Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

learn more… | top users | synonyms (2)

0
votes
2answers
52 views

Order and cofactor of the base point? [duplicate]

What is the order and cofactor of a base point? Is it possible to deduct the order and cofactor, given just the basepoint. What about the other way around from order and cofactor to basepoint?
2
votes
0answers
193 views

Choosing an optimal generator for an irreducible polynomial over a binary field?

I am reading the Certicom tutorial “An Example of an Elliptic Curve Group over F2m ” and I have following questions: How do they assume that generator $g = (0010)$ is correct for this polynomial? ...
0
votes
1answer
38 views

Key sizes for RSA over elliptic curves

I know that it is possible to define RSA over elliptic curves just as DSA and Diffie-Hellman have been. I know that it doesn't offer much of a speed advantage, but does it at least reduce the size of ...
2
votes
1answer
80 views

Construction of division polynomials

I'm trying to understand the construction of the division polynomials used in Schoof's algorithm. I firstly followed this report of Charlap and Robbins. I stuck with the definition of the leading ...
0
votes
1answer
41 views

Is there any place where I can find test vectors for point addition and doubling of ECC?

I want to extensively test my implementation of point addition and doubling. I have only one test vector with me. I need more values to test. In the web, I could find test vectors only for key pair ...
0
votes
1answer
71 views

Scalar multiplication with projective coordinates

I'm implementing point addition, doubling and scalar multiplication using projective coordinates. I took reference from this link https://www.nsa.gov/ia/_files/nist-routines.pdf I have implemented ...
0
votes
0answers
57 views

Simulation of a custom build network security algorithm with ElGamal Cryptosystem using Elliptic Curve

I am trying to build an algorithm to encrypt and decrypt text using ElGamal Cryptosystem using Elliptic Curve. My algorithm generation is done. But at simulation part I stuck. My algorithm steps are ...
7
votes
3answers
387 views

ECDSA signature verifiable 1-way transformations

Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$). I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ($r$,$s$...
0
votes
0answers
26 views

Do most TLS 1.2 implementations express curves in a canonical form when performing EC arithmetic?

Sorry if this is a silly question, but does anyone know if the cryptographic libraries which implement TLS 1.2 for Firefox, Chrome, etc. express a given curve in a canonical form (i.e. one of ...
4
votes
1answer
35 views

Can the backdoor in Dual_EC_DRBG be used to create a public key stream cipher?

Dual_EC_DRBG has the property that if $Q = e\cdot P$, someone who knows $e$ can break the PRNG. This seems to lead to a public-key stream cipher: Alice chooses a random $P, e$, where $P$ is a ...
0
votes
1answer
101 views

SHA1 collisions and the impact for ECDSA signatures

What will it mean for ECDSA using SHA1 when we have practical attacks breaking the collision resistance property of SHA1? [UPDATE] Added a bit more details to be clear. If $(r,s)$ is the ECDSA ...
8
votes
2answers
7k views

With OpenSSL and ECDHE, how to show the actual curve being used?

Using openssl s_client -host myserver.net -port 443 I can see the cipher negotiated is indeed using ECDHE for session key ...
10
votes
2answers
453 views

How to determine the order of an elliptic curve group from its parameters?

Let $\quad E:\; y^2 = x^3 + ax + b \quad$ be an elliptic curve defined over a finite field $\mathbb F_q$ where $q = p^n$, $a,b \in \mathbb F_q$ and $p \neq 2, 3$. By Hasse's theorem we know that the ...
0
votes
0answers
93 views

Degrade in performance with SSL_OP_SINGLE_ECDH_USE?

We have used SSL_OP_SINGLE_ECDH_USE when setting up our SSL_CTX . This seems to be causing a degrade in performance. I'm not able to find proper documentation for it except that it generates new ...
3
votes
1answer
207 views

Difference between Pseudo Mersenne primes and Generalized Mersenne primes

The field prime numbers $p$ proposed by the NIST standards are referred to as Generalized Mersenne prime numbers [1] and as Pseudo Mersenne prime numbers [2]. Is there a difference between Pseudo ...
13
votes
1answer
2k views

ECDSA Compressed public key point back to uncompressed public key point

From the ECDH demo here, if I generate a private key for Alice I can get _ P = 1175846487558108474218546536054752289210804601041 Which gives the following public ...
2
votes
0answers
46 views

