Elliptic curves are a mathematical structure. In cryptography, it is common to use the structure $y^2 = x^3 + ax^2 + b$ over a finite field. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider specific tags such as discrete-logarithm and ecdsa.

learn more… | top users | synonyms (1)

1
vote
1answer
322 views

Signature algorithm SHA 1-2 with ECDSA

Can someone please explain what key sizes are required for the ECDSA algorithm? I tried a 128 bit EC Key for SHA1withECDSA and it throws an error. However with 256 bit key I could run the algorithm. ...
14
votes
3answers
718 views

What is so special about elliptic curves?

There seems to be sources like this, this also, and some introductions that discuss elliptic curves in general and how they're used. But what I'd like to know is why these particular curves are so ...
2
votes
1answer
136 views

Elliptic Curve Factorization: Why are elliptic curves suited for this kind of task?

Currently I'm working on a presentation of a paper that talks about the factorization of large numbers. In the paper elliptic curves are presented as a way to factorize large numbers. After hearing a ...
3
votes
1answer
172 views

Why is a simple hash into $G_2$ for (certain) pairing based crypto not possible?

In the paper Pairings for Cryptographers we read about what the authors call a type 2 pairing in which we have a "pairing friendly curve $E$ over $\mathbb{F}_q$ with embedding degree $k>1$ and ...
0
votes
1answer
244 views

openSSL ECDH private key size

When you are using a named curve like P-256 in openSSL, is there any standard key size for ECDH private key keys? If you look at the ec_key.c file in the openSSL ...
2
votes
1answer
282 views

Subtracting a point in elliptic curve cryptography?

I've had lots of practice adding points for my crypto class. However I've run into a situation where I need to subtract two points for decryption: ...
1
vote
1answer
144 views

With TLS and ECDHE, how does curve selection work?

Given that a TLS client and server have already agreed upon ECDHE for session key establishment, how does the selection of the actual elliptic curve ("domain parameters") being used for deriving the ...
6
votes
2answers
1k views

With OpenSSL and ECDHE, how to show the actual curve being used?

Using openssl s_client -host myserver.net -port 443 I can see the cipher negotiated is indeed using ECDHE for session key ...
3
votes
3answers
349 views

Timing Attacks on ECDSA, ECDHE, AES and SHA2

Are there any known timing attacks (both practical and theoretical) on any implementations of the following? ECDSA (I'm aware of this one - are there any applicable to prime fields?), ECDHE (again, ...
2
votes
1answer
58 views

How do I know if a given curve requires a FpCurve F2mCurve or ECCCurve?

I'm trying to read a public key into Bouncy Castle (secp256k1) and need to choose from the following objects FpPoint; FpCurve; or ...
2
votes
0answers
114 views

Can keys from Bitcoin's Hierarchical Deterministic Wallets be correlated (reducing privacy)?

I'm trying to understand if the feature "Hierarchical Deterministic Wallets" in Bitcoin allows for complete privacy of all derived keys, and if any of those keys can be associated with each other ...
1
vote
1answer
112 views

Efficiency of computing $e(P,Q)$ Vs $g^a \pmod{p}$?

The definition of $e$ can be seen here. I want to know the accurate comparison of efficiency between $e(\cdot,\cdot)$ and $g^a \pmod{p}$. If computing $e(P,Q)$ is less efficient than computing $g^a ...
1
vote
1answer
176 views

Can Secp 256 K1 curves “map” to a value on FIPS 186-3 or P-256?

I'm looking at Secp 256K1 vs UProve's FIPS 186-3 or P-256 implementation. Is there any relationship between the curves such that I can consistently "map" or "project" values from one curve to ...
4
votes
1answer
249 views

Blockwise Montgomery multiplication

I have to implement a 256*256 bit Montgomery multiplier for pairing computations. The straightforward approach is to use a bit-serial version, but I would like to utilize the built-in 64*64 bits ...
0
votes
0answers
30 views

Using same keypairs for crypt and sign with elliptic curve [duplicate]

I asked my question on a mailing list ( http://www.metzdowd.com/pipermail/cryptography/2013-October/018061.html ) and i received many answers, which are confused me. So i try to ask here, it is ...
0
votes
2answers
209 views

Reuse of a DH / ECDH public key

I was wondering whether it is safe to use the same DH or ECDH key pair in more than one key agreement, particularly if these public keys are in a public registry. These public keys could be used by ...
0
votes
1answer
167 views

Key space: Dense and sparse

I'm taking a cryptography class and I come across these terms dense and sparse key space allt he time. What do they mean? As far as I can I understand, dense key space means that there are more ...
2
votes
1answer
261 views

Is using Ed25519 parameters in ECDSA safe?

I recently discovered the Curve25519 key exchange lib and the Ed25519 signature lib. Due to the speculations about NIST-designed curves, there is a chance that I ditch them and use the curves above ...
3
votes
1answer
153 views

Derive a public EC key from two public EC keys

Alice has two EC key pairs: $a_1$, $a_2$ are private keys (integers), $A_1$, $A_2$ are the corresponding public keys (points). Alice and Bob want to create a new public key $C$. Alice must prove that ...
1
vote
0answers
201 views

Does BouncyCastle (for ECC) resist timing attacks?

I need to extend the TLS protocol to be able to use other key exchange scheme based on elliptic curves. I am planning to use BouncyCastle's implementation in Java and in .NET. I am worring about ...
1
vote
1answer
139 views

Curve parameter for hyperelliptic curve cryptography?

