cr.yp.to update

 ecdh.html          |   17 +++++++++++++++--
 streamciphers.html |   14 ++++++++++++++
 2 files changed, 29 insertions(+), 2 deletions(-)
Deleted: .old-crypto/.tmp.streamciphers.html.1126107796.29373
diff -ru .old-crypto/ecdh.html cr.yp.to/ecdh.html
--- .old-crypto/ecdh.html	2005-09-08 16:20:15.000000000 -0400
+++ cr.yp.to/ecdh.html	2005-09-12 07:31:19.000000000 -0400
@@ -3,6 +3,7 @@
 <title>Curve25519: high-speed elliptic-curve cryptography</title>
 <meta name="keywords" content="curve25519, elliptic curve, ecc, diffie, hellman, dh, ecdh, key exchange, cryptography">
 <a href="djb.html">D. J. Bernstein</a>
+<br><a href="antiforgery.html">Authenticators and signatures</a>
 <h1>A state-of-the-art Diffie-Hellman function</h1>
 Curve25519 is a state-of-the-art Diffie-Hellman function
 suitable for a wide variety of applications.
@@ -21,7 +22,7 @@
 For each integer n,
 define Curve25519(n) in {0,1,...,p-1,infinity}
 as the x-coordinate of the nth multiple of the point
-(4,10396089888167458996693606908380331970145732977558722329349539962582616845133)
+(9,14781619447589544791020593568409986887264606134616475288964881837755586237401)
 on E.
 <p>
 More generally, for each integer n
@@ -35,11 +36,23 @@
 Security notes:
 The number of points of E over F_p is 8 times the prime
 2^252 + 27742317777372353535851937790883648493.
+This prime is also the order of the point (9,...) on E.
+The points of order dividing 8 have x-coordinates
+0,
+1,
+325606250916557431795983626356110631294008115727848805560023387167927233504,
+39382357235489614581723060781553021112529911719440698176882885853963445705823,
+and infinity.
+<p>
 The number of points of the twist of E over F_p is 4 times the prime
 2^253 - 55484635554744707071703875581767296995.
+The points of order dividing 4 have x-coordinates
+0,
+-1,
+and infinity.
 <h2>Technical details: Diffie-Hellman</h2>
 A user's secret key is a uniform random element
-U of {2^251,2^251+1,2^251+2,...,2^252-1}.
+U of {2^254,2^254+8,2^254+16,2^254+24,...,2^255-8}.
 The user's public key is Curve25519(U).
 <p>
 Given another user's public key Curve25519(V),
diff -ru .old-crypto/streamciphers.html cr.yp.to/streamciphers.html
--- .old-crypto/streamciphers.html	2005-09-06 03:17:52.000000000 -0400
+++ cr.yp.to/streamciphers.html	2005-09-07 11:43:16.000000000 -0400
@@ -264,6 +264,11 @@
 Initial impression:
 Timing-attack problems, like AES.
 Also looks like a great target for algebraic attacks.
+<p>
+Wu and Preneel write:
+``If a key is used with about 2^61 random IVs,
+and 20,000 keystream bytes are generated from each IV,
+then the key could be recovered easily.''
 <h2>Notes on YAMB</h2>
 Key as large as 32 bytes.
 Nonce as large as 16 bytes.
@@ -486,6 +491,15 @@
 <h2>Notes on VEST-32 (patented)</h2>
 32-byte key.
 No software speed reports.
+<p>
+According to the paper, VEST-32 returns ``32 bits of output per clock cycle''
+using about 20000 gates.
+Loading a 64-bit IV ``takes 40 rounds,''
+which I guess means 40 clock cycles.
+Expanding a key takes 320 clock cycles;
+an expanded key occupies 768 bits.
+<p>
+This hardware performance seems considerably worse than, e.g., Salsa20.
 <h2>Notes on ZK-Crypt (patented)</h2>
 No software speed reports.
 <hr>