve other instances of
| SVP and CVP, it'll certainly affect the security assessment of
| lattice-based PQC (e.g. NTRU, also LWE).
|
| Of course, I don't know what I'm talking about.
|
| [0] Factorization had a history of speedups, both theoretical and
| practical. It doesn't really affect the practical security but
| always comes at a cost of either decreasing confidence or
| constantly increasing the keysize, so I won't be too surprised if
| Schnorr really has new insights to speed it up further. In fact,
| "We need something with a better security record than RSA" was
| one of the main arguments for transitioning to ECC - which has
| already completed at large on today's Internet, RSA is only used
| for digital signature, almost all key exchanges are ECC now. You
| can't decrypt post-2016 web traffic by breaking RSA.
| JoblessWonder wrote:
| > Of course, I don't know what I'm talking about.
|
| I would honestly have no way of knowing either way. It is
| always fun to get a peek into people working out ideas in
| fields I have no experience in.
| k3liutZu wrote:
| > It is always fun to get a peek into people working out
| ideas in fields I have no experience in.
|
| Phew. I'm not alone.
|
| I understood _some_ of the words used in the HN comments in
| this thread.
| bcaa7f3a8bbc wrote:
| I noticed HN user fractionalhare has made a comprehensive reply
| to my questions, but it wasn't posted as a reply to me, so now
| it has fallen to the bottom of the page. You can see it here:
| https://news.ycombinator.com/item?id=26331747
| pbsd wrote:
| Schnorr got close to making such a claim in a previous version
| of the paper [1, Section 6]. Namely, that NTRU is close to
| being broken if a sufficiently short vector (it is not
| specified how short) is found.
|
| The main claim of Schnorr's, as far as I can gather, is that
| for lattices where the shortest vector(s) are much shorter than
| the maximum shortest vector(s) for the same dimension, i.e.,
| low-density lattices, those vectors can be found in heuristic
| polynomial time with his enumeration approach.
|
| Now, low-density lattices are fairly common in cryptographic
| settings, where the solution, discoverable by finding shortest
| vectors, is unusually short/close relatively to what one would
| expect in a random lattice.
|
| As such, if true, I would expect Schnorr's idea to lead to more
| breaks than just RSA. But I don't personally think it's true.
| At the same time, I'm not a lattice expert, so make of that
| what you will.
|
| [1] https://www.math.uni-
| frankfurt.de/~dmst/research/papers/SVP2...
| HATENIGGERS wrote:
| FUCKING FAGGOT
| stefan_ wrote:
| I take it someone finally put down the smartphone and picked up
| the telephone? It turns out retired 70+ year old math legends
| don't frequent Twitter, so of course the chances of the "crypto
| community" hashing this out through ever increasing frantic
| Tweets weren't great.
| draw_down wrote:
| I can't figure out why this paper is getting a bunch of attention
| now, if it is from 2019.
| wging wrote:
| See previous discussion for context:
| https://news.ycombinator.com/item?id=26321962
| YoungWeb wrote:
| Would love a "what's going on here for dummies" summary if
| possible. From what I gather someone is claiming they broke RSA
| encryption?
| bcaa7f3a8bbc wrote:
| 1. Claus-Peter Schnorr, a well-established and reputable
| cryptographer, publishes a paper and claims he found a new
| algorithm for integer factorization, which is faster than the
| best known algorithm today (Number Field Sieve).
|
| 2. If it's all the paper says, it probably won't attract that
| much attention, at best it leads to a new wave of RSA keysize
| upgrade (or transition to ECC). But today, this paper appeared
| on the Cryptology ePrint Archive, and its abstract reads "This
| destroys the RSA cryptosystem", the use of strong language is
| extraordinary, a reader may interpret it as "the speedup is
| significant and _all_ RSA keys can be broken. " Researchers
| usually don't make such claims.
|
| 3. Meanwhile, it's also very suspicious for two reasons. First,
| this claim didn't appear in the actual paper, only the ePrint
| Archive web page, and it also includes an embarrassing typo.
| Also, the submitted paper wasn't even the latest version, which
| is available at Schnorr's web page, but an old version from
| 2019. Many people suspected that the paper was submitted by
| someone else, who happened to see an earlier version on the web
| and got too excited about it, and added the "destroys RSA"
| claim.
