YT YouTube2Text

YouTube2Text → Transcripts → 【高校数学でよく寝れる】暗号マニアの僕が語りたい、楕円曲線暗号のビューチホー

【高校数学でよく寝れる】暗号マニアの僕が語りたい、楕円曲線暗号のビューチホー — Transcript

by 海外Yパパラジオ　世界を読み解く · 4,348 words · 669 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:01In the time between you tapping this
0:02video and the audio starting, your
0:04smartphone and the YouTube server have
0:06quietly completed a cryptographic
0:08handshake. They exchanged keys so that
0:11even if intercepted, it wouldn't matter
0:13, and that's how this audio is playing.
0:16The technology that has consistently
0:18powered those handshakes is today's
0:20star: Elliptic Curve Cryptography. In
0:22the last 20 years, this Elliptic Curve
0:24Cryptography has pushed RSA, the
0:26champion of the previous era, out of
0:29the forefront of global communication.
0:32The reason is simple: it only needs 1/
0:3512th the key length to achieve the same
0:38strength, so where RSA requires 3072
0:41bits, Elliptic Curve only needs 256.
0:44It's lightweight, yet just as strong.
0:47Why does something that sounds like
0:49magic happen? Today, I’m going to
0:51spend 20 minutes slowly digging into
0:53just this one question.
0:54Kaigai Waipa Radio.
0:56Hello everyone, how are you? This is
0:58Kaigai Waipa. I've lived in Shanghai,
1:02New York, and New Zealand, and now I
1:04live in Singapore with my family. I
1:07share information about the world as
1:09seen from the front lines of the Asian
1:11economy, from my own unique perspective
1:13. I should mention upfront that today
1:15isn't our usual economic talk; it's
1:17more like a university liberal arts
1:19lecture. Some mathematical formulas
1:22will appear. However, every formula is
1:25paired with an analogy, so even if you
1:28gloss over the math and just follow the
1:30analogies, you won't get lost. Also,
1:33since I'll be speaking in a calm,
1:34steady tone today, I think it's
1:36actually suitable for listening to
1:38before bed. It’s perfectly fine if
1:40you fall asleep halfway through. The
1:42cryptography isn't going anywhere, so
1:44just pick up where you left off
1:45tomorrow night. There are three main
1:47points to discuss. First, why the
1:49previous champion, RSA, saw its keys
1:52constantly growing larger. Second, what
1:55the challenger, Elliptic Curve, is
1:57doing mathematically. This is the main
2:00part of today's show. Third. How that
2:03lightness is reshaping the world and
2:05what will happen in the future. Let's
2:07get started. First point. It’s about
2:10the former champion, RSA. How does it
2:13work, and why did the keys keep getting
2:15bigger? A 30-second premise. Internet
2:19communication is designed on the
2:20assumption that it could be intercepted
2:22along the way. That is why we use
2:24encryption. But traditional encryption
2:27had a fundamental problem: how do you
2:29get the key to the other person?
2:32Because the communication sending the
2:34key can also be intercepted. Public-key
2:37cryptography solved this in the 1970s
2:39with a shift in perspective. Imagine it
2:43as scattering open padlocks around the
2:46world, split into two keys: one for
2:48locking and one for opening. Anyone can
2:52snap it shut. But only the person with
2:55the key can open it. Since the tool to
2:59lock it can be shared, it’s "public."
3:02This padlock was created using math and
3:05revealed to the world in 1977 by Rivest
3:08, Shamir, and Adleman at MIT. Taking
3:13their initials, it’s called RSA. They
3:16focused on the asymmetry between
3:18multiplication and prime factorization.
3:21Multiplying prime numbers together is
3:23instantaneous. 3 times 11 equals 33.
