text:
Epistle to Philemon

The Epistle to Philemon is one of the books of the Christian New Testament. It is a prison letter, authored by Paul the Apostle (the opening verse also mentions Timothy), to Philemon, a leader in the Colossian church. It deals with the themes of forgiveness and reconciliation. Paul does not identify himself as an apostle with authority, but as "a prisoner of Jesus Christ", calling Timothy "our brother", and addressing Philemon as "fellow labourer" and "brother". Onesimus, a slave that had departed from his master Philemon, was returning with this epistle wherein Paul asked Philemon to receive him as a "brother beloved".

Philemon was a wealthy Christian, possibly a bishop of the church that met in his home in Colossae. This letter is now generally regarded as one of the undisputed works of Paul. It is the shortest of Paul's extant letters, consisting of only 335 words in the Greek text.

Composition
The Epistle to Philemon was composed around AD 57–62 by Paul while in prison at Caesarea Maritima (early date) or more likely from Rome (later date) in conjunction with the composition of Colossians.

Authorship
The Epistle to Philemon is attributed to the apostle Paul, and this attribution has rarely been questioned by scholars. Along with six others, it is numbered among the "undisputed letters", which are widely considered to be authentically Pauline. The main challenge to the letter's authenticity came from a group of German scholars in the nineteenth century known as the Tübingen School. Their leader, Ferdinand Christian Baur, only accepted four New Testament epistles as genuinely written by Paul: Romans, 1 and 2 Corinthians and Galatians. Commenting on Philemon, Baur described the subject matter as "so very singular as to arouse our suspicions", and concluded that it is perhaps a "Christian romance serving to convey a genuine Christian idea". This view is now largely considered to be outdated and finds no support in modern scholarship.

The opening verse of the salutation also names Timothy alongside Paul. This, however, does not mean that Timothy was the epistle's co-author. Rather, Paul regularly mentions others in the address if they have a particular connection with the recipient. In this case, Timothy may have encountered Philemon while accompanying Paul in his work in Ephesus.

Occasion
According to the most common interpretation, Paul wrote this letter on behalf of Onesimus, a runaway slave who had wronged his owner Philemon. The details of the offence are unstated, although it is often assumed that Onesimus had fled after stealing money, as Paul states in verse 18 that if Onesimus owes anything, Philemon should charge this to Paul's account. Sometime after leaving, Onesimus came into contact with Paul, although again the details are unclear. He may have been arrested and imprisoned alongside Paul. Alternatively, he may have previously heard Paul's name (as his owner was a Christian) and so travelled to him for help. After meeting Paul, Onesimus became a Christian believer. An affection grew between them, and Paul would have been glad to keep Onesimus with him. However, he considered it better to send him back to Philemon with an accompanying letter, which aimed to effect reconciliation between them as Christian brothers. The preservation of the letter suggests that Paul's request was granted.

Onesimus' status as a runaway slave was challenged by Allen Dwight Callahan in an article published in the Harvard Theological Review and in a later commentary. Callahan argues that, beyond verse 16, "nothing in the text conclusively indicates that Onesimus was ever the chattel of the letter's chief addressee. Moreover, the expectations fostered by the traditional fugitive slave hypothesis go unrealized in the letter. Modern commentators, even those committed to the prevailing interpretation, have tacitly admitted as much." Callahan argues that the earliest commentators on this work – the homily of Origen and the Anti-Marcion Preface – are silent about Onesimus' possible servile status, and traces the origins of this interpretation to John Chrysostom, who proposed it in his Homiliae in epistolam ad Philemonem, during his ministry in Antioch, circa 386–398. In place of the traditional interpretation, Callahan suggests that Onesimus and Philemon are brothers both by blood and religion, but who have become estranged, and the intent of this letter was to reconcile the two men. Ben Witherington III has challenged Callahan's interpretation as a misreading of Paul's rhetoric. Further, Margaret M. Mitchell has demonstrated that a number of writers before Chrysostom either argue or assume that Onesimus was a runaway slave, including Athanasius, Basil of Caesarea and Ambrosiaster.

The only extant information about Onesimus apart from this letter is found in Paul's epistle to the Colossians 4:7–9, where Onesimus is called "a faithful and beloved brother":

"All my state shall Tychicus declare unto you, who is a beloved brother, and a faithful minister and fellow servant in the Lord: 8 Whom I have sent unto you for the same purpose, that he might know your estate, and comfort your hearts; 9 With Onesimus, a faithful and beloved brother, who is one of you. They shall make known unto you all things which are done here."

Recipient
The letter is addressed to Philemon, Apphia and Archippus, and the church in Philemon's house. Philemon is described as a "fellow worker" of Paul. It is generally assumed that he lived in Colossae; in the letter to the Colossians, Onesimus (the slave who fled from Philemon) and Archippus (whom Paul greets in the letter to Philemon) are described as members of the church there. Philemon may have converted to Christianity through Paul's ministry, possibly in Ephesus. Apphia in the salutation is probably Philemon's wife. Some have speculated that Archippus, described by Paul as a "fellow soldier", is the son of Philemon and Apphia.

The Scottish Pastor John Knox proposed that Onesimus' owner was in fact Archippus, and the letter was addressed to him rather than Philemon. In this reconstruction, Philemon would receive the letter first and then encourage Archippus to release Onesimus so that he could work alongside Paul. This view, however, has not found widespread support. In particular, Knox's view has been challenged on the basis of the opening verses. According to O'Brien, the fact that Philemon's name is mentioned first, together with the use of the phrase "in your house" in verse 2, makes it unlikely that Archippus was the primary addressee. Knox further argued that the letter was intended to be read aloud in the Colossian church in order to put pressure on Archippus. A number of commentators, however, see this view as contradicting the tone of the letter. J. B. Lightfoot, for example, wrote: "The tact and delicacy of the Apostle's pleading for Onesimus would be nullified at one stroke by the demand for publication."

Greeting and introduction (1–3)
The opening salutation follows a typical pattern found in other Pauline letters. Paul first introduces himself, with a self-designation as a "prisoner of Jesus Christ," which in this case refers to a physical imprisonment. He also mentions his associate Timothy, as a valued colleague who was presumably known to the recipient. As well as addressing the letter to Philemon, Paul sends greetings to Apphia, Archippus and the church that meets in Philemon's house. Apphia is often presumed to be Philemon's wife and Archippus, a "fellow labourer", is sometimes suggested to be their son. Paul concludes his salutation with a prayerful wish for grace and peace.

Thanksgiving and intercession (4–7)
Before addressing the main topic of the letter, Paul continues with a paragraph of thanksgiving and intercession. This serves to prepare the ground for Paul's central request. He gives thanks to God for Philemon's love and faith and prays for his faith to be effective. He concludes this paragraph by describing the joy and comfort he has received from knowing how Philemon has shown love towards the Christians in Colossae.

Paul's plea for Onesimus (8–20)
As a background to his specific plea for Onesimus, Paul clarifies his intentions and circumstances. Although he has the boldness to command Philemon to do what would be right in the circumstances, he prefers to base his appeal on his knowledge of Philemon's love and generosity. He also describes the affection he has for Onesimus and the transformation that has taken place with Onesimus's conversion to the Christian faith. Where Onesimus was "useless", now he is "useful" – a wordplay, as Onesimus means "useful". Paul indicates that he would have been glad to keep Onesimus with him, but recognised that it was right to send him back. Paul's specific request is for Philemon to welcome Onesimus as he would welcome Paul, namely as a Christian brother. He offers to pay for any debt created by Onesimus' departure and expresses his desire that Philemon might refresh his heart in Christ.

Conclusion and greetings (21–25)
In the final section of the letter, Paul describes his confidence that Philemon would do even more than he had requested, perhaps indicating his desire for Onesimus to return to work alongside him. He also mentions his wish to visit and asks Philemon to prepare a guest room. Paul sends greetings from five of his co-workers and concludes the letter with a benediction.

Themes
Paul uses slavery vs. freedom language more often in his writings as a metaphor.

This letter may have provided some comfort to some slaves of the time.

Though its practice appears centrally, Paul does not share value judgements about the institution of slavery. Its influence could create pressures, as an “abolitionist would have been at the same time an insurrectionist, and the political effects of such a movement would have been unthinkable." Paul saw human institutions like slavery among many that in his apocalyptic view would soon go.

When it comes to Onesimus and his circumstance as a slave, Paul felt that Onesimus should return to Philemon but not as a slave; rather, under a bond of familial love. Paul also was not suggesting that Onesimus be punished, in spite of the fact that Roman law allowed the owner of a runaway slave nearly unlimited privileges of punishment, even execution. This is a concern of Paul and a reason he is writing to Philemon, asking that Philemon accept Onesimus back in a bond of friendship, forgiveness, and reconciliation. Paul is undermining this example of a human institution which dehumanizes people. Onesimus, like Philemon, belongs to Christ, and so "Christ, and not Philemon, has a claim on Onesimus' honor and obedience."

Verses 13–14 suggest that Paul wants Philemon to send Onesimus back to Paul (possibly freeing him for the purpose). Marshall, Travis and Paul write, "Paul hoped that it might be possible for [Onesimus] to spend some time with him as a missionary colleague... If that is not a request for Onesimus to join Paul’s circle, I do not know what more would need to be said".

Significance
In his A History of Christianity, Diarmaid MacCulloch described the epistle as "a Christian foundation document in the justification of slavery".

