Trapdoor simulation Algorithms in CS courses of quantum algorithms - PowerPoint PPT Presentation

Trapdoor simulation Algorithms in CS courses of quantum algorithms “WHAT is your algorithm?” Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Joint work with: Tung Chou Technische Universiteit Eindhoven

Trapdoor simulation Algorithms in CS courses of quantum algorithms “WHAT is your algorithm?” Daniel J. Bernstein “Heapsort. Here’s the code.” University of Illinois at Chicago & Technische Universiteit Eindhoven Joint work with: Tung Chou Technische Universiteit Eindhoven

Trapdoor simulation Algorithms in CS courses of quantum algorithms “WHAT is your algorithm?” Daniel J. Bernstein “Heapsort. Here’s the code.” University of Illinois at Chicago & “WHAT does it accomplish?” Technische Universiteit Eindhoven Joint work with: Tung Chou Technische Universiteit Eindhoven

Trapdoor simulation Algorithms in CS courses of quantum algorithms “WHAT is your algorithm?” Daniel J. Bernstein “Heapsort. Here’s the code.” University of Illinois at Chicago & “WHAT does it accomplish?” Technische Universiteit Eindhoven “It sorts the input array in place. Joint work with: Here’s a proof.” Tung Chou Technische Universiteit Eindhoven

Trapdoor simulation Algorithms in CS courses of quantum algorithms “WHAT is your algorithm?” Daniel J. Bernstein “Heapsort. Here’s the code.” University of Illinois at Chicago & “WHAT does it accomplish?” Technische Universiteit Eindhoven “It sorts the input array in place. Joint work with: Here’s a proof.” Tung Chou Technische Universiteit Eindhoven “WHAT is its run time?”

Trapdoor simulation Algorithms in CS courses of quantum algorithms “WHAT is your algorithm?” Daniel J. Bernstein “Heapsort. Here’s the code.” University of Illinois at Chicago & “WHAT does it accomplish?” Technische Universiteit Eindhoven “It sorts the input array in place. Joint work with: Here’s a proof.” Tung Chou Technische Universiteit Eindhoven “WHAT is its run time?” “ O ( n lg n ) comparisons; and Θ( n lg n ) comparisons for most inputs. Here’s a proof.”

Trapdoor simulation Algorithms in CS courses of quantum algorithms “WHAT is your algorithm?” Daniel J. Bernstein “Heapsort. Here’s the code.” University of Illinois at Chicago & “WHAT does it accomplish?” Technische Universiteit Eindhoven “It sorts the input array in place. Joint work with: Here’s a proof.” Tung Chou Technische Universiteit Eindhoven “WHAT is its run time?” “ O ( n lg n ) comparisons; and Θ( n lg n ) comparisons for most inputs. Here’s a proof.” “You may pass.”

door simulation Algorithms in CS courses Algorithms quantum algorithms “WHAT is your algorithm?” Critical question J. Bernstein How hard “Heapsort. Here’s the code.” University of Illinois at Chicago & “WHAT does it accomplish?” echnische Universiteit Eindhoven “It sorts the input array in place. ork with: Here’s a proof.” Chou echnische Universiteit Eindhoven “WHAT is its run time?” “ O ( n lg n ) comparisons; and Θ( n lg n ) comparisons for most inputs. Here’s a proof.” “You may pass.”

simulation Algorithms in CS courses Algorithms for hard rithms “WHAT is your algorithm?” Critical question fo Bernstein How hard is ECDLP? “Heapsort. Here’s the code.” Illinois at Chicago & “WHAT does it accomplish?” Universiteit Eindhoven “It sorts the input array in place. Here’s a proof.” Universiteit Eindhoven “WHAT is its run time?” “ O ( n lg n ) comparisons; and Θ( n lg n ) comparisons for most inputs. Here’s a proof.” “You may pass.”

Algorithms in CS courses Algorithms for hard problems “WHAT is your algorithm?” Critical question for ECC securit How hard is ECDLP? “Heapsort. Here’s the code.” Chicago & “WHAT does it accomplish?” Eindhoven “It sorts the input array in place. Here’s a proof.” Eindhoven “WHAT is its run time?” “ O ( n lg n ) comparisons; and Θ( n lg n ) comparisons for most inputs. Here’s a proof.” “You may pass.”

Algorithms in CS courses Algorithms for hard problems “WHAT is your algorithm?” Critical question for ECC security: How hard is ECDLP? “Heapsort. Here’s the code.” “WHAT does it accomplish?” “It sorts the input array in place. Here’s a proof.” “WHAT is its run time?” “ O ( n lg n ) comparisons; and Θ( n lg n ) comparisons for most inputs. Here’s a proof.” “You may pass.”