3:30But if you're asked to factor 33 back
3:32into primes, it's easy for small
3:34numbers, but suddenly becomes hopeless
3:36with hundreds of digits. Except for the
3:40person who multiplied them, even a
3:42supercomputer couldn't reverse it in a
3:44realistic timeframe. Going is a breeze;
3:47returning is a nightmare. RSA is what
3:51turned this one-way street into a
3:53padlock. To explain the mechanism a bit
3:56more properly, it works like this. I'll
3:58put the detailed formulas on the screen
4:01, so you can just follow the flow by
4:02ear. Prepare two secret prime numbers,
4:07P and Q, and multiply them to get N.
4:10Release this N along with another
4:12number, E, used for encryption. This is
4:15the public key. It's the open padlock
4:18from before. When someone wants to send
4:22me a message M, they take M to the
4:24power of E and send the remainder when
4:26divided by N. Written as a formula:
4:28ciphertext C equals M to the E mod N.
4:31You can think of this "mod" as a
4:33division remainder, like a clock
4:35calculation. Like how 13:00 becomes
4:391:00. It's just like that. Upon
4:42receiving it, I use my secret number D
4:44to take C to the power of D and find
4:46the remainder when divided by N. Then,
4:49magically, it perfectly returns to the
4:52original message M. This D can only be
4:54created by someone who knows the prime
4:57numbers P and Q. E and D are chosen so
4:59that when multiplied, the remainder is
5:021 when divided by (P-1) times (Q-1).
5:05The proof that it loops back to the
5:07start is a tool from first-year
5:09university number theory called
5:10Fermat's Little Theorem. Today, we'll
5:12proceed with the understanding that
5:14it's just clock magic, where going
5:16around the world of remainders returns
5:18you to the start. Let's run through it
5:20once with small numbers. p = 3, Q = 11,
5:24multiply them for N = 33, and let E = 3
5:29. Let's assume the message you want to
5:32send is 2. Raise 2 to the 3rd power to
5:34get 8. Dividing by 33 leaves it as 8,
5:38so the ciphertext is 8. I receive it
5:42and raise 8 to the 7th power with my
5:44secret d = 7. That's about 2.1 million.
5:49Divide this by 33, and the remainder is
5:52exactly 2. It successfully returned to
5:55the original message. It's okay if you
5:58tuned out the numbers just now. There
6:00is only one thing I want you to take
6:01away. Go with E, and return with D. The
6:04return key D can only be created by
6:07someone who knows the prime factors.
6:10This is everything about RSA. RSA was
6:13king for about 30 years, but it had one
6:16fundamental weakness. A shortcut was
6:20found by the attacking side. There is a
6:22famous story about this. In 1977, along
6:26with the announcement of RSA, a
6:29challenge was set to factorize a 129-
6:32digit number. The estimate at the time
6:37was 4 years to solve it, but in fact,
6:39just 17 years later in 1994, volunteers
6:42from around the world brought their
6:44computers together and solved it. 4
6:48years turned into 17 years. What
6:51happened was not just that computers
6:53became faster, but that algorithms
6:55evolved. A family of shortcuts called "
6:59sieve methods," far faster than brute
7:01force, was discovered for prime
7:03factorization. What cracked the 129
7:06digits was the Quadratic Sieve, and
7:09later, the even faster General Number
7:11Field Sieve became the standard. It’s
7:15like thinking you had to climb a cliff
7:17head-on, only to find a spiral
7:18staircase on the back that kept getting
7:20improved every year. The staircase is
7:24long and narrow. Even so, it's orders
7:26of magnitude easier than climbing the
7:29cliff. In technical terms, this
7:30staircase is called a sub-exponential
7:33time algorithm. It is much faster than
7:36the exponential time of brute force,
7:38but slower than the polynomial time of
7:40ordinary calculations—a middle-ground
7:42speed. For ciphers where a shortcut is
7:46found, you have no choice but to keep
7:48lengthening the key and raising the
7:49wall. In fact, 512-bit RSA was broken
7:54in 1999, and by 2020, 829-bit RSA had
7:58fallen. That is why the minimum
8:01standard today is 2048 bits. For robust
8:04security, use 3072 bits. Incidentally,
8:09a 3072-bit RSA key is a 925-digit
8:12number in decimal. You couldn't fit it
8:16on a business card, even if you filled
8:18both sides. And to make matters worse,
8:22with the number field sieve, doubling
8:24the key length doesn't double the
8:26security. It’s an arms race where
8:29only the defender gets exhausted. If
8:32you want 256-bit level security in the
8:35future, you'd need a 15,360-bit RSA key
8:39. At that point, it’s less of a
8:41cipher and more of a burden. You
8:43couldn't possibly fit a key like that
8:45on an IC card or a small sensor. So,
8:48this brings us to the question. Is
8:51there no mountain out there with no
8:53shortcuts? Second, the main dish of the
8:56day. The story of finding that mountain
8:58with no shortcuts. Elliptic curves.