In order to better appreciate the Book of Philemon, it is necessary to be aware of the situation of the early Christian community in the Roman Empire; and the economic system of Classical Antiquity based on slavery. According to the Epistle to Diognetus: ''For the Christians are distinguished from other men neither by country, nor language, nor the customs which they observe... They are in the flesh, but they do not live after the flesh. They pass their days on earth, but they are citizens of heaven. They obey the prescribed laws, and at the same time surpass the laws by their lives''.

Pope Benedict XVI refers to this letter in his encyclical letter, Spe salvi, highlighting the power of Christianity as power of the transformation of society:"Those who, as far as their civil status is concerned, stand in relation to one an other as masters and slaves, inasmuch as they are members of the one Church have become brothers and sisters—this is how Christians addressed one another... Even if external structures remained unaltered, this changed society from within. When the Letter to the Hebrews says that Christians here on earth do not have a permanent homeland, but seek one which lies in the future (cf. Heb 11:13–16; Phil 3:20), this does not mean for one moment that they live only for the future: present society is recognized by Christians as an exile; they belong to a new society which is the goal of their common pilgrimage and which is anticipated in the course of that pilgrimage."

title: Epistle to Philemon


text:
Elliptic-curve cryptography

Elliptic-curve cryptography (ECC) is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. ECC allows smaller keys to provide equivalent security, compared to cryptosystems based on modular exponentiation in Galois fields, such as the RSA cryptosystem and  ElGamal cryptosystem.

Elliptic curves are applicable for key agreement, digital signatures, pseudo-random generators and other tasks. Indirectly, they can be used for encryption by combining the key agreement with a symmetric encryption scheme. They are also used in several integer factorization algorithms that have applications in cryptography, such as Lenstra elliptic-curve factorization.

History
The use of elliptic curves in cryptography was suggested independently by Neal Koblitz and Victor S. Miller in 1985. Elliptic curve cryptography algorithms entered wide use in 2004 to 2005.

In 1999, NIST recommended fifteen elliptic curves. Specifically, FIPS 186-4 has ten recommended finite fields:
 * Five prime fields $$\mathbb{F}_p$$ for certain primes p of sizes 192, 224, 256, 384, and 521 bits. For each of the prime fields, one elliptic curve is recommended.
 * Five binary fields $$\mathbb{F}_{2^m}$$ for m equal 163, 233, 283, 409, and 571. For each of the binary fields, one elliptic curve and one Koblitz curve was selected.

The NIST recommendation thus contains a total of five prime curves and ten binary curves. The curves were chosen for optimal security and implementation efficiency.

At the RSA Conference 2005, the National Security Agency (NSA) announced Suite B, which exclusively uses ECC for digital signature generation and key exchange. The suite is intended to protect both classified and unclassified national security systems and information. National Institute of Standards and Technology (NIST) has endorsed elliptic curve cryptography in its Suite B set of recommended algorithms, specifically elliptic-curve Diffie–Hellman (ECDH) for key exchange and Elliptic Curve Digital Signature Algorithm (ECDSA) for digital signature. The NSA allows their use for protecting information classified up to top secret with 384-bit keys.

Recently, a large number of cryptographic primitives based on bilinear mappings on various elliptic curve groups, such as the Weil and Tate pairings, have been introduced. Schemes based on these primitives provide efficient identity-based encryption as well as pairing-based signatures, signcryption, key agreement, and proxy re-encryption.

Elliptic curve cryptography is used successfully in numerous popular protocols, such as Transport Layer Security and Bitcoin.

Security concerns
In 2013, The New York Times stated that Dual Elliptic Curve Deterministic Random Bit Generation (or Dual_EC_DRBG) had been included as a NIST national standard due to the influence of NSA, which had included a deliberate weakness in the algorithm and the recommended elliptic curve. RSA Security in September 2013 issued an advisory recommending that its customers discontinue using any software based on Dual_EC_DRBG. In the wake of the exposure of Dual_EC_DRBG as "an NSA undercover operation", cryptography experts have also expressed concern over the security of the NIST recommended elliptic curves, suggesting a return to encryption based on non-elliptic-curve groups.

Additionally, in August 2015, the NSA announced that it plans to replace Suite B with a new cipher suite due to concerns about quantum computing attacks on ECC.

Patents
While the RSA patent expired in 2000, there may be patents in force covering certain aspects of ECC technology, including at least one ECC scheme (ECMQV). However, RSA Laboratories and Daniel J. Bernstein have argued that the US government elliptic curve digital signature standard (ECDSA; NIST FIPS 186-3) and certain practical ECC-based key exchange schemes (including ECDH) can be implemented without infringing those patents.

Elliptic curve theory
For the purposes of this article, an elliptic curve is a plane curve over a finite field (rather than the real numbers) which consists of the points satisfying the equation:

 * $$y^2 = x^3 + ax + b, \, $$

along with a distinguished point at infinity, denoted ∞. The coordinates here are to be chosen from a fixed finite field of characteristic not equal to 2 or 3, or the curve equation would be somewhat more complicated.

This set of points, together with the group operation of elliptic curves, is an abelian group, with the point at infinity as an identity element. The structure of the group is inherited from the divisor group of the underlying algebraic variety:

 * $$\mathrm{Div}^0 (E) \to \mathrm{Pic}^0 (E) \simeq E, \, $$

Application to cryptography
Public-key cryptography is based on the intractability of certain mathematical problems. Early public-key systems, such as RSA's 1983 patent, based their security on the assumption that it is difficult to factor a large integer composed of two or more large prime factors. For later elliptic-curve-based protocols, the base assumption is that finding the discrete logarithm of a random elliptic curve element with respect to a publicly known base point is infeasible (the computational Diffie–Hellman assumption): this is the "elliptic curve discrete logarithm problem" (ECDLP). The security of elliptic curve cryptography depends on the ability to compute a point multiplication and the inability to compute the multiplicand given the original point and product point. The size of the elliptic curve, measured by the total number of discrete integer pairs satisfying the curve equation, determines the difficulty of the problem.

The primary benefit promised by elliptic curve cryptography over alternatives such as RSA is a smaller key size, reducing storage and transmission requirements. For example, a 256-bit elliptic curve public key should provide comparable security to a 3072-bit RSA public key.

Cryptographic schemes
Several discrete logarithm-based protocols have been adapted to elliptic curves, replacing the group $$(\mathbb{Z}_{p})^\times$$ with an elliptic curve:
 * The Elliptic-curve Diffie–Hellman (ECDH) key agreement scheme is based on the Diffie–Hellman scheme,
 * The Elliptic Curve Integrated Encryption Scheme (ECIES), also known as Elliptic Curve Augmented Encryption Scheme or simply the Elliptic Curve Encryption Scheme,
 * The Elliptic Curve Digital Signature Algorithm (ECDSA) is based on the Digital Signature Algorithm,
 * The deformation scheme using Harrison's p-adic Manhattan metric,
 * The Edwards-curve Digital Signature Algorithm (EdDSA) is based on Schnorr signature and uses twisted Edwards curves,
 * The ECMQV key agreement scheme is based on the MQV key agreement scheme,
 * The ECQV implicit certificate scheme.

Implementation
Some common implementation considerations include:

Domain parameters
To use ECC, all parties must agree on all the elements defining the elliptic curve, that is, the domain parameters of the scheme. The size of the field used is typically either prime (and denoted as p) or is a power of two ($$2^m$$); the latter case is called the binary case, and this case necessitates the choice of an auxiliary curve denoted by f. Thus the field is defined by p in the prime case and the pair of m and f in the binary case. The elliptic curve is defined by the constants a and b used in its defining equation. Finally, the cyclic subgroup is defined by its generator (a.k.a. base point) G. For cryptographic application, the order of G, that is the smallest positive number n such that $$n G = \mathcal{O}$$ (the point at infinity of the curve, and the identity element), is normally prime. Since n is the size of a subgroup of $$E(\mathbb{F}_p)$$ it follows from Lagrange's theorem that the number $$h = \frac{1}{n}|E(\mathbb{F}_p)|$$ is an integer. In cryptographic applications, this number h, called the cofactor, must be small ($$h \le 4$$) and, preferably, $$h = 1$$. To summarize: in the prime case, the domain parameters are $$(p,a,b,G,n,h)$$; in the binary case, they are $$(m,f,a,b,G,n,h)$$.

Unless there is an assurance that domain parameters were generated by a party trusted with respect to their use, the domain parameters must be validated before use.

The generation of domain parameters is not usually done by each participant because this involves computing the number of points on a curve which is time-consuming and troublesome to implement. As a result, several standard bodies published domain parameters of elliptic curves for several common field sizes. Such domain parameters are commonly known as "standard curves" or "named curves"; a named curve can be referenced either by name or by the unique object identifier defined in the standard documents: SECG test vectors are also available. NIST has approved many SECG curves, so there is a significant overlap between the specifications published by NIST and SECG. EC domain parameters may be specified either by value or by name.
 * NIST, Recommended Elliptic Curves for Government Use
 * SECG, SEC 2: Recommended Elliptic Curve Domain Parameters
 * ECC Brainpool, ECC Brainpool Standard Curves and Curve Generation

If, despite the preceding admonition, one decides to construct one's own domain parameters, one should select the underlying field and then use one of the following strategies to find a curve with appropriate (i.e., near prime) number of points using one of the following methods:
 * Select a random curve and use a general point-counting algorithm, for example, Schoof's algorithm or the Schoof–Elkies–Atkin algorithm,
 * Select a random curve from a family which allows easy calculation of the number of points (e.g., Koblitz curves), or
 * Select the number of points and generate a curve with this number of points using the complex multiplication technique.

