On Thu, 26 Aug 2021, Demi Marie Obenour wrote: > One can prove primality using the Miller-Ramin test, which will > detect composites with probability at least 3/4 per round. After 64 > rounds the likelihood of a composite not being detected is not more > than 2⁻¹²⁸, even for adversarial choices of moduli. Note that > the primality testing APIs in cryptographic libraries are often not > designed for this, as they perform optimizations that are not valid for > adversarially chosen numbers. I assumed the safety of most libraries in the adversarial model was fixed a while ago, after https://eprint.iacr.org/2018/749.pdf pointed out a bunch of flaws. Shame on me for not checking thoroughly... -d _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