|
| 4. But now, personal communication with Schnorr confirmed the
| paper was indeed submitted by him, and he indeed makes the
| "destroys RSA" claim. Schnorr also said he uploaded the wrong
| file.
|
| 5. About 10 minutes ago, an updated preprint was published,
| that includes the sentence, "This destroys the RSA
| cryptosystem".
| isaacg wrote:
| Here's an expert saying that this paper should be considered
| unsubstantiated at best: https://crypto.stackexchange.com/a/88590
| [deleted]
| phigcch wrote:
| Without experimental data to back it up (e.g. implementation and
| benchmarks), I'd consider this claim veeeery dubious - regardless
| of who it came from.
|
| Extraordinary claims need extraordinary evidence, and in this
| case it would be easy to provide such evidence - by cracking
| appropriately-sized challenge primes in a transparent way that
| can be independently verified.
|
| On the other hand, the theoretical approach in the paper is quite
| complex and hard to follow - even for professional
| cryptographers.
| coliveira wrote:
| There are some approaches that seem difficult to implement at
| first view, but that can be improved when more people work on
| the difficult pieces. The most important thing in a paper like
| this is the general strategy. Even if there are small issues or
| if the implementation is too complex, if the general ideas are
| right we can find a better way to solve these problems over
| time.
| Lammy wrote:
| "This giant prime number will keep your information totally
| unreadable to anyone who doesn't have this other giant prime
| number" is no less of an extraordinary claim, just one that we
| all believe in.
| the_svd_doctor wrote:
| Depends of the claim. For the theoretical result, the evidence
| is the paper. (I have no clue whether it's correct.) Nothing
| else is needed. For "RSA is broken", it depends what broken
| means. If it would rely on a claim that is now provably false,
| it is indeed broken. If we are talking about the claim of
| breaking RSA in the real world, I agree with you. But it all
| depends on the claim.
| fractionalhare wrote:
| I wrote my thesis on post-quantum public key cryptosystems,
| though I'm not currently a practitioner and haven't been
| academically active since ~2017 or so. With those provisos in
| mind, I'll try to give the summary as I see it. As a basic tl;dr
| I'm skeptical of the paper. Crypto-twitter is lit up about this
| right now and as far as I can tell, harbors the same skepticism.
|
| - For context and background: yes, there are well-established
| links between factoring problems and lattice problems. These
| links have been known from at least the early 90s. There are many
| complexity theoretic reductions between specific factoring
| problems and specific lattice problems, and the approximate
| variants of the latter. There hasn't been an arbitrary reduction
| yet, it's mostly on a problem by problem basis.
|
| - That first bullet point means that this research is at least
| structurally built on, and engages with, prior work in the
| academic community. Schnorr in particular has been pursuing this
| since the 90s. Schnorr is an accomplished and established
| cryptographer.
|
| - I consider the context of that second bullet point unfortunate,
| because it means the research gets outsized attention even though
| it is otherwise, as of now, unsubstantiated. It gives the paper a
| lot more charity than it would ordinarily receive.
|
| - Critically: Schnorr has not empirically demonstrated a break in
| RSA. He has demonstrated - in theory - faster factoring methods
| using SVP and CVP solving techniques which rely on a reduction of
| the factoring problem.
|
| - The paper may not be worthless even if it doesn't break RSA. If
| he has indeed found a polynomial time way to solve a subset of
| lattice (and factoring) problems, that will be impressive. I'll
| have to read the paper a few more times to come to a belief on
| this point though.
|
| Many comparisons are being drawn online between Schnorr and
| Atiyah, because the latter kept insisting he found a proof of the
| Riemann Hypothesis towards the end of his life. It would be sad
| if this is the case for Schnorr, but it's personally what I
| believe at this time pending an empirical demonstration of his
| work and/or critical substantiation from the rest of the academic
| community. I'm skeptical of this result the same way I'm
| skeptical when highly established mathematicians publish
| purported proofs of long standing open problems.
| cleansingfire wrote:
| Assuming it works, I'm interested in its limitations. At
| various complexity levels, there are subsets of problems that
| yield easily, like unsafe primes in RSA, or trivially, how I
| can instantly get one factor of an even composite.
