Making a Nymbler Nymble Using VERBS

Computing Small Discrete Logarithms Faster

“…. , 16 are random primes between 2 48 − 2 20 and 2 48 . We repeated this process until p was prime, and then took = 1 .…”

“…A simple GMP-based implementation of our algorithm on a single core of a low-cost AMD CPU takes an order of magnitude less wall-clock time than the optimized GPU implementation described in [15], for the same DLP sizes considered in [15], even though the GPU is more than 30 times faster than the CPU core at modular multiplications. Specifically, for a group of prime order almost exactly 2 48 , our experiments show a discrete-logarithm computation taking just 115729 ≈ 1.77 · 2 16 multiplications on average, using a table of size 65536 = 2 16 . Precomputation of the table used 5333245354 ≈ 1.24 · 2 32 multiplications.…”

“…Another interesting category of applications uses "trapdoor discrete-logarithm groups": groups in which computations of discrete logarithms are feasible with some trapdoor information and hard otherwise. These applications include the Maurer-Yacobi IDbased encryption system in [24], for example, and the Henry-Henry-Goldberg privacy-preserving protocol in [16].…”

Extending Nymble-like Systems

“…Since Nymble was first proposed in 2006, several schemes have appeared in the literature to solve the same problem, or one of several closely related problems. (For some examples, see [6], [20], [21], [23], [24], [33]- [35].) Three of these schemes operate within the same general framework as Nymble; they change only low-level details to weaken trust assumptions and to provide stronger privacy guarantees and some new functionality.…”

“…Moreover, further incarnations of the idea seem likely to emerge in the future [19]. In this paper, we present several extensions to the abstract Nymble framework that can be used to improve the security, liveness and functionality of Nymble-like systems; our extensions solve several open problems identified in the future work sections of [20]- [23].…”