Elliptic curves are a mathematical structure. In cryptography, it is common to use the structure $y^2 = x^3 + ax^2 + b$ over a finite field. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider specific tags such as discrete-logarithm and ecdsa.

learn more… | top users | synonyms (1)

-2
votes
1answer
39 views

How Proof all Subgroup point of prime order elliptic curve have prime order [#G=#E]?

anyone knows any reference that proof it ? Please Help .
2
votes
1answer
49 views

Prevent MITM attack while encrypting data by using ElGamal ECC?

I am using ElGamal ECC to encrypt my plain text data. I want to ensure that my data is safe from a Man-In-The-Middle attack. What methodology I can adopt to achieve this goal? How can we prevent a ...
1
vote
0answers
44 views

Type G Bilinear Pairings

I was reading PBC and its implementations for finding pairing parameters. I am particularly interested in implementing a BLS signature scheme with 20-byte (160-bit) signatures ("short signatures"). ...
3
votes
1answer
103 views

Proving Non-Existence of ECC Backdoors

In light of the NIST Dual EC DRBG scandal, I was intrigued by a NIST slide (slide 9) that said the two points P and Q can be chosen so that the chooser can prove they don't have a backdoor. This ...
0
votes
0answers
64 views

RSA and ECDSA Certificate Sizes

Is there a table (or a whitepaper from official sources) that compares the size of X509 certificates generated with RSA (starting from 1024 bits) and ECDSA (starting from 160 bits) ? Thanks for the ...
1
vote
0answers
65 views

ECC cryptography with shorter signature when not needing high security?

I am new here and fairly new to cryptography, so if I say something wrong, let me know. I am trying to set up a system where a user can receive a temporary license key over the phone, put it into ...
1
vote
0answers
57 views

How to generate ECC (160 bits) Keys with OpenSSL? [closed]

I want to generate RSA Keys at 1024 bits with OpenSSL. I can do this with the following commands: To generate RSA Key at 1024 bits: ...
3
votes
2answers
195 views

Rely on NSA Suite B Cryptography?

NSA's Suite B Cryptography suggests some cryptographic algorithms for encryption, digital signatures, message digests and key agreements. The selected algorithms and their key size are suggested by ...
1
vote
0answers
78 views

Hardware Implementation of Pairing over BN curves

I am in the middle of FPGA based Hardware architecture design for the computation of Pairing (particularly R-ate Pairing) over BN curves. Where, the point addition, and point doubling should be ...
5
votes
1answer
66 views

point addition equation in projective co ordinates

How can I get point addition equation for elliptic curves in projective co ordinate system ? Can I get it by changing $$ x = X/Z $$ and $$ y =Y/Z $$ in the equation for affine co ordinates' group law ...
4
votes
1answer
122 views

Using Lattice-based cryptography for TLS\SSL

Given the general benefits of Lattice-based cryptography, such as: Post quantum Security Security from worst case scenario Efficiency What could the outlook of shifting from RSA \ ECC-based ...
2
votes
2answers
86 views

ECDH anonymous key exchange to avoid PKI

I want to use TLS to encrypt the communication between peers in a P2P network. Each peer has a well known 256bit peer identifier (the public key of a 256bit elliptic curve keypair). Both peers need ...
4
votes
1answer
120 views

Implementing CD serial key system

I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
2
votes
1answer
205 views

Adding points on Elliptic Curves

How do we add the integer points $P=(-1, 4)$ and $Q=(2, 5)$ on the elliptic curve of the form $y^2=x^3+17$ ?
5
votes
1answer
199 views

Elliptic Curve Cryptography

I have been trying this for a while. But I couldn't get it. How can I determine the point of intersection of the tangent line at (0, 0) on the curve $y^2 + y = x^3 + x^2$ ?
0
votes
2answers
77 views

Elliptic curve group over a prime finite field $F_p$

If $p$ is a big prime, and the elliptic curve $E$ is defined over $F_p$ by the equation $y^2=x^3+ax+b$ where $a,b\in F_p$. The point on $E/F_p$ together with the infinite point $\mathcal{O}$ form a ...
2
votes
3answers
82 views

Can a EC private key be derived from a public key?