|
| Schnorr's main novel claim here seems to be a speedup in
| finding the SVP and CVP in some cases (he explicitly
| acknowledges limitations.) A Proof Of Concept seems like it
| would be great to test for edge cases, and that's where I think
| the interesting bits are likely to be. Disclaimer: Not a
| mathematician or complexity theorist. Just here to learn, and
| glad to be corrected any time.
| forty wrote:
| I found this thread interesting
| https://twitter.com/SchmiegSophie/status/1367197192172179456
| mizaru wrote:
| *according to someone on twitter.
| slowmovintarget wrote:
| This is mildly important. It's someone that claims to have
| communicated with Schnorr.
| tptacek wrote:
| If Frederic Jacobs says he communicated with Schnorr, then
| that's what happened.
| cperciva wrote:
| If Frederic Jacobs says he communicated with Schnorr, he
| thinks he communicated with Schnorr. It's possible that
| someone is impersonating Schnorr.
| GordonS wrote:
| If only there was some kind of way of proving who you
| were... possibly using public key cryptography? ;)
| bcaa7f3a8bbc wrote:
| Elliptic Curve Cryptography still has an excellent
| theoretical security record, and will likely keep its
| record until the advent of quantum computers. Also,
| trustworthy digital signature is actually not too
| difficult even given the doomsday scenario - if all
| public-key cryptosystems are broken, as long as you still
| have a secure hash function, you can use Merkle signature
| [0].
|
| [0] https://en.wikipedia.org/wiki/Merkle_signature_scheme
| rfoo wrote:
| I really hope this is not just another Atiyah moment. Sigh.
| srockets wrote:
| It is an Atiyah moment in the our response to this: both men
| earned the right to have those publications silently ignored,
| not being made into an attraction.
| [deleted]
| pfortuny wrote:
| In the 2020 preprint:
|
| "These new algorithms factor integers N [?] 2^400 and N [?] 2^800
| using 7x10^10 and 4.3x10^12 arithmetic operations".
|
| He does not specify how many it uses for 2^1024 or 2^2048. This
| is clearly nonlinear. Assume (nevertheless) that you multiply
| x100 every 400 binary digits, then for
|
| 2^2048, you get
|
| (2048-800) equiv 1200/400 equiv 3, so you would need approx.
| 10^12*10^6 operations. Assuming you can do 10^6 ops , you need
| 10^12 seconds (like 30000 years).
|
| BUT those are very very rough assumptions (an "arithmetic op"
| might probably take more than 1 microsec).
|
| EDIT: sorry, this link is pretty interesting. Factor RSA-260,
| which only has 862 bits. Should be feasible in about 2 hours. The
| link: https://crypto.stackexchange.com/questions/88582/does-
| schnor...
|
| EDIT2: sorry again: Schnorr is 78 years old. I am not
| gerontophobic (being 50 I am approaching that age) but: Atiyah
| claimed the Riemann Hypothesis, Hironaka has claimed full
| resolution of singularities in any characteristic... And I am
| speaking of Fields medalists.
|
| So: you do really need peer-review for strong arguments.
| fallingknife wrote:
| I'm getting 1e9 multiplication (2.5e8 div) ops per second in
| Node on a 2018 Macbook pro. So that would be 30 - 120 years.
| Not sure how well this algorithm can be parallelized, but since
| it's factoring, I think it can. So I would think that a
| dedicated attacker could get at least another 1000x on that,
| which gives 11-44 days. Note that I am pretty much guessing
| here but this is my test code: function
| test(opp, n) { const start = Date.now();
| let i = 1; if (opp === '*') { let prod =
| 1; while (i < n) { i++;
| prod *= i; } } else if (opp === '/') {
| let quot = 100000000000000; while (i < n) {
| i++; quot /= i; } } else if
| (opp === '+') { let sum = 0; while (i <
| n) { i++; sum += i; }
| } else if (opp == '-') { let sum = 100000000000000;
| while (i < n) { i++; sum -= i;
| } } const end = Date.now();
| console.log(`${n} ${opp} ops in ${end - start} ms`); }
| waterhouse wrote:
| Guess: The "multiplications" we're talking about are those of
| 400-bit or 800-bit numbers (and, in general, would be the
| size of the number you're trying to factor), which are much
| more expensive than 64-bit x 64-bit or float x float
| multiplications. If you want to test the cost of that, I
| recommend GMPlib's bignums (or possibly just your favorite
| language that has built-in bignum support, although if it's
| not built on GMPlib it might not be using the most efficient
| algorithms).
