# Tagged Questions

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

60 views

### Non-Degeneracy of the Weil pairing

In this YouTube video, Dan Boneh mentions that if both points are defined on the base field then the pairing is degenerate. Why is that? And specifically is this true if I use the Weil Pairing?
167 views

### great discovery in the field of elliptic curves cryptography?

Prof. Adi Shamir says in The Cryptographers' Panel 2016: i think that NSA has made a great discovery in the field of elliptic curves cryptography and NSA wants to avoid the increased use and ...
62 views

### How to define order according to domain parameters in elliptic curve pairing groups

According to domain parameters, as an example Type 1 pairing domain parameters are ...
61 views

### Named Elliptical Curve parameters

Are named curve parameters always the same? I know this may be a stupid question however I think this is the case. For example the secp256r1 is defined in this documet http://www.secg.org/SEC2-Ver-1.0....
91 views

### Why do the subexponential algoriths for the DLP not work for the ECDLP?

Elliptic curve cryptography is much more secure for the same parameters because attacks that work on the DLP do not work on the ECDLP. Why do the attacks fail in the latter case?
31 views

### How do we calculate DHKey using A's public key and B's private key?

I have 2 set of public/private keys. I would like to know how I can calculate DHKey. e.g: ...
74 views

### Shouldn't a signature using ECDSA be exactly 96 bytes, not 102 or 103?

Attempting to use openssl to create a signature is confusing on several levels: If I'm using it to sign a hash that I've already created (HMAC-SHA-384-192, specifically), a. why must I specify ...
282 views

### Is there any reason to use RSA or DSA when we have ECC?

I am having trouble coming up with a use case for RSA or DSA. It appears that ECC is better in every way. Is this true? I am looking for cases where RSA/DSA is superior to ECC, not where it is used ...
61 views

### Is there any difference between NIST and SECP curves in-terms of their algorithms and implementation?

I'm implementing ECDSA for NIST P-256 curve. I just want to know the same implementation will work for SECP curves also?. If it doesn't, then please suggest me references of algorithms or sample ...
50 views

### Order and cofactor of the base point? [duplicate]

What is the order and cofactor of a base point? Is it possible to deduct the order and cofactor, given just the basepoint. What about the other way around from order and cofactor to basepoint?
49 views

### How to convert roots of Weber polynomial to Hilbert class polynomial over modulo prime?

Using any non square root discriminant $D$, we should be able to find the Weber class polynomial. How can I convert the roots of a Weber polynomial to a Hilbert class polynomial over modulo prime?
38 views

### Key sizes for RSA over elliptic curves

I know that it is possible to define RSA over elliptic curves just as DSA and Diffie-Hellman have been. I know that it doesn't offer much of a speed advantage, but does it at least reduce the size of ...
68 views

### Is there an additive homomorphic encryption that supports exponentation

For example say we have two numbers a and b. Now is there any partial homomorphic encryption scheme that allows to compute (a-b)^2 over the ciphertexts of a and b without round trips.
38 views

### Is there any place where I can find test vectors for point addition and doubling of ECC?

I want to extensively test my implementation of point addition and doubling. I have only one test vector with me. I need more values to test. In the web, I could find test vectors only for key pair ...
67 views

### Scalar multiplication with projective coordinates

I'm implementing point addition, doubling and scalar multiplication using projective coordinates. I took reference from this link https://www.nsa.gov/ia/_files/nist-routines.pdf I have implemented ...
53 views

### Simulation of a custom build network security algorithm with ElGamal Cryptosystem using Elliptic Curve

I am trying to build an algorithm to encrypt and decrypt text using ElGamal Cryptosystem using Elliptic Curve. My algorithm generation is done. But at simulation part I stuck. My algorithm steps are ...
25 views

### Do most TLS 1.2 implementations express curves in a canonical form when performing EC arithmetic?

Sorry if this is a silly question, but does anyone know if the cryptographic libraries which implement TLS 1.2 for Firefox, Chrome, etc. express a given curve in a canonical form (i.e. one of ...
150 views

### ECDH-ECDSA Combination

I am doing research on cryptography primitives at a basic level and I faced a question on encryption methods. I understood that ECDH is an approach to for secure key exchange between two parties ...
69 views