Several classes of curves are weak and should be avoided:
 * Curves over $$\mathbb{F}_{2^m}$$ with non-prime m are vulnerable to Weil descent attacks.
 * Curves such that n divides $$p^B-1$$ (where p is the characteristic of the field: q for a prime field, or $$2$$ for a binary field) for sufficiently small B are vulnerable to Menezes–Okamoto–Vanstone (MOV) attack which applies usual discrete logarithm problem (DLP) in a small-degree extension field of $$\mathbb{F}_p$$ to solve ECDLP.  The bound B should be chosen so that discrete logarithms in the field $$\mathbb{F}_{p^B}$$ are at least as difficult to compute as discrete logs on the elliptic curve $$E(\mathbb{F}_q)$$.
 * Curves such that $$|E(\mathbb{F}_q)| = q$$ are vulnerable to the attack that maps the points on the curve to the additive group of $$\mathbb{F}_q$$.

Key sizes
Because all the fastest known algorithms that allow one to solve the ECDLP (baby-step giant-step, Pollard's rho, etc.), need $$O(\sqrt{n})$$ steps, it follows that the size of the underlying field should be roughly twice the security parameter. For example, for 128-bit security one needs a curve over $$\mathbb{F}_q$$, where $$q \approx 2^{256}$$. This can be contrasted with finite-field cryptography (e.g., DSA) which requires 3072-bit public keys and 256-bit private keys, and integer factorization cryptography (e.g., RSA) which requires a 3072-bit value of n, where the private key should be just as large. However, the public key may be smaller to accommodate efficient encryption, especially when processing power is limited.

The hardest ECC scheme (publicly) broken to date had a 112-bit key for the prime field case and a 109-bit key for the binary field case. For the prime field case, this was broken in July 2009 using a cluster of over 200 PlayStation 3 game consoles and could have been finished in 3.5 months using this cluster when running continuously. The binary field case was broken in April 2004 using 2600 computers over 17 months.

A current project is aiming at breaking the ECC2K-130 challenge by Certicom, by using a wide range of different hardware: CPUs, GPUs, FPGA.

Projective coordinates
A close examination of the addition rules shows that in order to add two points, one needs not only several additions and multiplications in $$\mathbb{F}_q$$ but also an inversion operation. The inversion (for given $$x \in \mathbb{F}_q$$ find $$y \in \mathbb{F}_q$$ such that $$x y = 1$$) is one to two orders of magnitude slower than multiplication. However, points on a curve can be represented in different coordinate systems which do not require an inversion operation to add two points. Several such systems were proposed: in the projective system each point is represented by three coordinates $$(X,Y,Z)$$ using the following relation: $$x = \frac{X}{Z}$$, $$y = \frac{Y}{Z}$$; in the Jacobian system a point is also represented with three coordinates $$(X,Y,Z)$$, but a different relation is used: $$x = \frac{X}{Z^2}$$, $$y = \frac{Y}{Z^3}$$; in the López–Dahab system the relation is $$x = \frac{X}{Z}$$, $$y = \frac{Y}{Z^2}$$; in the modified Jacobian system the same relations are used but four coordinates are stored and used for calculations $$(X,Y,Z,aZ^4)$$; and in the Chudnovsky Jacobian system five coordinates are used $$(X,Y,Z,Z^2,Z^3)$$. Note that there may be different naming conventions, for example, IEEE P1363-2000 standard uses "projective coordinates" to refer to what is commonly called Jacobian coordinates. An additional speed-up is possible if mixed coordinates are used.

Fast reduction (NIST curves)
Reduction modulo p (which is needed for addition and multiplication) can be executed much faster if the prime p is a pseudo-Mersenne prime, that is $$p \approx 2^d$$; for example, $$p = 2^{521} - 1$$ or $$p = 2^{256} - 2^{32} - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1.$$ Compared to Barrett reduction, there can be an order of magnitude speed-up. The speed-up here is a practical rather than theoretical one, and derives from the fact that the moduli of numbers against numbers near powers of two can be performed efficiently by computers operating on binary numbers with bitwise operations.

The curves over $$\mathbb{F}_p$$ with pseudo-Mersenne p are recommended by NIST. Yet another advantage of the NIST curves is that they use a = −3, which improves addition in Jacobian coordinates.

According to Bernstein and Lange, many of the efficiency-related decisions in NIST FIPS 186-2 are suboptimal. Other curves are more secure and run just as fast.

Side-channel attacks
Unlike most other DLP systems (where it is possible to use the same procedure for squaring and multiplication), the EC addition is significantly different for doubling (P = Q) and general addition (P ≠ Q) depending on the coordinate system used. Consequently, it is important to counteract side-channel attacks (e.g., timing or simple/differential power analysis attacks) using, for example, fixed pattern window (a.k.a. comb) methods (note that this does not increase computation time). Alternatively one can use an Edwards curve; this is a special family of elliptic curves for which doubling and addition can be done with the same operation. Another concern for ECC-systems is the danger of fault attacks, especially when running on smart cards.

Backdoors
Cryptographic experts have expressed concerns that the National Security Agency has inserted a kleptographic backdoor into at least one elliptic curve-based pseudo random generator. Internal memos leaked by former NSA contractor Edward Snowden suggest that the NSA put a backdoor in the Dual EC DRBG standard. One analysis of the possible backdoor concluded that an adversary in possession of the algorithm's secret key could obtain encryption keys given only 32 bytes of PRNG output.

The SafeCurves project has been launched in order to catalog curves that are easy to implement securely and are designed in a fully publicly verifiable way to minimize the chance of a backdoor.

Quantum computing attack
Shor's algorithm can be used to break elliptic curve cryptography by computing discrete logarithms on a hypothetical quantum computer. The latest quantum resource estimates for breaking a curve with a 256-bit modulus (128-bit security level) are 2330 qubits and 126 billion Toffoli gates. For the binary elliptic curve case, 906 qubits are necessary (to break 128 bits of security). In comparison, using Shor's algorithm to break the RSA algorithm requires 4098 qubits and 5.2 trillion Toffoli gates for a 2048-bit RSA key, suggesting that ECC is an easier target for quantum computers than RSA. All of these figures vastly exceed any quantum computer that has ever been built, and estimates place the creation of such computers at a decade or more away.

Supersingular Isogeny Diffie–Hellman Key Exchange claimed to provide a post-quantum secure form of elliptic curve cryptography by using isogenies to implement Diffie–Hellman key exchanges. This key exchange uses much of the same field arithmetic as existing elliptic curve cryptography and requires computational and transmission overhead similar to many currently used public key systems. However, new classical attacks undermined the security of this protocol.

In August 2015, the NSA announced that it planned to transition "in the not distant future" to a new cipher suite that is resistant to quantum attacks. "Unfortunately, the growth of elliptic curve use has bumped up against the fact of continued progress in the research on quantum computing, necessitating a re-evaluation of our cryptographic strategy."

Invalid curve attack
When ECC is used in virtual machines, an attacker may use an invalid curve to get a complete PDH private key.

Alternative representations
Alternative representations of elliptic curves include:
 * Hessian curves
 * Edwards curves
 * Twisted curves
 * Twisted Hessian curves
 * Twisted Edwards curve
 * Doubling-oriented Doche–Icart–Kohel curve
 * Tripling-oriented Doche–Icart–Kohel curve
 * Jacobian curve
 * Montgomery curves

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/

title: Elliptic-curve cryptography


text:
EDM

EDM or E-DM may refer to:

Music

 * Electronic dance music
 * Early Day Miners, American band

Science and technology

 * Electric dipole moment
 * Electrical discharge machining
 * Electronic distance measurement
 * Entry, Descent, and landing demonstrator Module, like the Schiaparelli EDM
 * See also: Entry, descent and landing (EDL)

Computing

 * Educational data mining
 * Electronic document management
 * Empirical dynamic modeling
 * Enterprise data management
 * Enterprise data modeling
 * Enterprise decision management
 * Entity Data Model
 * Euclidean distance matrix
 * Experiment-directed metadynamics

Places

 * Edmonton, Alberta, Canada
 * Edmonds station, Edmonds, Washington, United States
 * Edward-Dean Museum & Gardens, Cherry Valley, California, United States

Politics

 * Early day motion

Other uses

 * Electronic Direct Mail. See Email marketing
 * Department of Essential Drugs and Medicines of the World Health Organization
 * Event-driven marketing
 * Master of Education (Ed.M.)
 * Electricidade de Moçambique, energy company of Mozambique
 * Einsatzstaffel der Deutschen Mannschaft, Croatian collaborationist military unit

title: EDM


text:
Eightfold path (policy analysis)

The eightfold path is a method of policy analysis assembled by Eugene Bardach, a professor at the Goldman School of Public Policy at the University of California, Berkeley. It is outlined in his book A Practical Guide for Policy Analysis: The Eightfold Path to More Effective Problem Solving, which is now in its seventh edition. The book is commonly referenced in public policy and public administration scholarship.

