# Tagged Questions

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

1answer
94 views

### Is there an asymmetric algorithm that can perform double encryption?

I'm looking for any asymmetric algorithm can perform the serial encryption, by serial I mean double or more encryption with different key(same key size). RSA can not do it since the cipher of the ...
1answer
82 views

### Why inversion and multiplication operations are costly in elliptic curves?

There are several algorithms for efficient scalar multiplication of an arbitrary point P(x,y) by some positive integer k in elliptic curves defined over $F_{p}$ or $F_{2^{m}}$. The scalar ...
1answer
61 views

### Non-Degeneracy of the Weil pairing

In this YouTube video, Dan Boneh mentions that if both points are defined on the base field then the pairing is degenerate. Why is that? And specifically is this true if I use the Weil Pairing?
1answer
167 views

### great discovery in the field of elliptic curves cryptography?

Prof. Adi Shamir says in The Cryptographers' Panel 2016: i think that NSA has made a great discovery in the field of elliptic curves cryptography and NSA wants to avoid the increased use and ...
2answers
62 views

### How to define order according to domain parameters in elliptic curve pairing groups

According to domain parameters, as an example Type 1 pairing domain parameters are ...
2answers
61 views

### Named Elliptical Curve parameters

Are named curve parameters always the same? I know this may be a stupid question however I think this is the case. For example the secp256r1 is defined in this documet http://www.secg.org/SEC2-Ver-1.0....
1answer
92 views

### Why do the subexponential algoriths for the DLP not work for the ECDLP?

Elliptic curve cryptography is much more secure for the same parameters because attacks that work on the DLP do not work on the ECDLP. Why do the attacks fail in the latter case?
1answer
31 views

### How do we calculate DHKey using A's public key and B's private key?

I have 2 set of public/private keys. I would like to know how I can calculate DHKey. e.g: ...
1answer
79 views

### Shouldn't a signature using ECDSA be exactly 96 bytes, not 102 or 103?

Attempting to use openssl to create a signature is confusing on several levels: If I'm using it to sign a hash that I've already created (HMAC-SHA-384-192, specifically), a. why must I specify ...
2answers
282 views

### Is there any reason to use RSA or DSA when we have ECC?

I am having trouble coming up with a use case for RSA or DSA. It appears that ECC is better in every way. Is this true? I am looking for cases where RSA/DSA is superior to ECC, not where it is used ...
0answers
66 views

### Is there any difference between NIST and SECP curves in-terms of their algorithms and implementation?

I'm implementing ECDSA for NIST P-256 curve. I just want to know the same implementation will work for SECP curves also?. If it doesn't, then please suggest me references of algorithms or sample ...
2answers
50 views

### Order and cofactor of the base point? [duplicate]

What is the order and cofactor of a base point? Is it possible to deduct the order and cofactor, given just the basepoint. What about the other way around from order and cofactor to basepoint?
1answer
49 views

### How to convert roots of Weber polynomial to Hilbert class polynomial over modulo prime?

Using any non square root discriminant $D$, we should be able to find the Weber class polynomial. How can I convert the roots of a Weber polynomial to a Hilbert class polynomial over modulo prime?
1answer
38 views

### Key sizes for RSA over elliptic curves

I know that it is possible to define RSA over elliptic curves just as DSA and Diffie-Hellman have been. I know that it doesn't offer much of a speed advantage, but does it at least reduce the size of ...
1answer
70 views

### Is there an additive homomorphic encryption that supports exponentation

For example say we have two numbers a and b. Now is there any partial homomorphic encryption scheme that allows to compute (a-b)^2 over the ciphertexts of a and b without round trips.
1answer
38 views

### Is there any place where I can find test vectors for point addition and doubling of ECC?

I want to extensively test my implementation of point addition and doubling. I have only one test vector with me. I need more values to test. In the web, I could find test vectors only for key pair ...
1answer
68 views

### Scalar multiplication with projective coordinates

I'm implementing point addition, doubling and scalar multiplication using projective coordinates. I took reference from this link https://www.nsa.gov/ia/_files/nist-routines.pdf I have implemented ...
0answers
53 views

### Simulation of a custom build network security algorithm with ElGamal Cryptosystem using Elliptic Curve

I am trying to build an algorithm to encrypt and decrypt text using ElGamal Cryptosystem using Elliptic Curve. My algorithm generation is done. But at simulation part I stuck. My algorithm steps are ...
0answers
25 views

### Do most TLS 1.2 implementations express curves in a canonical form when performing EC arithmetic?

Sorry if this is a silly question, but does anyone know if the cryptographic libraries which implement TLS 1.2 for Firefox, Chrome, etc. express a given curve in a canonical form (i.e. one of ...
3answers
151 views

### ECDH-ECDSA Combination

I am doing research on cryptography primitives at a basic level and I faced a question on encryption methods. I understood that ECDH is an approach to for secure key exchange between two parties ...
1answer
71 views

0answers
60 views

### Convert messages to elliptic curve points [duplicate]

Let $E$ be an elliptic curve; $\alpha,\beta$ two points of $E$; and $a$ a private key such that $\beta=a\cdot\alpha$. We choose random integer $k$ and plain text $x\in E$. Encryption and decryption ...
1answer
103 views

1answer
56 views

### What happens if you multiply a point with its order on complete Edwards curves?

I was recently working with some ECC crypto and stumbled across the following phrase on the SafeCurves page: The rational points of a complete Edwards curve are the pairs (x,y) of elements of ...
4answers
248 views

### What is the most secure ECC Curve?

I have for a while used Koblitz curve (sect571k1), in ECDH and ECDSA. But I have started wonder if it is the most secure. I prefer security over efficiency. So the curve doesn't have to be the most ...
2answers
257 views

### How do I get the equivalent strength of an ECC key?

I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
0answers
90 views

### HD (Hierarchical Deterministic) Keys using Safe Curves?

Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...