9:03Let's turn the clock back to 1985, when
9:05mathematicians Koblitz and Miller
9:07separately made the exact same proposal
9:10. Why not move the foundation of
9:13cryptography from prime factorization
9:15to elliptic curves? An elliptic curve
9:19is a curve defined by the equation y
9:21squared equals x cubed plus ax plus b.
9:26Despite the name "elliptic," it's not
9:28actually an ellipse. It originated
9:31historically from research into
9:33calculating the length of circular arcs
9:35, so "elliptic" remains in the name.
9:37When graphed, it's a gently undulating
9:39curve that's symmetrical vertically. Up
9:42to this point, it's just a curve. The
9:45interesting part starts here: you can
9:47define a unique kind of addition on
9:49this curve. Adding point P and point Q
9:52on the curve. How do we do it? We
9:55connect the two points with a straight
9:57line. Due to the properties of cubic
10:00equations, that line will always
10:01intersect the curve exactly one more
10:03time. You then reflect that third
10:07intersection point across the x-axis.
10:10We call the resulting point P plus Q.
10:12This is elliptic curve addition. It's
10:15similar to imagining a game of
10:16billiards. If you take a shot along the
10:19line connecting two balls, it hits a
10:21point on the table and bounces to a
10:23stop. That final position is the result
10:25of the addition. To add the same point
10:29twice, P plus P, you draw a tangent
10:31line to the curve at P and do the same
10:33thing. This gives you 2P. Add P to 2P,
10:38and you get 3P. If you repeat this, you
10:41can even create 1 trillion P. You might
10:43be thinking, "How on earth is that
10:45addition?" However, even if you change
10:47the order of operations or where you
10:49place the parentheses, the result is
10:51the same, and there’s even a special
10:53point that acts as zero. You can
10:55actually prove that it fulfills all the
10:57requirements to be called addition. In
10:59mathematics, this type of collection is
11:01called a group. It basically means a
11:04world where the "addition game" works
11:06perfectly. It's one of the first things
11:09you learn in university-level
11:10mathematics. But the diagrams so far
11:12were smooth curves of real numbers. In
11:15actual cryptography, to bring it into a
11:18finite world where error-free
11:19calculations are possible, we move this
11:22entire curve into a clock-like world.
11:25We think only in terms of dividing all
11:27coordinates by a massive prime number
11:29P. It’s the world of modular
11:30arithmetic we talked about earlier. You
11:32can visualize everything using this "
11:34clock arithmetic" that only considers
11:36remainders. If it’s 10 o'clock now,
11:40what time is it 4 hours later? 10 + 4
11:43is 14, but on a clock, the answer is 2.
11:47That’s because we are only looking at
11:49the remainder of 14 divided by 12. In
11:53this world, you can do addition and
11:55multiplication as usual, and the answer
11:57always falls between 0 and 11. Since
12:01the numbers don't grow infinitely, it's
12:03perfect for computers.
