@kelalaka: I think I remember you wrote instructions on how to use Sage to find the order of an Elliptic curve. I'd like to do just that for a semi-toy curve, like an Edwards curve with p=2^116-3 (call that ed1163). Do you have a pointer to your earlier writing, or something useful?
Yes, the cardinality was here https://crypto.stackexchange.com/a/68603/18298 however, the Edward curve has no direct construction as Weierstrass curves `E = EllipticCurve(GF(25, 'x'), [1, 1])` of course, to my knowledge.
@kelalaka hello again friend! I was thinking again today about partition oracle attacks and digging in further on how they might affect various types of crypto implementation...
I now feel I understand that they don't affect entropy over ~80bits, so ECDHE agreed keys are fine, or keys from /dev/unrandom
(based on my reading of the paper)
also I think I now understand that non-committing crypto doesn't mean there are many keys that CORRECTLY decrypt to plaintext, just that there are many keys that will pass tag validation.
(I think I am correct in the above, pls let me know if you disagree)...
Anyway, the last hurdle for me is to understand if partition oracle attacks might affect a tool such as this one I wrote using libsodium: github.com/johnalanwoods/encrypt
it simply takes a user password and uses argon with large params to derive a key and uses that key with salsa20, then finally destroys the key leaving only the blob of encrypted data
I originally thought that this type of tool might be affected, however, after reading some comments here crypto.stackexchange.com/questions/88777/… I think I change my mind
your response was interesting, but the last upvoted answer, seems to indicate the oracle here needs to KNOW the key, crypto.stackexchange.com/a/88795/67071
since in my tool, I dispose of the key after use, is a partition oracle attack even possible?
we were discussing here before, but we got side tracked
