Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

learn more… | top users | synonyms (2)

6
votes
2answers
248 views

How does Diffie–Hellman differ from elliptic curve Diffie–Hellman?

I didn't understand how ECDH actually works. Disclaimer: I know very little about elliptic curves. Here is how DH works: Alice and Bob agree on a prime number $P$ and a generator $G$. (They use one ...
3
votes
1answer
93 views

Can a billion elliptic curve keys be generated on a laptop in less than an hour?

I want my application to generate an EC key pair. The first four bytes of the sha256 hash of the public key should contain a known IP address. As hashes are one-way functions, I need to brute force ...
2
votes
1answer
145 views

ECDH or RSA more secure for symmetric key wrapping?

Suppose a message is encrypted with a symmetric block cipher with a random key. RSA is often used to wrap the symmetric key using the recipient's public key. In this case, the size of the message is ...
2
votes
0answers
54 views

Using a product of a series of curve25519 scalars as a private key

There are a few systems like the GNU Name System and the Sphinx mixnet packet format that employ a series of curve25519 scalars all multiplied together as a private key. Are there any caveats to ...
2
votes
0answers
46 views

Construct points with the same discrete logarithm

Assume we have an elliptic curve $E$ with a Tate (or Ate,...) pairing $G_1 \times G_2 \mapsto G_T$ Now the task is to find $g_1, g_1' \in G_1$ and $g_2, g_2' \in G_2$ such that the discrete logarithm ...
82
votes
4answers
54k views

Why is elliptic curve cryptography not widely used, compared to RSA?

I recently ran across elliptic curve crypto-systems: An Introduction to the Theory of Elliptic Curves (Brown University) Elliptic Curve Cryptography (Wikipedia) Performance analysis of identity ...
4
votes
3answers
135 views

Calculating $\mathbb F_{p^2}$-rational points of an elliptic curve defined over $\mathbb F_p$

How can I calculate points on an elliptic curve defined over $\mathbb F_p$, for example $y^2 \equiv x^3 + 1 \pmod p$, with coordinates in $\mathbb F_{p^2}$? (points might have complex number format in ...
4
votes
1answer
64 views

How to exctract ECDH parameters from an OpenSSL-generated $G$?

I'm using ECDH for generating ECDH public parameters (p,a,b,G,n), I try to get this values using openssl ecparam -in cert.pem -text -noout For ...
6
votes
1answer
157 views

How can ECDSA signatures be shortened (to be used as a product key)?

So I made my own serial key generation software, using ECDSA, for use in my own applications and it works great so far! To keep the serial key short enough I use a 128 bit EC curve. My final signature ...
4
votes
2answers
548 views

Safe elliptic curve point addition using projective coordinates: How do I tell if the points are the same?

I am trying to implement elliptic curve point addition in hardware for NIST p256 and p384 curves. I have noticed the following issue with the suggested NIST routines: Consider routine 2.2.7 of ...
12
votes
4answers
1k views

Are any of the major asymmetric ciphers distinguishable (EG, RSA, ECC)?

Related to "Is it possible to derive the encryption method from encrypted text?". Given ciphertexts generated by any of the major asymmetric ciphers (RSA, ElGamal, ECC, etc..) can these ciphertexts ...
-1
votes
2answers
87 views

Elliptical curve cryptography Determine if a public key point y is negative or positive, odd or even?

Take a Elliptical curve cryptography public key (x, y) and its additive inverse (x, -y). How do you identify which is the positive point and which is the negative point? Example Private key 1 -> (x, ...
3
votes
1answer
71 views

Do ECDH and ECDSA combined solution provide an authenticated protocol exchange solution in MCU environment?

I'm working on a project in MCU (micro controller) environment with GPRS connection to exchange data securely with the cloud. The encryption algorithm has been selected to use AES. I did some search ...
1
vote
2answers
592 views

Reuse of a DH / ECDH public key

I was wondering whether it is safe to use the same DH or ECDH key pair in more than one key agreement, particularly if these public keys are in a public registry. These public keys could be used by ...
5
votes
0answers
61 views

Elliptic curve point addition with $Z_1 = Z_2 = 1$

Elliptic curve point addition and point doubling operations using Projective and Jacobian coordinates require fewer field multiplication operations when considering $Z$ coordinates of input points ...
4
votes
1answer
122 views

Why a key pair is used in OpenSSL ECDSA_sign or ECDSA_do_sign instead of only private key ?