12:06There is also one other property that
12:07is vital for cryptography. Looking at
12:10the answer "2 o'clock" alone, you can't
12:13tell if it was 4 hours after 10 o'clock
12:15or 4 hours after 22 o'clock, right? In
12:18the world of remainders, the record of
12:20where you started disappears. This
12:22property, which makes it hard to trace
12:24back from the answer, comes into play
12:26later. Now, let’s bring the topic
12:28back to elliptic curves. What happens
12:30when we move them to this world of
12:32remainders? The smooth curve turns into
12:35a collection of scattered points. It
12:38looks like a starry sky, with points
12:40spread out randomly across the screen.
12:42The visual appearance of a curve
12:44completely disappears. But
12:46interestingly, the rules of addition
12:48survive intact in the form of equations
12:50. That said, it doesn't mean we’re
12:52drawing lines with a ruler across the
12:54starry sky. We just use the calculation
12:56formulas corresponding to the previous
12:58constructions, directly within this
13:00world of remainders. I'll show that
13:02formula just once. If we set the slope
13:05of the line connecting two points as
13:07lambda, the x-coordinate of the sum is
13:09lambda squared minus the x-coordinates
13:11of the original two points. It consists
13:13entirely of basic arithmetic operations
13:15. For those wondering how division
13:17works, you're sharp. Since there are no
13:19decimals in the world of remainders, we
13:21replace division with multiplying by
13:23the reciprocal. For example, in a world
13:26modulo 7, 3 times 5 is 15, and the
13:29remainder is 1. Because multiplying
13:32them returns 1, 5 is the reciprocal of
13:343. It is proven that if p is a prime
13:37number, every number has this
13:38counterpart, so all four arithmetic
13:40operations work in the world of
13:42remainders. You don't need to memorize
13:45this by ear. Even among the stars, the
13:48rules of billiards still apply. If you
13:50take just that away with you, it’s
13:52enough. Now, this is the core of
13:54today's topic. A powerful one-way
13:57street is hidden in this starry
13:59billiard game. We choose a starting
14:03point, point G. Then, we calculate
14:06point KG by adding G to itself K times.
14:11K is a massive number with about 78
14:14digits in base 10. If you added them up
14:18one by one, the universe would end
14:19before you finished. However, the
14:21calculator has a doubling trick up
14:23their sleeve. Add G and G to get 2G,
14:28then add 2G to itself to get 4G; by
14:31doubling like 8G, 16G, and 32G, you can
14:35advance quickly. By combining this
14:40doubling with occasional additions, you
14:42can reach KG in just a few hundred
14:44steps, no matter how huge the number is
14:46. I want you to recall the addition we
14:50established earlier. Even though we
14:52call it doubling, there are no new
14:54tools involved. 2G is adding G to G,
14:57the same point, so we use the tangent
14:59rule from before. 4G is 2G plus 2G,
15:03which is also a tangent. And when
15:07adding different points, like 8G and 4G
15:09, we use the chord rule. Everything is
15:12built on that single addition from the
15:14billiard game. Let's try it once with a
15:16small number. Suppose we want to get
15:2013G. Since 13 is 8 + 4 + 1, we first
15:25double G three times to get 2G, 4G, and
15:298G. Next, we add 8G and 4G to get 12G.
15:36Finally, we add G to get 13G. Instead
15:40of adding 13 times, we reach the goal
15:42in just 5 moves. The logic is the same
15:46even if K has 78 digits; doubling
15:48covers most of the distance, so it only
15:50takes a few hundred steps. It's like
15:52how folding a piece of paper 42 times
15:54would reach the moon. That is the power
15:56of that multiplication. That is why
15:58only those who know K can reach the
16:00goal in an instant. However, the
16:02reverse direction is different. If you
16:05are only given the start point G and
16:07the goal point kG and asked, "How many
16:09times was it added? What is K?", it
16:12becomes hopelessly difficult. It is
16:16like a game where you are shown only
16:17the first bullet and the final position
16:19of the bullet, and you have to guess
16:21how many shots were fired. The
16:23trajectory in between jumps randomly
16:25through the starry sky, leaving no
16:27footprints whatsoever. This is the
16:29elliptic curve discrete logarithm
16:31problem. And the true nature of the
16:36elliptic curve cryptography private key
16:38is this K, which is the number of times
16:40it was added. The public key is the
16:44position where the bullet landed, kG.