| fallingknife wrote:
| Yeah that makes sense.
| nine_k wrote:
| If one takes a good FPGA and implements a 4096 bit
| multiplier in it, would it be faster?
|
| Or, if we take a GPU, can we split a 4096 bit number into,
| say, 32-bit fragments, mass-multiply them, and combine the
| results faster than on a CPU? I suspect pretty common
| hardware can help speed such things up a lot; isn't crypto
| mining already using some of these approaches?
| waterhouse wrote:
| That I don't know. It's probably first worth looking at
| what software can do: https://en.wikipedia.org/wiki/Multi
| plication_algorithm#Karat...
|
| Naive multiplication is O(n^2) (where n = number of
| digits). The fastest algorithms seem to involve either
| cutting the numbers into pieces and doing multiplies,
| adds, shifts, and maybe subtracts on the pieces, and
| doing so recursively, which are O(n^[something slightly
| greater than 1]); or doing Fourier transforms, which
| apparently approach O(n log n). I don't know how easy it
| is to implement pieces of these more advanced approaches
| in hardware (especially if the size of the numbers isn't
| pre-chosen).
| blintz wrote:
| About 10 minutes ago an updated preprint was published with a
| much more succinct and understandable abstract, that includes the
| sentence, "This destroys the RSA cryptosystem".
|
| https://eprint.iacr.org/2021/232.pdf
|
| Version history here: https://eprint.iacr.org/eprint-
| bin/versions.pl?entry=2021/23...
| Flockster wrote:
| It seems a wrong version was uploaded.
|
| https://twitter.com/FredericJacobs/status/136717279911944601...
| j_walter wrote:
| It doesn't destroy it...at best it weakens the lower RSA bit
| keys. If it destroys it...why not prove it with a PoC on one of
| the RSA numbers that hasn't been factored yet. RSA-260 is still
| open...
| klmadfejno wrote:
| From the look of it, he hasn't really claimed this yet in
| public. This link is someone on twitter saying he did in
| private. I would just wait
| EthanHeilman wrote:
| He claimed it in the paper he posted on eprint.
|
| "This destroys the RSA cryptosystem" - Claus Peter Schnorr[0]
|
| [0]: https://eprint.iacr.org/2021/232.pdf
| pfortuny wrote:
| It is in the ePrints abstract, which is essentially public.
| TacticalCoder wrote:
| Ron Rivest explains himself that once in a while he gets an
| email from someone saying basically "I broke RSA": not everyday
| but it's a semi-regular occurrence. And he always nicely
| answers by asking the person claiming to have broken it to
| solve a challenge (and it's not even a crazy high number of RSA
| bit keys he gives).
|
| Theory is nice but if you can find the solution to something,
| just do it and then brag once it's done : )
| hinkley wrote:
| Way back when dinosaurs roamed the earth and comp.compression
| on Usenet was a place to be, usually we went beyond the
| pigeonhole principle by asking people to grab a megabyte from
| random.org, compress it, and then get back to us.
|
| Nobody ever did.
| capitol_ wrote:
| I remember one of those exchanges, two people waged money
| about compressing random data so that the data + decompress
| program would be smaller than the original data.
|
| The other guy came back with a program that moved some of
| the random data into the metadata of the filesystem, in
| such a way so that the produced files did indeed become
| small enough.
|
| Don't know if the other guy ever paid out.
| hinkley wrote:
| I think I remember that one too, or definitely one like
| it.
|
| That's a cheap trick. You gotta send someone the file,
| otherwise there's not much of a point.
| philsnow wrote:
| When I was a kid I found some compression program on a
| BBS, that claimed to use "wavelets" to compress even more
| than was previously thought possible. It turned out it
| was using a similar trick (but this was in MSDOS, so it
| was just hiding blocks in unused parts of the disk and
| storing their addresses in the "compressed" file). I
| blithely used the tool on some things I had on hand that
| were taking up too much space, and predictably lost ~all
| of them.
