Elliptic curves are a mathematical structure. In cryptography, it is common to use the structure $y^2 = x^3 + ax^2 + b$ over a finite field. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider specific tags such as discrete-logarithm and ecdsa.
0
votes
0answers
29 views
calculating beta for elgamal elliptic curves
Suppose we use elgamal elliptic curves for secure communication. Bob selects a prime $p$, an elliptic curve $E$, a point $\alpha$ on $E \pmod p$, and a secret integer $f$. Suppose that Bob has ...
3
votes
1answer
90 views
Trying to better understand the failure of the Index Calculus for ECDLP
So I'm going to give you guys my understanding and then if you would be so kind as to tell me where I'm off the mark (hopefully I'm not completely wrong).
So basically the index calculus for the ...
2
votes
1answer
44 views
How to derive formulas for addition and multiplication in Jacobian coordinates
Is there a way to derive the formulas for point addition and multiplication on elliptic curves in Jacobian format by yourself? How could I have derived these formulas by myself?
1
vote
1answer
67 views
Elliptic Curve is DH function or PKI?
can we reuse same ECC key on TLS for long terms or it must be used just once? (i mean can we use ECC like RSA?)
is there patent free ECC implementation ?
0
votes
0answers
85 views
Adding and multiplication in jacobian coordinates
How can I derive formulas for adding and multiplication of 2 points in Jacobian coordinates $(x,y) = (\frac{X}{Z^2},\frac{Y}{Z^3})$ over an elliptic curve?
2
votes
3answers
165 views
The utility of elliptic curve cryptography
Suppose that the only public key cryptography schemes that we knew were Diffie Hellman, RSA and ElGamal. How much would this set civilization back? Are there important applications of elliptic curve ...
0
votes
1answer
47 views
EC equivalent for RSA-OAEP
I have some questions regarding aforementioned subject:
Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ?
Is ECIES-KEM sufficient ?
0
votes
0answers
54 views
How fast can a wrong decryption key be detected using ECC?
When can a decryption function detect that the ECC key I use for decryption is incorrect? Is it possible to do that during initialization, or does the complete message have to be decrypted to do that?
...
2
votes
2answers
84 views
How do I unpack the x and y values from the BITSTRING in a DER ECDSA public key?
In ASN.1, the X and Y values for a 256-bit elliptic curve key are stored as a single 66-byte ASN.1 BITSTRING. Are the values just the first and second half of this bitstring?
The private key is an ...
1
vote
1answer
110 views
How to calculate y value from ((y*y) mod prime) efficiently
i am working ECC-224 bit. can any one tell me, how to calculate y value from ((y*y) mod prime) efficiently for large bit numbers.
0
votes
1answer
51 views
Efficient algorithm for remainder calculation over prime field for ECC implementation?
I am working on 224-bit elliptic curve cryptography. In this 224-bit * 224-bit multiplication results 448-bit output. I am reducing 448-bit into prime field range( prime number $2^{224}-2^{96}+1$) ...
3
votes
2answers
159 views
What crypto system allows for 3 parties: Party 1 who makes an assertion, Party 2 mutates the assertion, Party 3 validates it
I'm looking for the cryptographic equivalent of a Drivers license where the issuer can be verified, the issuer doesn't need to know who you showed the drivers license to, but also allows ...
0
votes
0answers
63 views
Use curve25519 for ElGamal crypto
DJB described curve25519 in his paper which can be found here: http://cr.yp.to/ecdh/curve25519-20060209.pdf. It seems that the main purpose was for Diffie-Hellman key exchange. I think this means that ...
2
votes
1answer
54 views
How are Elliptic Curve Cryptography and Pairing Based Cryptography related?
I have been doing a project that uses the PBC library developed by Ben Lynn. But I am still not clear on how PBC is related to ECC.
I know that this is a site for complex crypto QA, but I did not know ...
4
votes
1answer
162 views
Can SRP be used with Elliptic Curves?
I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia.
Edit: ok, can it be at least ...
1
vote
2answers
90 views
While generating a random Elliptic curve what are the conditions i have to considerd?
I want to generate a random elliptic curve over a prime field. What are the conditions I should satisfy?