I understand that the public key does not expose the private key. That is not the question. The question is: Given a EC public key, can a different, but plausible and functional private key be ...
2
votes
0answers
64 views

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part. What is the difference between ”ECDH with a ...
1
vote
0answers
73 views

A question about elliptic curves and finite fields in bilinear pairings

Based on what mentioned in the paper "Pairings For Cryptographers" http://www.sciencedirect.com/science/article/pii/S0166218X08000449 the two inputs of a pairing map are two members of two additive ...
-3
votes
2answers
127 views

pairing-based schemes

some authors claimed that computational performance of a pairing-fee scheme (based on scalar multiplication over an elliptic curve group) is about 1000% more efficient than a pairing based one I would ...
4
votes
2answers
138 views

How does recovering the public key from an ECDSA signature work?

It is possible to recover the public key from an ECDSA signature (R,S). Please explain me how this works.
2
votes
1answer
51 views

Is jacobian to projective conversion unique?

I am doing a small project in ECC. I have used the following equation for converting Projective to Jacobian coordinates: $$D = AC\\ E = BC^{2}\\ F = C$$ and also the following equation to convert ...
2
votes
2answers
155 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
1
vote
1answer
93 views

How to convert projective to jacobian co-ordinate in ECC?

I am doing a small project using elliptic curve in cryptography. My doubt is, can I directly convert a projective to a Jacobian coordinate system without using the affine conversion in elliptic curve ...
4
votes
1answer
147 views

Elliptic Curve Crypto, is a distributed signing method possible using Shamir's Secret Sharing?

Note: A distributed signature scheme exists for RSA: Practical Threshold Signatures, Victor Shoup. Is it possible to adapt such scheme for ECC? A centralized signing machine is vulnerable to ...
1
vote
1answer
98 views

Is either brainpoolP320r1 or brainpoolP320t1 a SafeCurve?

Not all elliptic curves are safe to use for cryptography, especially from an ECC safety perspective. The site http://safecurves.cr.yp.to/index.html shows that two tested Brainpool curves, ...
4
votes
1answer
79 views

Parallelized Pollard's Rho algorithm for ECDLP + Jacobian coordinates

My implementation of the parallelized Pollard's Rho algorithm is using Jacobian coordinates to avoid the costly inversion operation when performing point addition. I am wondering if there are any ...
6
votes
2answers
117 views

Fast hashing into elliptic curve

Is there a fast algorithm for mapping $n$-bit numbers $s$ (for fixed $n$) into a cyclic subgroup of an elliptic curve (over a finite field) in which the Discrete Logarithm Problem is hard? By fast, I ...
7
votes
1answer
124 views

curve25519 weak points for contributory behaviour

The Diffie-Hellman on curve25519 is usually calculated using the base point $(9,…)$ which induces a cyclic subgroup of $G:=\{\infty\}\cup(E(F_{p^2})\cap(F_p\times F_p))$ with index 8, i.e. there is a ...
2
votes
0answers
151 views

Elliptic Curve based blind signature implementation

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
2
votes
1answer
95 views

Why are there only positive value points on an elliptic curve?

I read about elliptic curve cryptography $E$ over $Z_p$ where $p$ is prime number and $G$ is a base point on the curve. I noticed the points resulting from multiplication e.g. $2G$,$3G$,.....,$(N-1)G$ ...
2
votes
1answer
83 views

What differences between Menezes–Vanstone ECC and ElGamal ECC?

After researching ECC encryption, I found that we can use ElGamal cryptosystem with elliptic curve and can we use Menezes-Vanstone cryptosystem with elliptic curve. What is the essential difference ...
2
votes
1answer
112 views

What are differences between $E(F_p)$ and $E(Z_p)$?