Bardach's procedure is as follows:
 * 1) Define the problem
 * 2) Assemble the evidence
 * 3) Construct the alternatives
 * 4) Select the criteria
 * 5) Project the outcomes
 * 6) Confront the trade-offs
 * 7) Decide
 * 8) Tell your story

A possible ninth step, based on Bardach's own writing, might be "repeat steps 1–8 as necessary."

The method is named after the Buddhist Noble Eightfold Path, but otherwise has no relation to it.

The New York taxi driver test
The New York taxi driver test is a technique for evaluating the effectiveness of communication between policy makers and analysts. Bardach contends that policy explanations must be clear and down-to-earth enough for a taxi driver to be able to understand the premise during a trip through city streets. The New York taxi driver is presumed to be both a non-specialist and a tough customer.

title: Eightfold path (policy analysis)


text:
Eden Project

The Eden Project (Edenva) is a visitor attraction in Cornwall, England. The project is located in a reclaimed china clay pit, located 2 km from the town of St Blazey and 5 km from the larger town of St Austell.

The complex is dominated by two huge enclosures consisting of adjoining domes that house thousands of plant species, and each enclosure emulates a natural biome. The biomes consist of hundreds of hexagonal and pentagonal ethylene tetrafluoroethylene (ETFE) inflated cells supported by geodesic tubular steel domes. The larger of the two biomes simulates a rainforest environment (and is the largest indoor rainforest in the world) and the second, a Mediterranean environment.

The attraction also has an outside botanical garden which is home to many plants and wildlife native to Cornwall and the UK in general; it also has many plants that provide an important and interesting backstory, for example, those with a prehistoric heritage.

There are plans to build an Eden Project North in the seaside town of Morecambe, Lancashire, with a focus on the marine environment.

History
The clay pit in which the project is sited was in use for over 160 years. In 1981, the pit was used by the BBC as the planet surface of Magrathea in the TV series the Hitchhiker's Guide to the Galaxy. By the mid-1990s the pit was all but exhausted.

The initial idea for the project dates back to 1996, with construction beginning in 1998. The work was hampered by torrential rain in the first few months of the project, and parts of the pit flooded as it sits 15 m below the water table.

The first part of the Eden Project, the visitor centre, opened to the public in May 2000. The first plants began arriving in September of that year, and the full site opened on 17 March 2001.

To counter criticism from environmental groups, the Eden Project committed to investigate a rail link to the site. The rail link was never built, and car parking on the site is still funded from revenue generated from general admission ticket sales.

The Eden Project was used as a filming location for the 2002 James Bond film Die Another Day. On 2 July 2005 The Eden Project hosted the "Africa Calling" concert of the Live 8 concert series. It has also provided some plants for the British Museum's Africa garden.

In 2005, the Project launched "A Time of Gifts" for the winter months, November to February. This features an ice rink covering the lake, with a small café-bar attached, as well as a Christmas market. Cornish choirs regularly perform in the biomes.

In 2007, the Eden Project campaigned unsuccessfully for £50 million in Big Lottery Fund money for a proposed desert biome. It received just 12.07% of the votes, the lowest for the four projects being considered. As part of the campaign, the Eden Project invited people all over Cornwall to try to break the world record for the biggest ever pub quiz as part of its campaign to bring £50 million of lottery funds to Cornwall.

In December 2009, much of the project, including both greenhouses, became available to navigate through Google Street View.

The Eden Trust revealed a trading loss of £1.3 million for 2012–13, on a turnover of £25.4 million. The Eden Project had posted a surplus of £136,000 for the previous year. In 2014 Eden accounts showed a surplus of £2 million.

The World Pasty Championships, an international competition to find the best Cornish pasties and other pasty-type savoury snacks, have been held at the Eden Project since 2012.

The Eden Project is said to have contributed over £1 billion to the Cornish economy. In 2016, Eden became home to Europe's second-largest redwood forest (after the Giants Grove at Birr Castle, Birr Castle, Ireland) when forty saplings of coast redwoods, Sequoia sempervirens, which could live for 4,000 years and reach 115 metres in height, were planted there.

The Eden Project received 1,010,095 visitors in 2019.

In December 2020 the project was closed after heavy rain caused several landslips at the site. Managers at the site are assessing the damage and will announce when the project will reopen on the company's website. Reopening became irrelevant as Covid lockdown measures in the UK indefinitely closed the venue from early 2021, though it had reopened by May 2021 after remedial works had taken place. The site was used for an event during the 2021 G7 Summit, hosted by the United Kingdom.

Design and construction
The project was conceived by Tim Smit and Jonathan Ball, and designed by Grimshaw Architects and structural engineering firm Anthony Hunt Associates (now part of Sinclair Knight Merz). Davis Langdon carried out the project management, Sir Robert McAlpine and Alfred McAlpine did the construction, MERO jointly designed and built the biome steel structures, the ETFE pillows that build the façade were realized by Vector Foiltec, and Arup was the services engineer, economic consultant, environmental engineer and transportation engineer. Land Use Consultants led the masterplan and landscape design. The project took 2½ years to construct and opened to the public on 17 March 2001.

Layout
Once into the attraction, there is a meandering path with views of the two biomes, planted landscapes, including vegetable gardens, and sculptures that include a giant bee and previously The WEEE Man (removed in 2016), a towering figure made from old electrical appliances and was meant to represent the average electrical waste used by one person in a lifetime.

Biomes
At the bottom of the pit are two covered biomes:

The Rainforest Biome, covers 1.56 ha and measures 55 m high, 100 m wide, and 200 m long. It is used for tropical plants, such as fruiting banana plants, coffee, rubber, and giant bamboo, and is kept at a tropical temperature and moisture level.

The Mediterranean Biome covers 0.654 ha and measures 35 m high, 65 m wide, and 135 m long. It houses familiar warm temperate and arid plants such as olives and grape vines and various sculptures.

The Outdoor Gardens represent the temperate regions of the world with plants such as tea, lavender, hops, hemp, and sunflowers, as well as local plant species.

The covered biomes are constructed from a tubular steel (hex-tri-hex) with mostly hexagonal external cladding panels made from the thermoplastic ETFE. Glass was avoided due to its weight and potential dangers. The cladding panels themselves are created from several layers of thin UV-transparent ETFE film, which are sealed around their perimeter and inflated to create a large cushion. The resulting cushion acts as a thermal blanket to the structure. The ETFE material is resistant to most stains, which simply wash off in the rain. If required, cleaning can be performed by abseilers. Although the ETFE is susceptible to punctures, these can be easily fixed with ETFE tape. The structure is completely self-supporting, with no internal supports, and takes the form of a geodesic structure. The panels vary in size up to 9 m across, with the largest at the top of the structure.

The ETFE technology was supplied and installed by the firm Vector Foiltec, which is also responsible for ongoing maintenance of the cladding. The steel spaceframe and cladding package (with Vector Foiltec as ETFE subcontractor) was designed, supplied and installed by MERO (UK) PLC, who also jointly developed the overall scheme geometry with the architect, Nicholas Grimshaw & Partners.

The entire build project was managed by McAlpine Joint Venture.

The Core
The Core is the latest addition to the site and opened in September 2005. It provides the Eden Project with an education facility, incorporating classrooms and exhibition spaces designed to help communicate Eden's central message about the relationship between people and plants. Accordingly, the building has taken its inspiration from plants, most noticeable in the form of the soaring timber roof, which gives the building its distinctive shape.

Grimshaw developed the geometry of the copper-clad roof in collaboration with a sculptor, Peter Randall-Page, and Mike Purvis of structural engineers SKM Anthony Hunts. It is derived from phyllotaxis, which is the mathematical basis for nearly all plant growth; the "opposing spirals" found in many plants such as the seeds in a sunflower's head, pine cones, and pineapples. The copper was obtained from traceable sources, and the Eden Project is working with Rio Tinto to explore the possibility of encouraging further traceable supply routes for metals, which would enable users to avoid metals mined unethically. The services and acoustic, mechanical, and electrical engineering design was carried out by Buro Happold.

Art at The Core
The Core is also home to art exhibitions throughout the year. A permanent installation entitled Seed, by Peter Randall-Page, occupies the anteroom. Seed is a large, 70 tonne egg-shaped stone installation standing some 13 ft tall and displaying a complex pattern of protrusions that are based upon the geometric and mathematical principles that underlie plant growth.

Environmental aspects
The biomes provide diverse growing conditions, and many plants are on display.

The Eden Project includes environmental education focusing on the interdependence of plants and people; plants are labelled with their medicinal uses. The massive amounts of water required to create the humid conditions of the Tropical Biome, and to serve the toilet facilities, are all sanitised rain water that would otherwise collect at the bottom of the quarry. The only mains water used is for hand washing and for cooking. The complex also uses Green Tariff Electricity – the energy comes from one of the many wind turbines in Cornwall, which were among the first in Europe.

In December 2010 the Eden Project received permission to build a geothermal electricity plant which will generate approx 4MWe, enough to supply Eden and about 5000 households. The project will involve geothermal heating as well as geothermal electricity. Cornwall Council and the European Union came up with the greater part of £16.8m required to start the project. First a well will be sunk nearly 3 miles (4.5 km) into the granite crust underneath Eden.