16:46At this point, sharp observers might
16:48think this: "Wait a minute, didn't
16:50everyone think prime factorization was
16:52impossible at first, too?""Won't a
16:55spiral staircase be found eventually?"
16:57That is a good question. So why is it
16:59that a shortcut was found for integer
17:02prime factorization, but none has been
17:04found for elliptic curves even 40 years
17:06after their proposal? What do you think
17:09is the difference between the two?
17:11Please think about it for a moment.
17:13Well? Actually, this is a point often
17:16glossed over in textbooks, but I think
17:18it is the most beautiful point of the
17:20day. The answer lies in whether or not
17:24you can use a scaffolding for an attack
17:26. Shortcut algorithms like the number
17:29field sieve actually relied on the rich
17:31properties of integers. In the world of
17:35integers, there are many structures
17:37that can be used as tools, such as
17:39being divisible by small primes or
17:41being smoothly factorable. The shortcut
17:43"spiral staircase" was built using
17:45those structures as scaffolding.
17:47However, even though there is structure
17:50in the points of an elliptic curve, we
17:52cannot find scaffolding equivalent to "
17:54smooth factorability." Addition is
17:57possible, but it simply refuses to show
18:00a face like "divisible by primes." We
18:03still cannot find the scaffolding
18:05needed to build a staircase. Of course,
18:07it has not been proven that a shortcut
18:09definitely does not exist. But for 40
18:12years, mathematicians around the world
18:14have challenged it, and not a single
18:16shortcut to a properly chosen curve has
18:18been found yet. This is where the
18:21research stands today. For a properly
18:23chosen curve, the best general attack
18:25currently known is Pollard's rho
18:27algorithm, which searches for a
18:29coincidental collision. It uses the "
18:34birthday paradox," where in a class of
18:3623 people, there's a 50%chance of a
18:39shared birthday. However, even with
18:42this, the computational complexity only
18:44drops to the square root of the
18:46brute-force search. This difference
18:48translates directly to the length of
18:49the key. A square-root attack on a 256-
18:53bit elliptic curve takes 2 to the 128th
18:56power steps; to put that in perspective
18:59, even with a billion computers trying
19:01a billion times per second, it would
19:04take 700 times the age of the universe.
19:08In short, 256 bits is effectively
19:11unbeatable. RSA, on the other hand,
19:14requires 3072 bits to reach the same 2
19:16to the 128th power level of strength
19:19because of its mathematical structure.
19:23Yes, we've now circled back to the 1/
19:2512th figure from the start. It’s not
19:30magic; the only difference is whether
19:32or not there’s a shortcut for the
19:33attacker. Finally, let me show you the
19:37most elegant example of how this
19:39one-way function works in reality.
19:42It’s the key handshake over an
19:43encrypted line mentioned at the
19:45beginning. I choose a secret number A
19:48and make the point AG public, which is
19:51G calculated A times. The other party
19:54chooses a secret B and makes BG public.
19:57I take the BG I received and calculate
20:00it A times. The other party takes the
20:03AG they received and calculates it B
20:05times. And just like that, we both
20:07arrive at the same point, ABG. Since A
20:12times B is the same as B times A, even
20:15though an eavesdropper only sees G, AG,
20:18and BG, they can't create ABG from that
20:20. That’s because A and B cannot be
20:24calculated backward. By the way, on the
20:29actual web, this handshake is combined
20:31with certificates and signatures to
20:33verify if the other party is legitimate
20:35. The commutative law of multiplication
20:38we learn in elementary school is what
20:40currently supports handshakes for
20:42communication worldwide. When I first
20:46understood this, I actually got
20:47goosebumps. That covers all the
20:50mathematical reasons why it’s both
20:52lightweight and strong. Oh, and I
20:55should cover what this lightness
20:57actually caused in the real world.
