Steve Weis

Elliptic curves are not generic. Long time coming. Congrats @crypto_theory and collaborators github.com/bochum-crypto/sub… What I said a week ago: It wouldn't surprise me in the least bit if there were a better factoring or discrete logarithm alg. For factoring: what is the chance that exp(n^1/3) is the right bound? who are we kidding? For discrete log over finite fields: better algorithms over Z_p have followed a decade or so behind those for small-char fields (Coppersmith'84 vs NFS a decade-ish later). Joux gave a quasi-poly alg over small-char fields in the 2010s. Porting to finite fields long overdue. For discrete log over elliptic curves: assuming that elliptic curve groups were "generic" is particularly preposterous given the rich structure they have. All of these ripe for disruption. Unstructured LPN would take me by real surprise, also unstructured LWE to a slightly lesser extent.