Eden co-founder, Sir Tim Smit said, "Since we began, Eden has had a dream that the world should be powered by renewable energy. The sun can provide massive solar power and the wind has been harnessed by humankind for thousands of years, but because both are intermittent and battery technology cannot yet store all we need there is a gap. We believe the answer lies beneath our feet in the heat underground that can be accessed by drilling technology that pumps water towards the centre of the Earth and brings it back up superheated to provide us with heat and electricity".

Drilling began in May 2021, and it was expected the project would be completed by 2023.

Eden Project Morecambe
In 2018, the Eden Project revealed its design for a new version of the project, located on the seafront in Morecambe, Lancashire. There will be biomes shaped like mussels and a focus on the marine environment. There will also be reimagined lidos, gardens, performance spaces, immersive experiences, and observatories.

Grimshaw are the architects for the project, which is expected to cost £80 million. The project is a partnership with the Lancashire Enterprise Partnership, Lancaster University, Lancashire County Council, and Lancaster City Council. In December 2018, the four local partners agreed to provide £1 million to develop the idea, which allowed the development of an outline planning application for the project. It is expected that there will be 500 jobs created and 8,000 visitors a day to the site.

Having been granted planning permission in January 2022 and with £50 million of levelling-up funding granted in January 2023, it is due to open in 2026 and predicted to benefit the North West economy by £200 million per year.

Eden Project Dundee
In May 2020, the Eden Project revealed plans to establish their first attraction in Scotland, and named Dundee as the proposed site of the location. The city's Camperdown Park was widely touted to be the proposed location of the new attraction however in May 2021, it was announced that the Eden Project had chosen the site of the former gasworks in Dundee as the location. It was planned that the new development would result in 200 new jobs and "contribute £27m a year to the regional economy". The project is in partnership with Dundee City Council, the University of Dundee and the Northwood Charitable Trust.

In 2021, Eden Project announced that they would establish fourteen hectares of new wildflower habitat in areas across Dundee, including Morgan Academy and Caird Park.

In July 2023, new images were released depicting what the Dundee attraction would look which accompanied the planning permission documents for the new attraction which would be submitted by autumn 2023.

Planning permission for the project was approved by Dundee City Council in June 2024.

South Downs
In 2020, Eastbourne Borough Council and the Eden Project announced a joint project to explore the viability of a new Eden site in the South Downs National Park.

Qingdao, China
In 2015, the Eden Project announced that it had reached an agreement to construct an Eden site in Qingdao, China. While the site had originally been slated to open by 2020, construction fell behind schedule due to the COVID-19 pandemic and the opening date was delayed to 2023. The new site is expected to focus on "water" and its central role in civilization and nature.

Eden Project New Zealand
A planned Eden Project for the New Zealand city of Christchurch, to be called Eden Project New Zealand/Eden Project Aotearoa, is expected to be inaugurated in 2025. It is to be centred close to the Avon River, on a site largely razed as a result of the 2011 Christchurch Earthquake.

Eden Sessions
Since 2002, the Project has hosted a series of musical performances, called the Eden Sessions, usually held during the summer. The 2020 sessions were postponed due to the COVID-19 pandemic and where rescheduled as the 2022 sessions lineup.

The 2024 sessions will be headlined by Fatboy Slim, Suede, Manic Street Preachers, The National, JLS, Crowded House, Rick Astley, Tom Grennan and Paolo Nutini.

In the media
The Eden Project has appeared in various television shows and films such as the James Bond film Die Another Day, The Bad Education Movie, in the Netflix series The Last Bus, in the CBeebies show Andy's Aquatic Adventure and in Armenia’s postcard in the Eurovision Song Contest 2023.

A weekly radio show called The Eden Radio Project is held every Thursday afternoon on Radio St Austell Bay.

On 18 November 2019, on the Trees A Crowd podcast, David Oakes would interview the Eden Project's Head of Interpretation, Dr Jo Elworthy, about the site.

title: Eden Project


text:
Talk:Evil

pushpinx
pushpins are mean and evil. evil is bad — Preceding unsigned comment added by 99.243.110.117 (talk) 18:59, 4 November 2019 (UTC)

A Commons file used on this page or its Wikidata item has been nominated for deletion
The following Wikimedia Commons file used on this page or its Wikidata item has been nominated for deletion: Participate in the deletion discussion at the. —Community Tech bot (talk) 04:26, 9 February 2020 (UTC)
 * Genghis Khan.jpg

Question of a universal definition.
I have rewritten the section: Question of a universal definition in a way that I think better discusses the topic it claims. If there are no comments or objections within a week, I will publish the changes. Thank you Jenhawk777 (talk) 23:04, 19 January 2021 (UTC)

A fundamental question is whether there is a universal, transcendent definition of evil, or whether one's definition of evil is determined by one's social or cultural background. C. S. Lewis, in The Abolition of Man, maintained that there are certain acts that are universally considered evil, such as rape and murder. However, the rape of women, by men, is found in every society, and there are more societies that see at least some versions of it, such as marital rape or punitive rape, as normative than there are societies that see all rape as non-normative (a crime). In nearly all societies, killing except for self-defense or duty is seen as murder. Yet the definition of self-defense and duty varies from one society to another. Stanley Milgram's 1974 experiments were designed to explain how thousands of ordinary, non-deviant, people could have reconciled themselves to a role in the Holocaust. He showed that ordinary humans have the capacity for evil behavior when influenced, manipulated, or pressed into it by authority figures. Social deviance is not uniformly defined across different cultures, and is not, in all circumstances, necessarily wrong, therefore it cannot be seen as a necessary or a sufficient characteristic of evil.

Defining evil is further complicated by its multiple, often ambiguous, common usages: evil is often used to describe the whole range of human suffering, including that caused by nature, and it is also used to describe all human immorality from the "evil of genocide to the evil of malicious gossip". It is sometimes thought of as the generic opposite of good. Marcus Singer asserts that these common connotations must be set aside as overgeneralized ideas that don't really describe the nature of evil. For example, the idea there can be such a thing as a 'necessary evil', which is doing what one dislikes, is untenable. "If something is really evil, it can't be necessary, and if it is really necessary, it can't be evil".

Renowned orthopedist and missionary to lepers, Dr. Paul Brand, asserts that pain is necessary, that it has a good and valuable purpose, that it fulfills that purpose well, and that it does so in a way nothing else can. Leprosy attacks the nerve cells that feel pain resulting in no more pain for the leper. Rather than no pain being a good, this prevents pain from fulfilling its purpose, which leads to ever increasing often catastrophic damage to the body of the leper. Congenital insensitivity to pain (CIP), also known as congenital analgesia, is a neurological disorder that prevents feeling pain. It "leads to self-mutilation in the first months of life and to bone fractures, multiple scars, osteomyelitis, joint deformities, and limb amputation as the children grow older. Mental retardation is common. Death from hyperpyrexia occurs within the first 3 years of life in almost 20% of the patients." Few with the disorder are able to live into adulthood. Pain "is of the utmost importance to the survival of the individual and [human] race". Evil cannot be correctly understood "(as some of the utilitarians once thought) [on] a simple hedonic scale on which pleasure appears as a plus, and pain as a minus".

In contemporary philosophy, there are two basic concepts of evil: a broad concept and a narrow concept. A broad concept defines evil simply as any and all pain and suffering: "The suffering of a toothache is evil, in the broad sense, as is a white lie". Yet, according to Singer and Brand, the broad definition of evil is problematic.

The narrow concept of evil involves moral condemnation, therefore it is ascribed only to moral agents and their actions. This eliminates natural disasters and animal suffering from consideration as evil: "When not guided by moral agents, forces of nature are neither "goods" nor "evils". They just are. Their "agency" routinely produces consequences vital to some forms of life and lethal to others".

The narrow definition of evil "picks out only the most morally despicable sorts of actions, characters, events, etc. As Marcus Singer puts it “‘evil’ [in this sense] … is the worst possible term of opprobrium imaginable”. Eve Garrard suggests that evil describes "particularly horrifying kinds of action which we feel are to be contrasted with more ordinary kinds of wrongdoing, as when for example we might say 'that action wasn't just wrong, it was positively evil'. The implication is that there is a qualitative, and not merely quantitative, difference between evil acts and other wrongful ones; evil acts are not just very bad or wrongful acts, but rather ones possessing some specially horrific quality." In this context, the concept of evil is one element in our whole nexus of moral concepts.   Jenhawk777 (talk) 23:04, 19 January 2021 (UTC)

 * Maybe it's just me, but this reads more like a school essay than a Wikipedia entry. I think we're getting a little too detailed into the various arguments. —  The Hand That Feeds You :Bite 14:08, 21 January 2021 (UTC)

 *  The Hand That Feeds You :Bite Okay, what do you suggest? Jenhawk777 (talk) 05:01, 22 January 2021 (UTC)
 *  The Hand That Feeds You :Bite There were originally two paragraphs on deviance that is not actually discussed in any of the literature on the nature of evil, the concept of evil, the definition of evil, that I found anywhere. I don't think anyone uses it as a definition of evil, but it was already there, which generally indicates someone was invested in it, so I left it and just shortened it, but that whole first paragraph could easily go.
 * Whether or not "pain and suffering" are adequate definitions of evil is the entire discussion so leaving any of the rest out would be counterproductive to the goal of an actual discussion of definitions. I am happy to rewrite in any style you think would be less essay-like. Please do make a suggestion. I believe cooperation produces the best result. Jenhawk777 (talk) 17:17, 22 January 2021 (UTC)

 * Hello!  The Hand That Feeds You :Bite Please don't just be negative, work with me. I think this is as short as I can make it, does this help?