For the NIST recommended standard ECC-224 bit curve with prime $p=2^{224}-2^{96}+1$, a ...
6
votes
1answer
134 views
When do ECC patents end?
As the topic says, since when can ECC cryptography be freely used?
Isn't it widely used because of patents? There is no alternative to it on embedded devices and smart cards.
Just to mention: i am ...
1
vote
0answers
57 views
How to represent point-at-infinity in affine coordinate
In projective coordinates point-at-infinity can be identified with z=0. How to identify the point-at-infinity in affine coordinate.
Whether x=0 and y=0 can be considered as point-at-infinity in ...
0
votes
3answers
127 views
File encryption with one keypair?
I'm working on a program that uses an ECC keypair in a (password protected) PKCS12 file (.pfx) to encrypt files. I like this method because I think it will be higher security (using ECDH to negotiate ...
0
votes
1answer
73 views
What are unified addition and differential addition in elliptic curve point arithmetic?
A lot of papers use these terms but I do not find a proper explanation of them. Can somebody tell the meaning / difference / intuition / application and if possible with an example.
4
votes
1answer
176 views
Why do the elliptic curves recommended by NIST use 521 bits rather than 512?
Wikipedia says in reference to the elliptic curves officially recommended by NIST in FIPS 186-3:
Five prime fields for certain primes p of sizes 192, 224, 256, 384, and 521 bits. For each of the ...
2
votes
1answer
69 views
Discrete log analog of ECM factoring algorithm?
Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas.
Is there an analog of the elliptic curve (ECM) ...
1
vote
0answers
37 views
Generating non-supersingular elliptic curves for symmetric pairings
I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the ...
2
votes
1answer
51 views
Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack
The curve $E(\mathbb{F}_{47}):y^2=x^3+x+38$ has order $61$ and $61|47^3-1$ so the embedding degree of $E$ is $3$ and therefore the MOV attack, presumably using some sort of distortion map and a ...
3
votes
2answers
137 views
Modulus for elliptic curve point multiplication
I want to implement a point multiplication ($k \cdot P$) operation on FPGA. I have a BN curve $y^2=x^3+2$, and a scalar value $k$. The $x$ and $y$ coordinates of point $P$ are of 256 bits. In the ...
7
votes
1answer
277 views
Does the elliptic curve (EC) cryptosystem outperform RSA and DL cryptosystems?
Throughout the literature, it is stated that EC cryptosystems outperform RSA and Discrete logarithm cryptosystems, but I cannot understand how ECC would be more efficient than RSA and DL in terms of ...
2
votes
1answer
104 views
Choosing good parameter for Lenstra's elliptic curve factorization
In Wikipedia, there is an article explaining Lenstra's factorization algorithm. As far as I got it, we choose some $e \in \mathbb{N}$ and a point $P$ on the curve and then calculate $eP$. While ...
0
votes
1answer
67 views
tower of extension field
while working on tate pairing, i have to implement towering technique. like i have point p on F(q) and point Q(F(q^k)) (here embedding degree k=12 for BN curve).
instead of taking a point Q on ...
3
votes
1answer
147 views
Is there a field guide to ECC for the IT Security layman?
I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ...
3
votes
1answer
88 views
Why doesn't this replay attack work on ECDSA?
I've just started working with elliptic curves and ECSDA in particular, so my understanding of the underlying math isn't great. The thing I'm currently stuck on is trying to understand why replay ...
1
vote
2answers
118 views
ECM Implementation is really slow
I followed the algorithms 14.4 (computes 1st and 3rd coordinates in (X,Y,Z)#k modulo n) and 14.5 (factorization using ECM) in David Bressoud's book 'Factorization and Primality Testing'. I think the ...
3
votes
1answer
125 views
Impact of algorithms for factoring using elliptic curves over $\mathbb{Q}$
Recently a few papers have appeared that describe a new approach to factoring, using elliptic curves over $\mathbb{Q}$. See, e.g.,
Factoring integers and computing elliptic curve rational points, ...
2
votes
1answer
214 views
Why are elliptic curve variants of RSA “chiefly of academic interest”?