Algorithms in CS courses Algorithms for hard problems “WHAT is your algorithm?” Critical question for ECC security: How hard is ECDLP? “Heapsort. Here’s the code.” Standard estimate for “strong” “WHAT does it accomplish?” ECC groups of prime order ‘ : “It sorts the input array in place. Latest “negating” variants of Here’s a proof.” “distinguished point” rho methods break an average ECDLP instance “WHAT is its run time?” √ using ≈ 0 : 886 ‘ additions. “ O ( n lg n ) comparisons; and Θ( n lg n ) comparisons for most inputs. Here’s a proof.” “You may pass.”

Algorithms in CS courses Algorithms for hard problems “WHAT is your algorithm?” Critical question for ECC security: How hard is ECDLP? “Heapsort. Here’s the code.” Standard estimate for “strong” “WHAT does it accomplish?” ECC groups of prime order ‘ : “It sorts the input array in place. Latest “negating” variants of Here’s a proof.” “distinguished point” rho methods break an average ECDLP instance “WHAT is its run time?” √ using ≈ 0 : 886 ‘ additions. “ O ( n lg n ) comparisons; Is this proven? No! and Θ( n lg n ) comparisons for most inputs. Here’s a proof.” Is this provable? Maybe not! “You may pass.”

Algorithms in CS courses Algorithms for hard problems “WHAT is your algorithm?” Critical question for ECC security: How hard is ECDLP? “Heapsort. Here’s the code.” Standard estimate for “strong” “WHAT does it accomplish?” ECC groups of prime order ‘ : “It sorts the input array in place. Latest “negating” variants of Here’s a proof.” “distinguished point” rho methods break an average ECDLP instance “WHAT is its run time?” √ using ≈ 0 : 886 ‘ additions. “ O ( n lg n ) comparisons; Is this proven? No! and Θ( n lg n ) comparisons for most inputs. Here’s a proof.” Is this provable? Maybe not! “You may pass.” So why do we think it’s true?

rithms in CS courses Algorithms for hard problems 2000 Gallant–Lamb inadequately T is your algorithm?” Critical question for ECC security: of a negating How hard is ECDLP? “Heapsort. Here’s the code.” Standard estimate for “strong” T does it accomplish?” ECC groups of prime order ‘ : rts the input array in place. Latest “negating” variants of a proof.” “distinguished point” rho methods break an average ECDLP instance T is its run time?” √ using ≈ 0 : 886 ‘ additions. lg n ) comparisons; Is this proven? No! Θ( n lg n ) comparisons ost inputs. Here’s a proof.” Is this provable? Maybe not! may pass.” So why do we think it’s true?

courses Algorithms for hard problems 2000 Gallant–Lamb inadequately specified algorithm?” Critical question for ECC security: of a negating rho algo How hard is ECDLP? Here’s the code.” Standard estimate for “strong” accomplish?” ECC groups of prime order ‘ : input array in place. Latest “negating” variants of “distinguished point” rho methods break an average ECDLP instance run time?” √ using ≈ 0 : 886 ‘ additions. comparisons; Is this proven? No! comparisons Here’s a proof.” Is this provable? Maybe not! So why do we think it’s true?

Algorithms for hard problems 2000 Gallant–Lambert–Vanstone: inadequately specified statem rithm?” Critical question for ECC security: of a negating rho algorithm. How hard is ECDLP? de.” Standard estimate for “strong” accomplish?” ECC groups of prime order ‘ : place. Latest “negating” variants of “distinguished point” rho methods break an average ECDLP instance √ using ≈ 0 : 886 ‘ additions. Is this proven? No! proof.” Is this provable? Maybe not! So why do we think it’s true?

Algorithms for hard problems 2000 Gallant–Lambert–Vanstone: inadequately specified statement Critical question for ECC security: of a negating rho algorithm. How hard is ECDLP? Standard estimate for “strong” ECC groups of prime order ‘ : Latest “negating” variants of “distinguished point” rho methods break an average ECDLP instance √ using ≈ 0 : 886 ‘ additions. Is this proven? No! Is this provable? Maybe not! So why do we think it’s true?

Algorithms for hard problems 2000 Gallant–Lambert–Vanstone: inadequately specified statement Critical question for ECC security: of a negating rho algorithm. How hard is ECDLP? 2010 Bos–Kleinjung–Lenstra: Standard estimate for “strong” a plausible interpretation of ECC groups of prime order ‘ : that algorithm is non-functional . Latest “negating” variants of “distinguished point” rho methods break an average ECDLP instance √ using ≈ 0 : 886 ‘ additions. Is this proven? No! Is this provable? Maybe not! So why do we think it’s true?