When I read some books about elliptic curve cryptography noticed that. sometimes symbolized elliptic curve over $F_p$ is $E(F_p)$ and sometimes symbolized elliptic curve over $Z_p$ is $E(Z_p)$. I ...
3
votes
1answer
135 views

Twisted curves in protocol

I've come to understand that twisted curves, as for instance defined in the Brainpool specifications, are $F(p)$-isomorphic to their regular $F(p)$ equivalents. So brainpoolP256r1 is isomorphic to ...
3
votes
1answer
100 views

Measure ECC key size

I have implemented a ECC key generation scheme successfully. Now I need to find ECC key sizes of each generating key pairs. I assumed that ECC key size is the size of the ECC private Key. So I would ...
2
votes
1answer
206 views

Montgomery Ladder vs Double-and-Add

I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm. I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
1
vote
0answers
62 views

Bilinear pairing

I am working on Efficient Construction of Pairings which are being realized by Miller's algorithm. In this algorithm the basic steps are point doubling and line function computation point addition ...
1
vote
3answers
97 views

Encryption time in ECC

In RSA, encryption time is usually much less than decryption time due to having a small public exponent. Can this be achieved in Elliptic Curve Crypto (ECC)?
-2
votes
1answer
91 views

Integers in ECC

Let A be a point on curve with integral coordinates. Does k.A necessarily have integer coordinates? If so than why and if not than how to find A and k such that k.A has integral coordinates.
3
votes
1answer
112 views

How to handle the GCD(V,P) != 1 case when doing point addition or point doubling in elliptic curve cryptography

The equation for a finite field Elliptic Curve is of this form: $$y^2 \equiv x^3 + a * x + b \pmod{P}$$ When we do common EC operations like point doubling or point addition we need to calculate the ...
1
vote
0answers
54 views

Want to use ECC but am clueless [closed]

First off, I'm not an experienced cryptography or computer person, please bear with me. I have some basic experiences with PGP software though (not much of a redemption huh?). I have some data that ...
1
vote
1answer
71 views

order of elliptic curve divisible by prime

Why order "u" of an elliptic curve "E" defined over a finite field "GF (q)" (u = | E / GF (q) |) must be divisible by a large prime number r to be appropriate for cryptographic purposes?
0
votes
1answer
151 views

Is C25519/Ed25519 “twist secure”?

This recent new curve mentions something that's new to me: twist security. http://safecurves.cr.yp.to/bada55.html Are the existing C25519/Ed25519 curves secure against this form of attack?
0
votes
1answer
117 views

Is this EdDSA modification secure?

I am hoping to employ a signed set membership system which is valid iff each signer's contribution to the set is present. The system should allow for two or more mutually exclusive signed sets to be ...
3
votes
1answer
311 views

ECDSA vs RSA: Performance on Android platform and surprising results

For our privacy-preserving protocol, an encrypted channel is established. In order to protect our system from man-in-the-middle attacks, signature-based approach is used. After we've implemented it ...
2
votes
1answer
132 views

ECC partially blind signature scheme verification

Continued from Is there a flaw in this ECC blind signature scheme? The problem I needed a partially blind signature scheme for one of my projects, but couldn't find one on the internet, so I've made ...
3
votes
0answers
109 views

Is there a flaw in this ECC blind signature scheme?

Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ...
3
votes
1answer
125 views

Security benefits of Ed25519 generating signatures deterministically

I am reading on the Ed25519 curve, and I am trying to understand a claim. Here is the claim: Foolproof session keys. Signatures are generated deterministically; key generation consumes new ...
1
vote
0answers
44 views

Smart card Strong authentication / Verification ( fingerprints)

I'm trying to make a strong authentication software and embedded software in a java card. I have found many papers and publications about the subject… too much information to process and I'm working ...
3
votes
1answer
187 views

ECC public key encryption and authentication - ECIES with ECDSA vs ECDH with AES

I'm currently working on a project where I want to establish a secure and authenticated communication channel between to entities, using Elliptic Curve Cryptography. Now I'm not really sure how to ...