Yesterday I was thinking about elliptic curve variants of popular protocols/algorithms (ECDH, ECES[1], etc) and the thought occured that I had never seen an elliptic curve variant of RSA. My ...
5
votes
2answers
201 views
Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?
There are elliptic curve variants of Diffie-Hellman, ElGamal, DSA and possibly other protocols/algorithms. I know that these elliptic curve variants have smaller key and ciphertext sizes which will ...
0
votes
3answers
367 views
How does one calculate the scalar multiplication on elliptic curves?
I found this example online:
In the elliptic curve group defined by
$$y^2 = x^3 + 9x + 17 \quad \text{over } \mathbb{F}_{23},$$
what is the discrete logarithm $k$ of $Q = (4,5)$ to the base ...
6
votes
2answers
202 views
Why do public keys need to be validated?
For some curves it's necessary to validate the public-key of the other side before running an elliptic-curve Diffie-Hellman key-exchange. Apparently if you don't validate the public key, small ...
0
votes
1answer
389 views
BouncyCastle Elliptic Curve implementation
I'm implementing ECDH key exchange in C# using the BouncyCastle library and I'm having a hard time understanding the elliptic curve side (FpCurve).
...
1
vote
1answer
147 views
Is there a method to break an EC curve for all key-pairs (Q,d) such that (Q=d*G) faster than breaking every single key-pair?
Related to this question: Is there any memory trade-off that helps such attack?
Obviously if the field size is very small (say 40 bits) it´s possible, but what if the field size is 160 bits long? or ...
1
vote
1answer
178 views
Storage of Private Keys
I'm building a bitcoin web application that will require all users to be assigned a wallet for adding funds to their account. I plan on exposing the public key to the user (the bitcoin address). Users ...
7
votes
2answers
308 views
Using same keypair for Diffie-Hellman and signing
Are there any security risks using a single key-pair for both key-exchange and signing?
I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
3
votes
2answers
239 views
Why would anyone use an elliptic curve with a cofactor > 1?
In cryptography, an elliptic curve is a group based on a finite field $GF(p^k)$; this group has $n$ elements on it, and we work on a prime-sized subgroup of size $q$. We denote the value $h = n/q$ as ...
2
votes
1answer
93 views
How does DJB's nistp224 manage to fit compressed points into 224 bits?
DJB's nistp224 program purports to be an implementation of elliptic curve Diffie-Hellman relative to the standard NIST P-224 elliptic curve.
To the best of my ...
1
vote
1answer
150 views
How to properly add ECDSA private keys?
I'm currently working on an application that requires me to add two ECDSA private keys in order to make a new private key. The result has to have the property, that its corresponding public key is the ...
0
votes
1answer
118 views
ECDSA - point order criterion
i am creating some primitive demostration for ECDSA over small curve ( p < 229). But my implementation have some weird issues. Verify process return false even if the signature is correct. Because ...
1
vote
1answer
180 views
ECIES protocol - what does the || operation mean?
I am studying elliptic curves problems, which also includes study of related protocols such as ECIES. A there is a problem I don't understand operation $||$. What this operation mean?
Some stuff is ...
3
votes
1answer
287 views
Elliptic curves for ECDSA
i'm trying to implement parameters generation for ECDSA according to SEC1 v2.0:
Input: The approximate security level in bits = t is {80, 112, 128, 192, 256}
...
4
votes
1answer
1k views
How strong is the ECDSA algorithm?
Some cryptographic algorithms are as strong as the size of their key is, while other have some weaknesses that limit their strength (such as SHA-1). How strong is the ECDSA algorithm, and does that ...
3
votes
0answers
338 views
Elliptic curve cryptography related key attacks
This question is an extension of Families of public/private keys in elliptic curve cryptography
As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
6
votes
2answers
480 views
Can one reduce the size of ECDSA-like signatures?
Using $n$-bit ECDSA, a signature has a size of $2·n$. It is possible to recover the public key from this signature, which shows that there is a publicly visible redundancy in the signature.
Is ...
3
votes
1answer
442 views
X9.62 Multiplying an elliptic curve point by a number
I'm currently trying to implement ecdsa and the first problem i met -- multiply an elliptic curve point by a number.
As far as i understand X9.62 gives some recommendation for doing it but i ...