20:59Third, let’s talk about how this
21:01lightness has reshaped the world. I'll
21:06go over how its efficiency led to its
21:08spread, the trust-related incidents
21:10that occurred along the way, and
21:12finally, the next era involving quantum
21:15computers. Having a key 1/12th the size
21:18for the same strength makes a massive
21:20difference in practice. First,
21:23regarding data volume, which is a
21:26different figure from key length, when
21:28compared at the same strength, the data
21:31sent as a signature is 64 bytes for
21:33elliptic curves versus 384 for RSA.
21:38That's it. Next are batteries and
21:40components: IC cards, car smart keys,
21:43and small IoT sensors. Even with such
21:45low-power chips, elliptic curves can
21:47create signatures at a decent speed.
21:49And another quiet benefit is key
21:51generation. With RSA, every time you
21:54make a key, you have to find two
21:56massive prime numbers, almost like a
21:58lottery. For elliptic curves, you just
22:01pick one 256-bit random number, and
22:03that is your private key. Just roll the
22:06dice and you're done. For the record,
22:08if you are only verifying signatures,
22:10RSA is actually faster, which is why it
22:13is still active in older systems and
22:15many certificates. But overall,
22:18elliptic curves are lighter to create,
22:21send, and carry around. That’s why
22:23the shift toward them has been a
22:24one-way street. In 2005, the U.S.
22:27National Security Agency (NSA) set
22:30elliptic curves as their recommended
22:32cryptographic suite for secret
22:34communications. In 2009, Bitcoin
22:38appeared and entrusted the entire proof
22:40of coin ownership to elliptic curve
22:43signatures. The secret behind Bitcoin
22:46is literally that 256-bit number
22:48representing how many times the point
22:50was added. The ownership of the heart
22:54of that massive market cap hangs on the
22:56assumption that the discrete logarithm
22:58problem cannot be solved. Since my job
23:01is asset management, I still find it
23:03quite radical that a vault for assets
23:05is just a single mathematical formula,
23:08rather than something physical or legal
23:10. Also, smartphone messaging apps like
23:14Signal and WhatsApp use elliptic curves
23:16for end-to-end encryption. Even in
23:19current web standards, elliptic curves
23:21have become the mainstream for key
23:23exchange. The changing of the guard is
23:26complete. However, there is one famous
23:28dark side to this history of transition
23:30. Researchers had pointed out early on
23:35that the Dual_EC elliptic curve-based
23:37mechanism, adopted as a standard for
23:39random number generation, could have a
23:41backdoor embedded by its designer
23:43depending on the choice of constants.
23:48Then, following the 2013 Snowden leaks,
23:51suspicions grew that the NSA had indeed
23:54tried to plant a backdoor in the
23:56standard. Furthermore, Reuters reported
24:02that the NSA paid the major security
24:05firm RSA Security $ 10 million to set
24:07that mechanism as the default in their
24:10products. And it was none other than
24:13RSA, the company that bore the name.
24:17The company denied these reports, but
24:19the Dual_EC method in question was
24:22officially removed from US standards in
24:242015. The lesson this incident left for
24:27the industry is quite interesting. You
24:30can trust the mathematics of the curves
24:32. But you cannot necessarily trust the
24:34people who chose the constants for
24:36those curves. Fanned by this distrust,
24:40Curve25519, designed by a researcher
24:43named Bernstein, suddenly took off. He
24:49published all the reasons for his
24:50choice of coefficients, effectively
24:52saying, "I have nothing hidden up my
24:54sleeve." Today, this curve is widely
24:58used for handshakes in smartphones and
25:01on the web. So, are elliptic curves the
25:04eternal champions? Actually, the date
25:07of their retirement is starting to come
25:09into view. It's quantum computers. As
25:14early as 1994, a mathematician named
25:16Shor theoretically proved that if a
25:19large-scale quantum computer is built,
25:21prime factorization and discrete
25:23logarithms can be solved in a realistic
25:25timeframe. The day that becomes a
25:28reality, both RSA and elliptic curves
25:30will collapse from their foundations.