 * Defining evil is complicated by its multiple, often ambiguous, common usages: evil is often used to describe the whole range of suffering, including that caused by nature, and it is also used to describe all human immorality from the "evil of genocide to the evil of malicious gossip". It is sometimes thought of as the generic opposite of good.  Marcus Singer asserts that these common connotations must be set aside as overgeneralized ideas that don't really describe the nature of evil.

 * In contemporary philosophy, there are two basic concepts of evil: a broad concept and a narrow concept. A broad concept defines evil simply as any and all pain and suffering: "any bad state of affairs, wrongful action, or character flaw". Yet, it is also asserted that evil cannot be correctly understood "(as some of the utilitarians once thought) [on] a simple hedonic scale on which pleasure appears as a plus, and pain as a minus", because pain "is of the utmost importance to the survival of the individual and [human] race".  Renowned orthopedist and missionary to lepers, Dr. Paul Brand explains that leprosy attacks the nerve cells that feel pain resulting in no more pain for the leper. Rather than "no pain" being a good, this leads to ever increasing often catastrophic damage to the body of the leper. According to Dr. Brand, pain is both necessary and a good.  As Marcus Singer says: "If something is really evil, it can't be necessary, and if it is really necessary, it can't be evil".

 * The narrow concept of evil involves moral condemnation, therefore it is ascribed only to moral agents and their actions. This eliminates natural disasters and animal suffering from consideration as evil: according to Claudia Card, "When not guided by moral agents, forces of nature are neither "goods" nor "evils". They just are. Their "agency" routinely produces consequences vital to some forms of life and lethal to others". The narrow definition of evil "picks out only the most morally despicable sorts of actions, characters, events, etc. “Evil [in this sense] … is the worst possible term of opprobrium imaginable”.  Eve Garrard suggests that evil describes "particularly horrifying kinds of action which we feel are to be contrasted with more ordinary kinds of wrongdoing, as when for example we might say 'that action wasn't just wrong, it was positively evil'. The implication is that there is a qualitative, and not merely quantitative, difference between evil acts and other wrongful ones; evil acts are not just very bad or wrongful acts, but rather ones possessing some specially horrific quality".  In this context, the concept of evil is one element in the whole nexus of moral concepts.

Jenhawk777 (talk) 19:02, 22 January 2021 (UTC)

Please don't ping me repeatedly, I don't always have time to check Wikipedia. I also have this page on my watchlist, so I'll get to respond when I can. I'll need time to read through this and I can't guarantee it'll be anytime soon. In the meanwhile, hopefully someone else offers advice. —  The Hand That Feeds You :Bite 14:27, 24 January 2021 (UTC)
 * I apologize. I made a false assumption, that's entirely on me. I appreciate that you responded and explained.Jenhawk777 (talk) 20:10, 24 January 2021 (UTC)

 * Well, this has been here for a week now, and all it has received is one non-participant response, so I am going to proceed on the assumption there is no one that objects or cares or whatever. I am going to be bold, and publish them accordingly.Jenhawk777 (talk) 04:13, 27 January 2021 (UTC)

Unlock please
Why is this page locked? When will it be unlocked?
 * The page is not technically locked, but semi-protected so that only autoconfirmed users can edit it. This is due to persistent vandalism. If you have any questions about Wikipedia, please ask at the Tea House. Remember, you should always sign your comments in talk pages by adding four tildes at the end. -- Alexf(talk) 11:12, 28 August 2021 (UTC)

Number 4
Please, cite the source correctly. 81.0.166.183 (talk) 04:15, 3 July 2022 (UTC)

 * You’re going to have to be more specific. I don’t know what you want done here. —  The Hand That Feeds You :Bite 15:17, 3 July 2022 (UTC)

title: Talk:Evil


text:
Talk:Elliptic-curve cryptography

Security analysis of ECC
Interesting research and summary of security for different ECC: https://safecurves.cr.yp.to/ — Preceding unsigned comment added by 153.46.253.213 (talk) 14:18, 4 August 2023 (UTC)

Cite required
From an earlier revision of the article:

''For comparison, in 2001 some experts are suggesting these sizes for various public key systems for a security level appropriate to major business transactions that require secrecy:

RSA (based on difficulty of factorisation) 1024 bits.

DSA (based on difficulty of discrete log for integers modulo a prime) 1024 bits.

ECC (based on difficulty of discrete log for discrete ECC system) 200 bits.''

I have removed this until it can be backed up firmly by a cite - instead, I have added external links to research papers in this field. -- The Anome

I refer you to What Wikipedia is not, item 9, and Most common Wikipedia faux pas "Deleting useful content". You have deleted some useful inline information and replaced it with external links. Bad idea. If you actually know anything about this subject and don't like my numbers, then change them, they are fairly fuzzy and there is no recognized reliable method for generating them. But don't delete them. You didn't even give a reason for deleting them. It is NOT necessary to give a cite for every single factlet on the whole of Wikipedia, and lack of a cite is NOT a good reason to delete content. I'll be back in a few days to revert the edit and maybe add some more discussion. -- Geronimo Jones

See www.nist.gov/encryption for a list of recommended elliptic curves. ANSI X9 requires a minimum of 80 bits of *symmetric key equivalent* security. THis means use of SHA-1 with 160 bit output, use of RSA/DSA with 1024 bit keys and use of ECC with 160 bit keys. Don Johnson

The references of 256 bit ECC keys providing 128-bit security need citation. Bdamm (talk) 17:23, 13 August 2018 (UTC)

Non-mathematical description needed
I'm sure as ECC becomes more common, lay-people will be looking for information about it. A lot of these people (like me) are rather put off by seeing mathematical functions in the introductory section. Could someone write a lay description of ECC that doesn't use mathematical symbols?

 * I tried to do this. --agr 12:10, 16 April 2006 (UTC)

 * A completely non-mathematical description of ECC is no more than that of PK crypto, so I doubt that it is actually possible to have it. GBL 16:48, 20 April 2006 (UTC)

 * I agree with the original poster - there needs to be an intermediate paragraph describing what's happening in simplified, analogous text before it launches into all the TeX stuff. 82.43.137.103 00:08, 18 February 2007 (UTC)

 * I agree, this is endemic on wikipedia maths articles. 93.97.48.217 (talk) 11:50, 1 August 2010 (UTC)

I think a simplified mathematical explanation is desperately needed. It should be possible to make an example that uses numbers small enough to fit on an 8 digit calculator and is more easily understood. How is key generation done? How do I use the keys to en/de-crypt something. I understand math, but I'm not a genius or have a PhD in it. How about explaining this in a way that a common person can understand it? Note that they did a fairly good job explaining RSA on that page, but have dropped the ball here. —Preceding unsigned comment added by 74.93.34.241 (talk) 13:38, 19 April 2010 (UTC)

+1 72.177.115.161 (talk) 06:58, 7 January 2012 (UTC)

Elliptic curves over ternary fields
Hello. In the introduction, the article states that elliptic curves used in cryptography are defined over prime or binary fields. However, mainly due to pairing-based cryptography, there has been interest in elliptic curves over ternary fields as well. augustojd 14:25, 2 April 2006 (UTC)

Pictures and intros
Removed from todo:
 * Please add a graph such as [a picture of EC over real numbers]

If a picture does not communicate any information there is no reason to include it (there is already such a picture in EC—there is no need to copy it to ECC). BTW, this talk page needs major clean up GBL 08:29, 18 April 2006 (UTC)
 * I don't think we need the mathematic intro, either. A reader can read the EC article if they need it. — Matt Crypto 08:45, 18 April 2006 (UTC)
 * There isn't much overlap between the math inro here and the EC article. ECC is a very specialized application of EC. Thanks for the cleanup here, btw. --agr 09:18, 18 April 2006 (UTC)
 * IMO Mathematical introduction is needed since it is about EC over finite fields and it is not described elsewhere, OTOH Introduction is about PK crypto and general EC and thus can be safely removed here and merged into PK and EC. GBL 16:48, 20 April 2006 (UTC)
 * Sorry, I don't agree. Even if a purely non-technical intro is not feasible, a less technical intro that summarizes the subject is totally appropriate and badly needed in this case.--agr 12:26, 21 April 2006 (UTC)

Resolved issues

 * mathematical description of ECC was added
 * 109-bit EC provides only 55 bits of security
 * a sentence given integers j and k ... was revised (it is not in the article any more)
 * MQV
 * Victor Miller link was incorrect

Factoring link
The link for factoring in "recent advances in factoring" points to the general factorization article; wouldn't the Integer factorization article be more appropriate in this case? lordspaz 16:21, 10 August 2006 (UTC)

Cryptographic schemes
Just to note...

> (Another factor is that ElGamal scheme is vulnerable to chosen-ciphertext attacks.) That's certainly not a real factor as e.g. plain RSA is vulnerable to chosen-ciphertext attacks as well. That's what the padding schemes are for (PCKS, OAEP, SAEP...).

> ...cryptography based on integer factorization (e.g., RSA) and finite-field cryptography (e.g., DSA). Well, both RSA and standard DSA are based on finite-field cryptography.