If the digital signature in ECC (ECDSA) is made using a private key, why is the OpenSSL library using ECKEY pair as an input parameter instead of the private key only ?
2
votes
1answer
161 views

Forward-secure static-ephemeral ECDH key agreement protocol

The question is whether the following simple key agreement protocol design has good security properties, and how it can or should be improved. Assumptions Alice is a persistent entity with a static ...
1
vote
0answers
27 views

Where can I find a versatile PKI and library leveraging curve25519?

I note that Things that use Curve25519 provides a long list of protocols, software, and libraries that leverage curve25519, but I'm wondering if there is any such software that more fully implements a ...
11
votes
1answer
332 views

How to calculate elliptic curve parameters?

I'm having a rough time understanding the math behind elliptic curves. I want to implement ECDH where user can define a, b, and p parameters of elliptic curve. How can I calculate generator base ...
1
vote
0answers
35 views

What is the hardness in Decisional Linear Assumption (DLIN)?

I had understood what does the DLIN assumption means and here is a related question. But I fail to understand the 'real hardness' in this problem. I would be grateful if someone can help me to ...
4
votes
1answer
93 views

ECDH and ECDSA in PGP with known public key

How are used ECDH and ECDSA in combination with public key ? Usually these methods are used for establish a secret themselves, ...
-1
votes
1answer
46 views

Could someone explain the given algorithm?

The following snapshot of the algorithm is taken from the book Guide to Elliptic Curve Cryptography published by Springer 2004. I don't understand that why at the statement 9.1 if both $T_1$ and ...
4
votes
1answer
99 views

OpenPGP Public-Key algorithm

What means when pgpdump shows this kind of algorithm in the Public-Key Encrypted Session Key Packet? ...
2
votes
2answers
164 views

How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
2
votes
1answer
123 views

OpenSSL ECDH key exchange mechanism

I am using FIPS based OpenSSL module for encryption of sensitive data for my desktop socket server and client applications. I am using ECDH for key agreement.The keys public and private pair is ...
2
votes
1answer
156 views

What are the differences between curve NIST P-521 and Edwards E-521 for signature?

I implemented and used the P-521 curve for ECDSA. Signatures are 132 bytes long. It seems that Edwards E-521 is safer but I did not investigated very deeper. What is its signature length ? How is it ...
5
votes
1answer
189 views

Why Curve25519 for encryption but Ed25519 for signatures?

NaCl and libsodium libraries use Curve25519 for authenticated encryption (actually for sharing a key which is used for encryption) and Ed25519 for signatures. What is the purpose of using different ...
11
votes
1answer
180 views

Edwards / Montgomery ECC with Weierstrass Implementation?

So let's assume I want to perform Ed448 or Ed25519 digital signatures or want to perform a DH key-exchange. Assume further that those curves (Curve448 or Curve25519) are required. But the problem is, ...
14
votes
1answer
5k views

ECDSA vs ECIES vs ECDH

Recently I started studying Elliptic Curve Cryptography and I just loved it. I want to transfer some big data (like 3KB), What is the best method, ECDSA, ECIES, or ECDH (and why)? I am confused, how ...
5
votes
2answers
342 views

Is Curve25519 vulnerable to private key exposure in the case of a bad RNG?

I'm really excited by what I've learned of advancements in elliptic-curve cryptography. Curve25519 seems to be a great choice at this point in time, but if I recall correctly, some elliptic curve ...
10
votes
1answer
447 views

Does Curve25519 only provide 112 bit security?

In a recent mail on the IETF CFRG mailing list it was claimed that: The (currently missing) security considerations (or somewhere) should describe why Curve25519 is ok when used in contexts where ...
5
votes
0answers
30 views

Safe generation of $k$ points on a curve such that the mutual discrete logs are hard?

I have a multiplicative group $G$ of prime order $p$ implemented using a twisted Edwards curve (similar to Ed25519). I want to compute a set of $k$ distinct points $P_1,...,P_k$ that generate $G$, ...
3
votes
2answers
132 views

Supersingular Isogeny Key Exchange broken?