25:33Ironically, because their keys are
25:34shorter, estimates suggest elliptic
25:37curves will be broken with fewer qubits
25:39, meaning they are likely to be
25:41defeated first. So, their strength now
25:44becomes their weakness. That is why the
25:46world is currently preparing for its
25:48third migration. A migration to yet
25:50another mathematical mountain known as
25:52lattice-based cryptography. In 2024, US
25:55standardization bodies finalized the
25:57first post-quantum cryptography
25:59standards, and apps like Apple Messages
26:02have already begun layering elliptic
26:04curves with lattice cryptography. The
26:07interesting part is the key size. With
26:10the primary standard method, the public
26:13key is over 1,000 bytes, which is more
26:15than 30 times larger than the 32 bytes
26:18elliptic curves required. The keys are
26:21getting fat again. Finally, a little
26:24bit about my own perspective. The fact
26:26that "lightweight yet strong" was never
26:28something to be taken for granted. In
26:31the world of tools, aren't lightness
26:33and strength usually a trade-off? Light
26:36armor is thin, and sturdy safes are
26:38heavy. Yet, elliptic curve cryptography
26:42managed to be both lightweight and
26:44strong for 40 years. The reason isn't
26:47because humans worked hard to make it
26:49that way, is it? The world of heaven
26:52borrows the inherent property of
26:54mathematics that there are no
26:56overlapping footholds for attackers to
26:58use. Human ingenuity will eventually be
27:02outsmarted. But for 40 years, no one
27:05has been able to outsmart an opponent
27:07with no overlapping footholds. The idea
27:11that the strongest defense is to offer
27:13no shortcuts feels like a Zen riddle,
27:15which I find truly beautiful. And
27:18there's another thing; as seen in the
27:20Dual_EC incident, the trust in
27:22cryptography isn't complete with
27:24mathematical proofs alone. Who chose
27:27those constants? Was the
27:29decision-making process transparent?
27:32Mathematics doesn't lie, but it is
27:34humans and institutions that implement
27:36it. The structure here is exactly the
27:39same as the trust involved in currency
27:41or finance. For those who watch this
27:44channel regularly, this probably
27:46strikes a chord.
27:48So, here is today's summary. The
27:50strength of cryptography is determined
27:52by whether there is a shortcut for the
27:54attacker. A spiral staircase was found
27:56for prime factorization, so RSA keys
27:58kept getting fatter. In the starry-sky
28:00billiards of elliptic curves, no
28:02shortcut has been found for 40 years.
28:04That’s why a 256-bit key provides the
28:08same strength as a 3072-bit RSA key.
28:11This is the answer. Those who listened
28:13this far probably have a knack for the
28:15sciences. If you fell asleep midway,
28:18that is actually a perfectly correct
28:20way to use this video. Good night. Also
28:23, for those who studied math at
28:24university, I’m sure you noticed I
28:26skipped a lot, like group theory.
28:30Supplementary comments from experts are
28:32very welcome. That is all for today. If
28:37you liked this video, please give it a
28:39like and subscribe to the channel. I
28:44read every single comment. See you next
28:47time.

About this transcript

This page contains the full transcript of 【高校数学でよく寝れる】暗号マニアの僕が語りたい、楕円曲線暗号のビューチホー by 海外Yパパラジオ　世界を読み解く, generated from the public captions YouTube serves with the video. The transcript has 4,348 words across 669 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.