83.64.176.129 11:13, 27 August 2006 (UTC)

==== Actually, RSA is based on Rings, not finite-field - BrunoX 16:24, 29 November 2006 (UTC)

The section referencing RSA is wrong.
The introductory states that "... a user picks two large random primes as his private key, and publishes their product as his public key. The difficulty of factoring ensures that no one else can derive the private key (i.e., the two prime factors) from the public one within a reasonable amount of time." This is wrong. Consider the article RSA; in short, RSA generates two primes, p and q, but these are not the private key. The user then creates two exponents d and e, such that de = k(p-1)(q-1) for some k. (There are other restrictions on e, and I'm unsure if the two are really interchangeable.) Unless certain shortcuts are taken, both p and q are deleted at the end of the key generation process (though n = pq is retained).

In any case, this is a rather crucial distinction: in the system described in the article currently, the public key doesn't contain any information that the holder of the private key (assuming they somehow don't have the public key) doesn't already have, and so it doesn't make sense that it could be used to encrypt data that only they could decrypt.

I've rewritten it, but I'm not very happy with my layman's explanations of things. Future editors, please reference the actual operation of RSA before writing about it; there are a lot of misconceptions about cryptography out there. grendel|khan 21:09, 27 February 2008 (UTC)

In RSA, the private key has several equivalent forms, including (n,d) and (p,q). The previous version article was written using the latter in mind, which is fine. This emphasizes the dependence of RSA on integer factorization, while ignoring other details (such as the RSA problem being required to hard too).

With this new edit, the article now appears to suggest that p, one of the primes, is to be included in the public key. This would be wrong. Given n and p, one can recover q, and therefore determine the private key. From your talk page comment above, I gather that you meant e was the value to be made public, not p, but this was not made sufficiently clear in the article edit.

Either the current version should be clarified, or the article should be put back the way it was. DRLB (talk) 21:34, 27 February 2008 (UTC)

 * Yeah, I see how it looks like I'm talking about p and q rather than d and e (the user does create two primes, but they use those to create two different primes which are actually used in the keys--I don't stress that there are two sets of primes). Is it particularly vital to make this distinction? I'm not sure it adds anything to a layman's overview. grendel|khan 21:30, 28 February 2008 (UTC)

 * Well, neither d nor e need to be prime (although in practice e is often a fixed, but not a random prime), so by saying one prime is included in the public key and the other in the private key is strongly suggestive that p is made public, especially to those already familiar with RSA, as typically, the first thing one learns about RSA about is the secret primes p and q, whose product is difficult to factor. Maybe the article's reference to RSA should be simplified, just to say that is another public key cryptography scheme, which requires integer factorization to be hard, letting RSA explain the details.  —Preceding unsigned comment added by DRLB (talk • contribs) 22:47, 28 February 2008 (UTC)

 * To keep it simple the private is (p,q) and the public N=p*q. e and d can be introduced in the RSA article along with the RSA problem. Brusegadi (talk) 05:07, 28 February 2008 (UTC)

 * That's still not really accurate. The public key can't just include n; it also has to include e. The essential nature of RSA is that key operations are symmetric: what can be done with one key can only be undone with the other, and vice versa. The system as described is very much a one-way scheme, where the public key can be derived solely from the private key, but not vice versa, which is not how RSA works. The rewritten explanation describes it properly, as does somehow shoehorning in a mention of e in the original description. We shouldn't sacrifice accuracy while we're trying to make the explanation simpler. grendel|khan 21:30, 28 February 2008 (UTC)

 * While it's true that to use a public key, one has to also know the value of e, it is often not specified explicitly, rather all users of a given encryption product typically agree on a default value for e. For example, PGP uses 17 by default and will try other popular values. So e is a technicality that does not have to be discussed here. It has no confidentiality implications in usual practice. All the public key confidentiality is in n. --agr (talk) 22:54, 28 February 2008 (UTC)
 * I agree. The most important technical aspect might be   gcd(e,(p - 1)(q - 1))=1, and the fact that if you choose e such that d is smaller than N^(1/4) then RSA becomes vulnerable (D. Boneh and G. Durfee. Cryptanalysis of RSA with private key d less than N^(.292) . IEEE Trans. Inform. Theory, 46(4):1339-1349, 2000. ) according to my textbook is good further reading...  In summary, I see what grendel says, but I am not sure if adding the bit about e would make things too complicated.  Is there a third opinion thats somewhere in between proposals?    Brusegadi (talk) 03:02, 29 February 2008 (UTC)
 * Right, but that level of detail isn't needed in this article. --agr (talk) 04:19, 29 February 2008 (UTC)
 * Agreed. The article is about elliptic curve cryptography in general and not just one specific cryptosystem. Hence the introduction should compare the mathematical problems that are the basis of different classes of cryptosystems, i.e. integer factorisation vs. discrete logarithms over GF(p) vs. discrete logarithms over elliptic curves. Details about RSA do not belong here, simply because there are many other cryptosystmes that are also based on integer factorisation. 85.2.102.219 (talk) 06:35, 29 February 2008 (UTC)
 * Yet, we still should be careful about equating solving RSA to integer factorization... It is not proven that the only way to crack RSA is by factorization...  Am I being too picky?  Brusegadi (talk) 06:44, 29 February 2008 (UTC)
 * If you find such a mistake, fix it. Right now the article only claims that finding the private key is as difficult as factoring, which is correct. Still there is much room to improve the introduction. E.g., right now the introduction appears to claim that DSA is based on factorisation. 85.2.99.242 (talk) 19:12, 1 March 2008 (UTC)
 * Brusegadi's point is that in fact we don't know if  finding the private key is as difficult as factoring. That is the RSA problem. I tried to clarify the article on this point, without getting too far off topic.--agr (talk) 02:21, 2 March 2008 (UTC)
 * That is wrong. Rivest, Shamir and Adleman already showed in their original RSA paper that N can be factored in propabilistic polynimial time given N,e and d. But it is still unknown whether there exists another method for decrypting RSA that does not require the private key. 85.2.53.248 (talk) 07:58, 2 March 2008 (UTC)
 * Yeah, the RSA problem is to decipher without the private key, with e, N and Cipher text. We know we can do it if we factor, the question is, can we do it without factoring?  Thus, factoring is not equivalent to solving RSA although the first implies the second... (I am pretty sure of this, I was once penalized for saying they were equivalent...)  Brusegadi (talk) 08:24, 2 March 2008 (UTC)
 * Sorry, you're right, I missed that distinction, but I think the current article text still covers this point.--agr (talk) 12:41, 2 March 2008 (UTC)

Curve25519
I believe that Curve25519 can be considered a cipher in its own right, and have added a page for it; however, I lack the time to write a full article for it, so I have redirected it here for the time being (rather than provide a meaningless stub.) I am not sure whether a Curve25519 section in the ECC page makes more sense than its own page; I suspect that it is best handled in a dedicated page. But at least now there's something for it. NoDepositNoReturn (talk) 06:51, 14 June 2008 (UTC)

 * Looking at Bernstein's article "Curve25519: new Diffie-Hellman speed records", is see that the domain he use is y2 = x3 + ax2 + x which is different from the one presented on this page. Being a non expert in elliptic curve cryptography I would like to know if this makes a significant difference ? If I take this page by the word, curve25519 is not performing elliptic cryptography. — Preceding unsigned comment added by 134.158.16.169 (talk • contribs) 15:36, 25 March 2010

 * That is a Montgomery curve. If you look at that article, there is a section on how to convert it into the Weierstrass form used by this article. --cesarb (talk) 15:40, 12 October 2013 (UTC)

A Set forms a Group?
It's unhelpful to say that a set of points (x,y) forms a group, without giving some hint as to what the group operator is. How do (x1,y1) and (x2,y2) combine to form (x3,y3), also a solution? And why is the "point at infinity" (which point at infinity?) the identity element for this combination? 213.123.226.227

 * Good point, I've added a line about the source of the group. Skippydo (talk) 19:12, 4 October 2009 (UTC)

 * Speaking as an informed layman (i.e. I have some post-secondary mathematics study under my belt, but am neither a mathematician nor a cryptographer), I have no idea what the sentence you added there means, and the articles linked in it are basically incomprehensible to me.
 * What I do know is that the article still states that a set of points forms a group, which to my (admittedly basic) understanding of discrete mathematics simply cannot be true: a group consists of a set of items and an operator on those items.
 * Can somebody, please, add a simple explanation of what the operator in question actually is, and hence correct the clearly incorrect statement that "this set [of points on a curve plus a point at infinity] forms an Abelian group, with the point at infinity as identity element." 212.159.69.4 (talk) 20:15, 3 February 2010 (UTC)
 * I have added some wording referring to the group operation defined in the Elliptic curve article. The explanations there are admittedly very Bourbakish and therefore totally incomprehensible, but the theory shall not be replicated here - but instead fixed in the Elliptic curve article, IMHO. Dimawik (talk) 23:06, 3 February 2010 (UTC)
 * The group operation is referred to as "addition".

Design choices and ECC
This article is written almost entirely from the mathematical POV. There are other important POVs which should be reflected here.

For example, what guides a design choice to incorporate ECC vs. alternatives? How does ECC compare to alternatives such as RSA? e.g. the key length is shorter, computational complexity on each side of an exchange, etc. —Preceding unsigned comment added by 192.118.32.80 (talk) 08:46, 13 December 2009 (UTC)

Broken link in reference
The link hxxp://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml in reference 3 is broken. –84.157.71.42 (talk) —Preceding undated comment added 19:32, 17 June 2010 (UTC).