|
| I learned a little bit about information theory that day,
| and my sneakernet bandwidth was saturated for a while
| afterwards.
| EthanHeilman wrote:
| On one hand I am skeptical about strong claims especially in
| the early stage of the claim. On the other hand Schnorr is the
| person claiming it and no one has refuted it yet. I wonder how
| long until we will know for certain.
| pfortuny wrote:
| Hironaka has claimed to have a proof of reduction of
| singularities in positive characteristic for years (he got
| the Fields Medal for the same result in characteristic 0).
|
| Nobody has read the manuscript though...
| marcinzm wrote:
| Refuting it puts a massive burden on other people since
| finding the fault in complicated proofs can be very involved.
| Providing a PoC puts a burden on the person making the claim.
| So at a minimum not providing a PoC is a very selfish
| approach.
| j_walter wrote:
| The paper seems to be built off of the work of a lot of
| previous research. It will take some time to prove it, but
| again if Schnorr is so adamant that this is true he should
| have no problem with a PoC...even a simple one.
| EthanHeilman wrote:
| Not sure I would agree that it would be "no problem" to do
| a PoC. Going from paper to PoC might take a long time. If
| you are very sure of a result, better to get it out early
| and let others look at it.
| raverbashing wrote:
| Agreed. Typical mathematician mentality
|
| People would be more convinced by presenting a factorization of
| a challenge RSA number
| klyrs wrote:
| As a computational mathematician, I must object. The world is
| large enough for multiple deep specializations. I can't think
| at this level of abstraction (hence, I quit number theory
| after bashing at it for a few years). I can, however, read a
| math paper and put together an implementation as long as I'm
| familiar with the notation and the axiom of choice hasn't
| been used in a nontrivial matter. But then, my implementation
| would probably piss off software engineers who like to
| castigate research software that doesn't meet their standards
| (rather than, say, helping out).
|
| Expecting everybody to have mastery of every specialization
| that their work touches is toxic and unproductive. I look
| forward to a team of motivated undergrad number theorists to
| tear into this and hack up an implementation.
| richardfey wrote:
| Count me in!
| tantalor wrote:
| Pffh, that's for lowly applied mathematicians. This is theory!
| /s
| tyingq wrote:
| The two links to the paper...had to navigate twitter a bit to
| find them:
|
| https://eprint.iacr.org/2021/232.pdf (older)
|
| https://www.math.uni-frankfurt.de/~dmst/teaching/WS2019/SVP9...
| (newer)
|
| Edit: And the abstract with the _" destroyes the RSA..."_ blurb:
| https://eprint.iacr.org/2021/232
| KMag wrote:
| Quick summary, he's found a faster way to factor numbers. He
| hasn't found a way to break RSA that isn't equivalent to
| factoring the modulus.
|
| (As far as I know, it's still just a long-standing conjecture
| that breaking RSA is as difficult as factoring. RSA always uses
| odd exponents. The Rabin cryptosystem is similar to RSA except
| that it always uses 2 as the public exponent and is provably as
| difficult as factoring, but if the modulus has 2 prime factors
| p and q, then by the Chinese remainder theorem, the output will
| always be a quadratic residue modulo p and also a quadratic
| residue modulo q. In other words, the number of possible
| plaintexts is 4 times the number of possible ciphertexts, so
| decryption gives you back 4 possibilities and you need some
| convention that only one of those was a legal message.)
|
| Unfortunately, this is a faster factoring method, so it also
| applies to the Rabin cryptosystem, the Blum-Blum-Shub
| pseudorandom number generator, and Rivest's time lock puzzles
| (repeated squaring modulo a large composite).
| airhead969 wrote:
| Seems like not a fault of the construction of RSA or anything
| else that relies on the cost of factoring, but a fault of
| appropriately anticipating the costs to break it. Useable
| quantum will also make crypto security more expensive and
| complicated.
|
| Another thing that often bothers me are claims and emphasis
| of how fast constructions are. This just makes it easier to
| brute force.