RFC5639 defines some curve parameter for Elliptic curve cryptography. Aren't there any curve parameter database for Hyperelliptic curve cryptography? What I can only find was that written in this ...
2
votes
1answer
210 views

Elliptic curve cryptography attack vector

I would expect a complicated answer for what seems like a simple question about Elliptic curve cryptography. I've read several entries here such as "Elliptic curve cryptography related key attacks" ...
1
vote
0answers
286 views

Understanding elliptic curve encryption

I'm having a hard time understanding the elliptic curve encryption. One thing thing I don't understand is listing all the points on the curve (mod p). Suppose I have the following elliptic curve: y^2 ...
2
votes
3answers
247 views

understanding pairing $e:G \times G \to G_T$ and ( Decision)BDH assumption

From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$ I have some trouble to understand this map $e:G \times G \to G_T$. Am I ...
27
votes
1answer
24k views

Explaining weakness of Dual EC DRBG to wider audience?

I have an audience of senior (non-technical) executives and senior technical people who are taking the backdoor in Dual_EC_DRBG and considering it as a weakness of Elliptic curves in general. I can ...
6
votes
1answer
247 views

What exactly could be accomplished with a backdoor in Dual_EC_DRBG?

Assume that some entity really holds the private key corresponding to the recommended/dubious constants of Dual_EC_DRBG. According to this presentation, they would be able to reconstruct the internal ...
3
votes
1answer
720 views

Possible ECC backdoor and its impact on Internet traffic

In a recent article, Bruce Schneier suggested that he prefers classic discrete log crypto over ECC because "I no longer trust the constants. I believe the NSA has manipulated them through their ...
3
votes
1answer
352 views

Hide a weakness in ECC by choosing the prime or one of the curve coefficients

Suppose you are given a value $c$. Can you find a prime $p$ and an integer $b$ such that the elliptic curve $$E: y^2 \equiv x^3 -3x + b \pmod p$$ is cryptographically weak? You need to choose ...
64
votes
3answers
20k views

Should we trust the NIST-recommended ECC parameters?

Recent articles in the media, based upon Snowden documents, have suggested that the NSA has actively tried to enable surveillance by embedding weaknesses in commercially-deployed technology -- ...
3
votes
2answers
243 views

Proof of elliptic curve difficulty

Are there any proofs that cryptographic functions on an elliptic curve are any more difficult than the analogues over modulo arithmetic? While at present, ECC appears to be more difficult, as it is ...
34
votes
6answers
13k views

Who uses Dual_EC_DRBG?

Recent news articles have suggested that the NSA may be involved in trying to influence the cryptography in public standards or commercially deployed software, to enable the NSA to decrypt the ...
1
vote
1answer
89 views

Where can I double check my elliptic curve results?

I am trying to do some elliptic curve calculations by hand, just to refresh myself on how the system works. I calculated some points and did some operations by hand. I am trying to double check my ...
3
votes
2answers
270 views

Elliptic Curve Cryptography Encryption Results

I'm playing around with a package that does Elliptic Curve Cryptography from http://jecc.sourceforge.net/ Every time I encrypt a value it produced a different result (same private key). However I'm ...
3
votes
2answers
259 views

Finite fields and ECC

I understand modular arithmetic(or at least I think I do!) and I've tried to read and learn about how the Math in RSA works(and I think it went pretty well). I've been reading up on ECC and it looks ...
9
votes
1answer
2k views

ElGamal with elliptic curves

I've searched some information on ECC, but so far I have only found Diffie-Hellman key-exchange implementations using ECC, but I don't want to exchange keys, I want to encrypt & decrypt data like ...
1
vote
1answer
110 views

Three-way key exchange with elliptic curves without pairing

Assume that there are three users, each with their own secret key $d_i$ and the corresponding public key $Q_i = d_i \cdot P$, such that $Q_i$ is a point on an elliptic curve and $P$ is a base point on ...
3
votes
0answers
187 views

Reasons for SM2 Digital Signature Algorithm

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it specify ...
5
votes
1answer
736 views

Why is the P-521 elliptic curve not in Suite B if AES256 is?

In the NSA's document, "The Case for Elliptic Curve Cryptography", we have ...
4
votes
6answers
560 views

Generate Elliptic Curve Private Key from User Passphrase?

I'd like to generate a private elliptic curve key from user input like pass phrase. Is the best way to do this with a key derivation function like PBKDF2? Is there a better way? Edit (based upon ...
1
vote
1answer
186 views

Relationship between Elliptic Curve Discrete Log, Integer Discrete Log, and Integer Factorization

I am trying to look into a relation between the following three problems which are widely used to build public crypto systems: Integer Discrete log Elliptic Curve Discrete log Integer Factorization ...
2
votes
1answer
104 views

Verify Messages to Embedded Device

I'm building an embedded device that I plan on distributing. Periodically the device will poll my server to check for updates and commands. I'd like the device to verify that any messages(JSON strings ...
4
votes
1answer
275 views

How Were secp*k1 elliptic curve generators chosen?

The Koblitz elliptic curves specified in the SEC2 document https://docs.google.com/viewer?url=http%3A%2F%2Fwww.secg.org%2Fcollateral%2Fsec2_final.pdf all have the nice feature that the parameters are ...
3
votes
2answers
136 views

Finite fields in elliptic curve

I have an elliptic curve defined over finite field where $S_1=aP$ . Is it valid to say that $S_1P$ can also be computed. $P$ is the generator of the group. What my real question is that. Should '$a$' ...
6
votes
1answer
629 views

Why Elliptic curve cryptography are not popular in practice

RSA and ElGamal can be implemented using the technique of Elliptic curves. I am confused on why the it seems that Elliptic curves are not so popular in cryptographic applications since they provide ...
3
votes
1answer
478 views

Converting Ed25519 public key to a Curve25519 public key

I understand that: $$x_{montgomery} = \frac{1 + y_{edwards}}{1 - y_{edwards}}$$ Using the libsodium ed25519 implementation, I have tried to write the following: ...