asciilifeform: ( a ptron is permitted to be invoked with any bitness that is multiple of 64 )
asciilifeform: mircea_popescu: it'd be many moar , to correctly handle cases of 1-7 word too
asciilifeform: 'sorry you can't have multiplication in algebraic - branch-free - form ! That Would Be Wrong'
asciilifeform: srsly this entire exercise has been a brainmelting tour of the sheer unfathomable worthlessness of 'the litarature', 'the cryptography komyoonity', et al
asciilifeform: ( nobody seems to have produced a branch-free montgomery-reduction algo. or any other division-free modexp. )
asciilifeform: for simplicity, tested the case that actually happens in practice: on a 64bit box, any ffa width over 512 bits gives a strictly 8-wide comba mult ocurrence☟︎
asciilifeform: ( my distaste for it comes largely from it not being rsa, and from a suspicion that enemy has a partial pill against discrete logarithm problem , given that dsa was based on same )
asciilifeform: now if you want a pubkeycrypto where this proof actually exists, i know of exactly one : cramer-shoup
asciilifeform: thing ~assumes~ own conclusion ! acquinas-style.
asciilifeform: ''When RSA is the underlying primitive, something even more is known: that the ability to forge with resources R in an attack which does not exploit some structural characteristic of the MGF implies the ability to invert RSA on random strings using computational resources only slightly greater than R.''