| KMag wrote:
| > Another thing that often bothers me are claims and
| emphasis of how fast constructions are. This just makes it
| easier to brute force.
|
| People generally talk about speed of encryption and
| decryption. You're complaining about time for bruit-force
| attacks. In general, there's not a linear relation between
| the two, and the time for initial TLS session setup
| matters. If it takes a year to hit amazon.com for the first
| time, how many people are going to visit amazon.com?
| arghwhat wrote:
| > People generally talk about speed of encryption and
| decryption. You're complaining about time for bruit-force
| attacks.
|
| If it takes me k time to decrypt something where there
| are N key variations and where I can run p attempts in
| parallel, the maximum runtime for a brute force attack is
| k*N/p. Perfectly linear relationship.
|
| This is why we want large key spaces, and why algorithms
| needing offline brute force protection like password
| hashing algorithms artificially increase execution time
| and resource requirements to very large numbers.
| KMag wrote:
| > This is why we want large key spaces,
|
| This is a subset of what I'm talking about.
| Encryption/decryption times aren't linear with key space
| sizes. Force the number of required parallel instances to
| exceed the number of atoms on Earth, and bruit force time
| rapidly diverges from being linear with
| encryption/decryption time.
| thaumasiotes wrote:
| > This is why we want large key spaces
|
| Yes, but large key spaces are really easy to have. The
| size of the key space doesn't cost you anything when
| you're encrypting or decrypting, but it costs the earth
| if you're trying to guess the key.
|
| > and why algorithms needing offline brute force
| protection like password hashing algorithms artificially
| increase execution time and resource requirements
|
| Ehhhh... this is more of a function of the fact that the
| password space is much smaller than it looks. Password
| cracking attempts generally aren't trying to exhaust the
| space. Instead, they're trying to guess the password
| based on the known properties of passwords. You start
| with common passwords and work your way down to iffy
| ones. You don't bother guessing rare passwords; there are
| too many of them.
|
| Rainbow tables exist, but they have sharp length limits,
| precisely because of the explosion-of-the-key-space
| phenomenon.
| [deleted]
| [deleted]
| thaumasiotes wrote:
| > the number of possible plaintexts is 4 times the number of
| possible ciphertexts, so decryption gives you back 4
| possibilities and you need some convention that only one of
| those was a legal message.
|
| This condition is satisfied by ~100% of all communications,
| including stuff like software downloads. (If I send you a
| file, then yes, any message is _legal_ , but as soon as you
| try to do anything with it, you'll know whether the message
| was correct or not.)
| phkahler wrote:
| >> As far as I know, it's still just a long-standing
| conjecture that breaking RSA is as difficult as factoring.
|
| No, that's not a conjecture. If you factor the modulus you
| can directly calculate the private key from the public one.
|
| Edit: oh maybe you mean that it's possible to break RSA
| faster without factoring... Its been too long since I looked
| at that.
| KMag wrote:
| > No, that's not a conjecture. If you factor the modulus
| you can directly calculate the private key from the public
| one.
|
| You have misread my post. The conjecture is that the RSA
| problem is as difficult as the factoring problem. In other
| words, it's possible that solving the RSA problem isn't as
| difficult as the factoring problem (but most people doubt
| it). A <= B. Most people think A == B.
|
| This is the inverse of your statement. Factoring breaking
| RSA doesn't tell us if there's a non-factoring solution to
| the RSA problem. Everyone knows breaking RSA is no more
| difficult than factoring, but it may be easier than
| factoring.
|
| A break in the Rabin cryptosystem would provably break RSA,
| but it's not necessarily true that a break in RSA would
| break the Rabin cryptosystem.
|
| Edit: Paragraph 4 of
| https://en.wikipedia.org/wiki/RSA_problem at least believes
| it's still a conjecture that RSA is as difficult as the
| factoring problem.
| phkahler wrote:
| Yeah, that's what I tried to say with my edit.
| llarsson wrote:
| What if it's actually someone else that discovered this and is
| just publicly posting and acting as Schnorr, in an attempt to
| prove their point? ;)
| olliej wrote:
| .. this is literally a post confirming that it was schnorr
___________________________________________________________________
(page generated 2021-03-03 23:02 UTC)