Example of Projective Coordinates

Given the affine form of coordinates $(x,y)$ such as $(5,3)$, if I want to convert $(5,3)$ to projective coordinates $(x,y,z)$, should the form of point be $(5,3,1)$? It is triplet not a point, right? ...
2
votes
0answers
113 views

Convert projective to affine coordinates in ECC? [closed]

I am working with my project. I use projective coordinates but when I convert to affine coordinates, I can't get it. Can anyone help me? Projective Coordinates $(X,Y,Z)$ to Affine Coordinates $(X,Y)$:...
6
votes
1answer
119 views

Elligator-2 against curves over Fq, q mod 4 = 3

It appears that the conditions for applicability of Elligator-2 against many of the SaveCurves curves, where $q \mod 4 = 3$ will inevitably poke a hole in the bit-string set over $(0, 1, .. (q-1)/2)$. ...
0
votes
0answers
80 views

Semaev summation polynomials

I am little confused how this attack works. We have the points $P, Q$ such that $Q = nP$. We let $u_{1} $and $u_{2}$ such that $R(x,y)=u_{1}P+u_{2}Q$. Then if we find the solution $x_1,...,x_n$ of the ...
1
vote
1answer
152 views

Limitations of Elliptic Curve Cryptography?

Simple question, what are the limitations of ECC, both in terms of application and how secure it is? I heard that the NSA were able to read emails a few years back due to a backdoor they had ...
0
votes
0answers
34 views

Using Montgomery ladder to calculate the coordintes

In one of my assignments I need to solve the below: For a Montgomery curve $3v^2 = u^3+u^2+u$ over ${\mathbb{F}}_{11}$ and point $P = (9,8)$. I need to compute $x$ coordinate of $3P$ using ...
4
votes
1answer
64 views

Optimal same-base exponentiation?

I've (finally) implemented the answer to this question in our library, which stated how to transform montgomery curves (and points) to weierstrass curves (and points). Now, for scalar multiplication, ...
2
votes
0answers
81 views

Can we break ECDLP with this machine?

Let $P$ and $Q$ are two points of NIST elliptic curve $E$ (defined over $F_{2^m}$ with prime $m$) and $k$ is a private key such that $k.P=Q$. Also we have a machine that is able to leak some ...
5
votes
0answers
97 views

Performance of ECDSA, ECKCDSA and ECGDSA

It is proven that ECDSA algorithms are faster in key and signature generation compared to RSA. In addition, the signatures are much shorter. However, I would like to know the performance difference ...
1
vote
1answer
41 views

Elliptic ElGamal Public Key Cryptosystem doubt

I need an example of Elliptic ElGamal Public Key Cryptosystem. I have been trying with some values but I don't get the right solution. I have $p=13$, the elliptic curve $E:y^2=x^3+11x+7$ and a point ...
2
votes
0answers
61 views

Convert messages to elliptic curve points [duplicate]

Let $E$ be an elliptic curve; $\alpha,\beta$ two points of $E$; and $a$ a private key such that $\beta=a\cdot\alpha$. We choose random integer $k$ and plain text $x\in E$. Encryption and decryption ...
3
votes
1answer
123 views

Counting points on elliptic curve over binary field

How to count number of rational points on elliptic curve over binary field?
4
votes
2answers
253 views

Why is 2048-bit RSA always paired with 320-bit ECC?

You may already have noticed that most smart cards ship with 2048-bit RSA support and 320-bit ECC over GF(p) support. You may have already asked yourself "why exactly 320-bit?". Now I remember having ...
1
vote
2answers
118 views

Is signing a plaintext sufficient?

If I have N bytes of plaintext, does signing it with my private key prove (to holders of my public key) that I have signed that exact plaintext messages? i.e. could an attacker use the plaintext and ...
0
votes
0answers
55 views

How to sign an elliptic curve point using an ECC signature scheme?

In Schnorr based ECC signature scheme, a message $M$ is signed with the private key $\mathit{sk}$ as $$s=\mathit{sk}\cdot h(M,R)+k$$ where $R=k\cdot P$ and $P$ is a base point. If $M$ is a point $(x,y)...
4
votes
1answer
121 views

How does encryption work in elliptic curve cryptography?

So I think I understand a good amount of the theory behind elliptic curve cryptography, however I am slightly unclear on how exactly a message in encrypted and then how is it decrypted. So my ...
9
votes
2answers
620 views

How can I implement the elliptic curve MOV attack myself?