Found this report detailing a quantum algorithm for computing isogenies between supersingular elliptic curves. http://cacr.uwaterloo.ca/techreports/2014/cacr2014-24.pdf with the quote ...
6
votes
1answer
376 views

ECC considered secure in OpenSSL?

If I perform the following command: openssl ecparam -list_curves using my OpenSSL version (1.0.1f), it spits out the following supported curves: ...
1
vote
1answer
91 views

Modular reduction for NIST prime P256— understanding the data

I am working on a project where I need to implement elliptic curve cryptography, I am struggling from a long time in order to understand the working and the process. Modular finite field arithmetic, ...
1
vote
0answers
68 views

Why is there no 'ECDSA' version of 'DHE-RSA-CHACHA20-POLY1305'?

So I was just checking my TLS cipherlist and noticed that there was a 'DSS' / DSA / ECDSA version of every ...
3
votes
1answer
128 views

public key cryptography and authentication for cross-platform network application

I'm developing network based application for control and telemetry on Linux based embedded system. I'm using ZMQ network library and Google Protocol Buffers serialization library for communication ...
2
votes
0answers
42 views

Testing PRNG quality from ECC public keys?

Having a large set of ECC public keys $P_i = n_iB$ on a fixed curve $E$ over a prime field, is there a way to determine if coefficients $n_i$ were generated using a bad PRNG? In other words, can a ...
11
votes
3answers
4k views

Why is the P-521 elliptic curve not in Suite B if AES-256 is?

In the NSA's document, "The Case for Elliptic Curve Cryptography" (archived), we have ...
5
votes
1answer
120 views

EC: Why does $h>200$ need to hold?

From BSI-TR-03111 (PDF), on page 15: The class number of the principal order belonging to the endomorphism ring of E SHOULD be at least 200. This value commonly is referred to as $h$ in that ...
6
votes
1answer
208 views

Is SHA-1 safe for signing ECDHE parameters?

Is using the SHA-1 algorithm insecure for hashing the ephemeral ECDH public key in the signed_params structure? There are some worrying articles about using SHA-1: ...
3
votes
1answer
73 views

Parameter choice Supersingular Isogeny DH

In “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies” by DeFeo, Jao and Plut (PDF), the public parameters are defined as: Supersingular curve $E$, and bases $P, Q$ ...
9
votes
2answers
120 views

Why develop Edward curve formulas that deviate from unification?

Edward curves were considered initially because they provide a unified formula for both doubling and addition, thus having inherent side-channel resistance. But a lot of work has been done recently ...
3
votes
1answer
106 views

Base point in Ed25519?

The paper "High-speed high-security signatures" by Bernstein et al. introduces the Edwards curve Ed25519. Concerning the base point $B$, it says that $B$ is the unique point $(x, 4/5)\in E$ for ...
5
votes
2answers
785 views

Understanding elliptic curve encryption [closed]

I'm having a hard time understanding the elliptic curve encryption. One thing thing I don't understand is listing all the points on the curve mod p. Suppose I have the following elliptic curve: $y^2 = ...
1
vote
1answer
158 views

Point addition in NaCl/libsodium (Curve25519)

In NaCl and libsodium, the crypto_scalarmult function implements the operation $Q = kP$ (scalar/point multiplication). There doesn't seem to be a function for point ...
7
votes
0answers
115 views

Attacks on elliptic-curve based cryptosystems through solving the Decisional Diffie-Hellman Problem with the Weil Pairing

Are there any examples of practical attacks on cryptosystems set over elliptic curves which utilize the easiness of DDH for certain choices of curves $E(\textbf{F}_q)$, and as such their lack of ...
5
votes
1answer
187 views

How to generate own secure elliptic curves?

I know that the algorithm used to generate the Brainpool curves and the NIST curves is published. The algorithm should be this one (RFC5639 Appendix A). From what it looks like it's rather slow to ...
3
votes
1answer
47 views

Favor hash size or field size when systems are disparate?

I'm working on an implementation of Krawczyk's Hashed MQV (HMQV). I'm using Crypto++, which is a C++ library. C++ has some features where classes that represent the crypto objects can be combined ...
10
votes
2answers
795 views

Why Elliptic Curves?

What is the benefit of using elliptic curves over the standard finite field, when the cyclic subgroup we consider of the EC's solution group is just isomorphic to some integer residue class of prime ...