Generator
The article currently states that "For cryptographic application the order of G [...] must be prime." This agrees with SP800-56A, but the only references I have seen that justify a restriction on the order only say that it should be large and divisible by a large prime. (E.g., Algebraic aspects of cryptography, Neal Koblitz.) Does anyone know of a reason why the order would have to be prime? Doctorhook (talk) 20:24, 22 December 2010 (UTC)

 * You're right, it does not have to be prime. If it is not prime, then some complexity would be added to some protocols. For example, someone might choose a public key that has order 2, and that is useless. So it is customary to choose the generator to have prime order. Roger (talk) 22:48, 22 December 2010 (UTC)

External link one
The first of the external links shows a page with no substantial or interactive content to me? Gryllida 03:07, 21 November 2011 (UTC)

This is a link to a SAGE notebook. SAGE is an important open-source computer-algebra system. A notebook has to be run in your browser to use it -- when you just open it, without starting it, you see the source-code which may appear to be similar to TeX. To start the notebook just click "Evaluate". [BE] — Preceding unsigned comment added by BeEs1 (talk • contribs) 11:08, 1 December 2011 (UTC)

Quantum Computing Attack Citations
In reference to quantum computing attacks the article reads "Elliptic curve cryptography is vulnerable to a modified Shor's algorithm for solving the discrete logarithm problem on elliptic curves" with two citations. Looking through both of these citations, they both work over fields of prime order, with the latter paper explicitly stating that they did not consider fields of prime power order. If ECC over fields of prime power order is truly vulnerable to QC attacks, I think there should be a citation that references this. GromXXVII (talk) 22:20, 25 June 2012 (UTC)
 * Good catch! I updated the reference. If you need more information or have any other ideas, please share. Skippydo (talk) 01:58, 26 June 2012 (UTC)
 * I found a copy of the first 1997 Eicher reference if it is still of use: (cite tag: ). I (probably is) be outdated though, though it might be useful for background info (?). Jimw338 (talk) 04:18, 12 September 2016 (UTC)

I just rewrote the whole section with an updated citation and what I hope is both clearer wording and a more NPOV. Tarcieri (talk) 18:40, 3 November 2017 (UTC)

Possible NSA backdoor
I don't have the technical competence to write a section about this, but I think it is important to point out that there is serious speculation that the NSA inserted a backdoor into the NIST Special Publication 800-90 Dual_EC_DRBG elliptic curve pseudo random generator. If I understand the concern, it is basically that some defined constants in the standard are related to a second, unknown set of numbers, but whoever originally generated those constants does know those numbers. Cryptographic experts say that whoever knows those numbers can gain encryption keys given only 32 bytes of cyphertext.

The technical discussion of the issue is found in these sources:

http://www.wired.com/politics/security/commentary/securitymatters/2007/11/securitymatters_1115 http://eprint.iacr.org/2007/048.pdf http://rump2007.cr.yp.to/15-shumow.pdf

And some analysis of the possibility that these concerns are founded, based on leaks from Edward Snowden, is found here:

http://arstechnica.com/security/2013/09/the-nsas-work-to-make-crypto-worse-and-better/ — Preceding unsigned comment added by 24.126.40.36 (talk) 17:29, 6 September 2013 (UTC)

 * Wrong place here. Go to the Dual_EC_DRBG article. Besides this is about a specific random number generator. It's about a possible weakness on the practicality of the technique based on geometrical identity of elliptic curves, I think. Something like finding a twin to get the answer. Mightyname (talk) 20:39, 6 September 2013 (UTC)

 * I think it might be appropriate to mention it in the section about NIST-recommended elliptic curves. I think there are good sources in the Slashdot summary: http://it.slashdot.org/firehose.pl?op=view&type=story&sid=13/09/11/1224252 Yakatz (talk) 15:35, 11 September 2013 (UTC)

 * considering the gravity of the scandal, there should obviously be a paragraph dedicated to it here. Details can still go to Dual_EC_DRBG, but the topic needs to be given WP:SS treatment on this page, because this page is the first people will come to when they read about the "NSA ECC backdoor". --dab (𒁳) 10:10, 21 September 2013 (UTC)

 * I think this is quite out of topic and should be removed. Even though there are links between random number generation and cryptography, Dual_EC_DBRG is a random number generator, based on elliptic curves (the mathematical objects). This article should be about the cryptographic primitives.  12:46, 3 January 2014 (UTC)

 * I strongly disagree. There is no such thing as an NSA ECC backdoor (that we know of), there is an NSA Dual_EC_DBRG backdoor. Furthermore, the fact that elliptic curves were used as the construct for this RNG is a mere detail; the NSA could have just as easily based this upon modular exponentiation in integer fields. Elliptic curves just happen to be used by this backdoored construct, but this coincidence is only of interest in other articles. It is irrelevant here, especially when positioned actual implementation issues specific to elliptic curve cryptography. Please remove it here. — Preceding unsigned comment added by 130.89.106.70 (talk • contribs) 15:22, 17 March 2014 (UTC)

 * You should clearly read the text a little more closely. The fact that quotable sources are making comments about the possible untrustworthiness of the NSA-recommended elliptic curves, and hence on their use in ECC, is relevant in the section. —Quondum 18:09, 17 March 2014 (UTC)

Just have to agree with people saying it should be mentioned if only to disambiguate the issue from this page. I too expected to see something about it and had to read the talk page to understand that not all ECC was compromised. Only a very small number of potential readers here know enough to make the distinction required; the vast majority simply think ECC->NSA->backdoored. It's just the reality of the situation. — Preceding unsigned comment added by 68.45.155.10 (talk) 15:42, 22 January 2015 (UTC)

Group Order
The article states, under the heading "Domain Parameters," that
 * For cryptographic application the order of G, that is the smallest positive number n such that $$n G = \infty$$, is normally prime.

The order of an element G in an additive group is the smallest positive integer n such that $$nG = 0$$, not ∞ (Gallian, Contemporary Abstract Algebra, ch. 4). This needs to be fixed.

John (talk) 15:37, 3 November 2014 (UTC)

 * I believe either is accurate -- it's equal to the identity element of the group (denoted 0 (zero), O (uppercase o), or e), which is a point at infinity, specifically [0:1:0]. I suspect this is what the original author was trying to convey.... gurnec (talk) 21:33, 15 January 2015 (UTC)

External links modified
Hello fellow Wikipedians,

I have just modified 2 one external links on Elliptic curve cryptography. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
 * Added archive https://web.archive.org/web/20110719233751/https://www.certicom.com/index.php/2004-press-releases/36-2004-press-releases/300-solution-required-team-of-mathematicians-2600-computers-and-17-months- to http://www.certicom.com/index.php/2004-press-releases/36-2004-press-releases/300-solution-required-team-of-mathematicians-2600-computers-and-17-months-
 * Added archive https://web.archive.org/web/20060327202009/https://anziamj.austms.org.au:80/V44/CTAC2001/Hitc/Hitc.pdf to http://anziamj.austms.org.au/V44/CTAC2001/Hitc/Hitc.pdf

When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at ).

Archive link for anziamj.austms.org.au fails with 504 Gateway Timeout

Cheers.— InternetArchiveBot  (Report bug) 20:15, 11 September 2016 (UTC)

External links modified
Hello fellow Wikipedians,

I have just modified 1 one external link on Elliptic curve cryptography. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
 * Added archive https://web.archive.org/web/20090117023500/http://www.nsa.gov/business/programs/elliptic_curve.shtml to http://www.nsa.gov/business/programs/elliptic_curve.shtml

When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at ).

Cheers.— InternetArchiveBot  (Report bug) 02:32, 23 December 2016 (UTC)

External links modified
Hello fellow Wikipedians,

I have just modified 2 external links on Elliptic-curve cryptography. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
 * Added archive https://web.archive.org/web/20140503190338/http://eprint.iacr.org/2011/506 to https://eprint.iacr.org/2011/506
 * Added archive https://archive.is/20121208212741/http://wiki.crypto.rub.de/Buch/movies.php to http://wiki.crypto.rub.de/Buch/movies.php

When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.

Cheers.— InternetArchiveBot  (Report bug) 21:14, 19 September 2017 (UTC)

Algorithm needed
This article doesn't contain the algorithm for ECC like the RSA article does. — Preceding unsigned comment added by 198.52.160.180 (talk) 20:30, 6 December 2019 (UTC)

The first paragraph seems self-contradictory
The first paragraph states that ECC is based on finite fields, as opposed to non-EC cryptography, which is based on plain Galois fields. However, the referenced article on finite fields explains that finite fields and Galois fields are one and the same. I suspect the intended meaning is that non-EC crypto is based structures over finite fields which are not elliptic curves. If so, this is not clear from the text. I won't change the formulation myself, since I'm not an expert in the field. — Preceding unsigned comment added by VecLuci (talk • contribs) 04:13, 10 October 2018 (UTC)

Not a typo. 521, not 512.
"Five prime fields $$\mathbb{F}_p$$ for certain primes p of sizes 192, 224, 256, 384, and 521 bits. For each of the prime fields, one elliptic curve is recommended."

Should there be a footnote about that 521 not being a typo? It really is 521 (see among many, many sources) but it really looks like someone mis-typed "512". 76.216.220.191 (talk) 04:00, 28 December 2021 (UTC)

title: Talk:Elliptic-curve cryptography