I understand and have implemented elliptic curve signatures in Python without the use of libraries like Sage, and would like to implement the MOV attack against certain weak types of elliptic curves. ...
1
vote
1answer
61 views

A standard extension of ECIES for multiple recipients (broadcast / multiparty)?

I have one sender, and a small number (~5) of recipients. The sender knows each recipient's public EC key. I want the sender to broadcast a single message in such a way that any one of the recipients ...
11
votes
4answers
1k views

RSA & DH at risk due to math advances, will this eventually affect elliptic curves too?

I was looking into the predictions by some researchers that RSA and Diffie-Hellman may not be secure in the next few years due to advances in math and being able to calculate the discrete logarithm ...
3
votes
3answers
150 views

Is there any alternative for extended euclidean algorithm to perform modulo division?

I'm implementing point addition and point doubling operations for elliptic curve cryptography. I have implemented extended euclidean algorithm to perform modulo division. It appears the that ...
7
votes
3answers
218 views

Do I understand (below) why Q = dP is easy while finding d is hard

As we all know for discussion of Dual_EC_DBRG, the point on an elliptic curve Q can be calculated from P and some (large) integer d $Q = dP$ And we know that knowledge of Q and P is not sufficient ...
3
votes
1answer
77 views

Schnorr Ring Signatures - wrong hash results

I don't know if I've placed the question right, It is half maths, half programming. I'm writing Schnorr Ring Signatures on Elliptic Curves in Java and I have a problem. I've found scheme on integers ...
1
vote
1answer
58 views

What happens if you multiply a point with its order on complete Edwards curves?

I was recently working with some ECC crypto and stumbled across the following phrase on the SafeCurves page: The rational points of a complete Edwards curve are the pairs (x,y) of elements of ...
12
votes
4answers
7k views

Is secp256r1 more secure than secp256k1?

Curves secp256r1 and secp256k1 are both examples of two elliptic curves used in various asymmetric cryptography. Googling for these shows most of the top results are Bitcoin related. I've heard the ...
9
votes
4answers
259 views

What is the most secure ECC Curve?

I have for a while used Koblitz curve (sect571k1), in ECDH and ECDSA. But I have started wonder if it is the most secure. I prefer security over efficiency. So the curve doesn't have to be the most ...
1
vote
1answer
91 views

All the affine points on the curve

I have calculated the affine points on the curve $x^2 + y^2 = 1 − 3x^2y^2$ over the field ${\mathbb{Z}}_{11}.$ Using $y^2 = \frac{1-x^2}{1+3x^2}$ I got the following points: $(0,1),(0,10),(1,0),(2,2)...
13
votes
2answers
271 views

How do I get the equivalent strength of an ECC key?

I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
2
votes
1answer
433 views

Koblitz encoding a message to a point, what is the “associated auxiliary base parameter”?

I am looking at the Koblitz method for encoding a message as an elliptic curve point. The first step given in the paper I'm reading is: "Choose an elliptic curve and its associated auxiliary base ...
3
votes
0answers
99 views

HD (Hierarchical Deterministic) Keys using Safe Curves?

Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...
14
votes
1answer
6k views

ElGamal with elliptic curves

I've searched some information on ECC, but so far I have only found Diffie-Hellman key-exchange implementations using ECC, but I don't want to exchange keys, I want to encrypt & decrypt data like ...
4
votes
2answers
190 views

Why are some x-coordinates unsuitable for an ECDSA generator point?

For Bitcoin's ECDSA curve (secp256k1, where $a=0$, $b=7$), why can't the generator point's first coordinate be $x=0$? That is, the point on the curve would be $(0,y)$ where $y$ satisfies $y^2 = 0^3 + ...
8
votes
0answers
1k views

Elliptic curve cryptography related key attacks

This question is an extension of Families of public/private keys in elliptic curve cryptography As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
0
votes
0answers
55 views

Translation of Schorr Ring Signature to ECSchnorr Ring Signature

I have to write an EC version of Schnorr Ring Signature Scheme. I've already wrote regular ECSchnorr Signature Scheme using this (page 128). I've found a scheme of Schnorr Ring Signature Scheme (page ...
2
votes
1answer
72 views

Elliptic Curve ElGamal and DSA - smooth group order and element of large prime order

In regular ElGamal and DSA, we choose large primes $p$ and $q$ such that $p\equiv 1\pmod{q}$, and a group element $g$ of order $q$ by computing $a^{(p-1)/q}$ for some random $a$. This is to prevent ...