Kurve : EC : $y^2=x^3 + x + 1$ Generator:$(1,7)$ $p=23$ Result in Affine use Excel: $P=(1,7)$, $Q=(7,11) \implies P+Q=(18,20)$ Result in Projective use Excel: $P=(1:7:1), Q=(7:11:1) \implies P+Q=(15:... 1answer 79 views ### Construction of division polynomials I'm trying to understand the construction of the division polynomials used in Schoof's algorithm. I firstly followed this report of Charlap and Robbins. I stuck with the definition of the leading ... 1answer 35 views ### Can the backdoor in Dual_EC_DRBG be used to create a public key stream cipher? Dual_EC_DRBG has the property that if$Q = e\cdot P$, someone who knows$e$can break the PRNG. This seems to lead to a public-key stream cipher: Alice chooses a random$P, e$, where$P$is a ... 1answer 113 views ### Elliptic curve ElGamal with homomorphic mapping I am interested in ElGamal due to the fact that you can achieve some degree of homomorphic properties. I became interested in applying ElGamal to elliptic curves, and found this other question with an ... 1answer 93 views ### SHA1 collisions and the impact for ECDSA signatures What will it mean for ECDSA using SHA1 when we have practical attacks breaking the collision resistance property of SHA1? [UPDATE] Added a bit more details to be clear. If$(r,s)$is the ECDSA ... 0answers 78 views ### Degrade in performance with SSL_OP_SINGLE_ECDH_USE? We have used SSL_OP_SINGLE_ECDH_USE when setting up our SSL_CTX . This seems to be causing a degrade in performance. I'm not able to find proper documentation for it except that it generates new ... 1answer 193 views ### Difference between Pseudo Mersenne primes and Generalized Mersenne primes The field prime numbers$p$proposed by the NIST standards are referred to as Generalized Mersenne prime numbers [1] and as Pseudo Mersenne prime numbers [2]. Is there a difference between Pseudo ... 2answers 206 views ### Finding the subgroup in isogeny-based cryptography Isogeny-based cryptography is one of the newest post-quantum cryptography. Hardness of this system is based on finding isogeny between two elliptic curves. Also this is theorem: Elliptic curves ... 0answers 44 views ### Example of Projective Coordinates Given the affine form of coordinates$(x,y)$such as$(5,3)$, if I want to convert$(5,3)$to projective coordinates$(x,y,z)$, should the form of point be$(5,3,1)$? It is triplet not a point, right? ... 0answers 87 views ### Convert projective to affine coordinates in ECC? [closed] I am working with my project. I use projective coordinates but when I convert to affine coordinates, I can't get it. Can anyone help me? Projective Coordinates$(X,Y,Z)$to Affine Coordinates$(X,Y)$:... 0answers 76 views ### Semaev summation polynomials I am little confused how this attack works. We have the points$P, Q$such that$Q = nP$. We let$u_{1} $and$u_{2}$such that$R(x,y)=u_{1}P+u_{2}Q$. Then if we find the solution$x_1,...,x_n$of the ... 1answer 140 views ### Limitations of Elliptic Curve Cryptography? Simple question, what are the limitations of ECC, both in terms of application and how secure it is? I heard that the NSA were able to read emails a few years back due to a backdoor they had ... 0answers 31 views ### Using Montgomery ladder to calculate the coordintes In one of my assignments I need to solve the below: For a Montgomery curve$3v^2 = u^3+u^2+u$over${\mathbb{F}}_{11}$and point$P = (9,8)$. I need to compute$x$coordinate of$3P$using ... 0answers 81 views ### Can we break ECDLP with this machine? Let$P$and$Q$are two points of NIST elliptic curve$E$(defined over$F_{2^m}$with prime$m$) and$k$is a private key such that$k.P=Q$. Also we have a machine that is able to leak some ... 0answers 90 views ### Performance of ECDSA, ECKCDSA and ECGDSA It is proven that ECDSA algorithms are faster in key and signature generation compared to RSA. In addition, the signatures are much shorter. However, I would like to know the performance difference ... 1answer 41 views ### Elliptic ElGamal Public Key Cryptosystem doubt I need an example of Elliptic ElGamal Public Key Cryptosystem. I have been trying with some values but I don't get the right solution. I have$p=13$, the elliptic curve$E:y^2=x^3+11x+7$and a point ... 0answers 51 views ### What is th purpose of m and q in elliptic curve cryptography protocols? In crypto protocols that contains calculus on elliptic curves I can often see$\dfrac{m}{q}Q$where$m$stands for order of EC points group and$q$is the order of corresponding subgroup of$m$.$Q \...
Let $E$ be an elliptic curve; $\alpha,\beta$ two points of $E$; and $a$ a private key such that $\beta=a\cdot\alpha$. We choose random integer $k$ and plain text $x\in E$. Encryption and decryption ...