Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

learn more… | top users | synonyms (2)

5
votes
2answers
553 views

Can elliptic curve (25519) be used to encrypt file?

This is probably a simple question, but I haven't been able to see it stated anywhere. Is it possible to directly encrypt a file (of any length) with some form of EC using the 25519 curve. I know it'...
4
votes
1answer
121 views

How does encryption work in elliptic curve cryptography?

So I think I understand a good amount of the theory behind elliptic curve cryptography, however I am slightly unclear on how exactly a message in encrypted and then how is it decrypted. So my ...
3
votes
1answer
77 views

Schnorr Ring Signatures - wrong hash results

I don't know if I've placed the question right, It is half maths, half programming. I'm writing Schnorr Ring Signatures on Elliptic Curves in Java and I have a problem. I've found scheme on integers ...
7
votes
3answers
218 views

Do I understand (below) why Q = dP is easy while finding d is hard

As we all know for discussion of Dual_EC_DBRG, the point on an elliptic curve Q can be calculated from P and some (large) integer d $Q = dP$ And we know that knowledge of Q and P is not sufficient ...
1
vote
1answer
58 views

What happens if you multiply a point with its order on complete Edwards curves?

I was recently working with some ECC crypto and stumbled across the following phrase on the SafeCurves page: The rational points of a complete Edwards curve are the pairs (x,y) of elements of ...
9
votes
4answers
261 views

What is the most secure ECC Curve?

I have for a while used Koblitz curve (sect571k1), in ECDH and ECDSA. But I have started wonder if it is the most secure. I prefer security over efficiency. So the curve doesn't have to be the most ...
13
votes
2answers
272 views

How do I get the equivalent strength of an ECC key?

I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
3
votes
0answers
99 views

HD (Hierarchical Deterministic) Keys using Safe Curves?

Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...
0
votes
0answers
55 views

Translation of Schorr Ring Signature to ECSchnorr Ring Signature

I have to write an EC version of Schnorr Ring Signature Scheme. I've already wrote regular ECSchnorr Signature Scheme using this (page 128). I've found a scheme of Schnorr Ring Signature Scheme (page ...
2
votes
1answer
72 views

Elliptic Curve ElGamal and DSA - smooth group order and element of large prime order

In regular ElGamal and DSA, we choose large primes $p$ and $q$ such that $p\equiv 1\pmod{q}$, and a group element $g$ of order $q$ by computing $a^{(p-1)/q}$ for some random $a$. This is to prevent ...
3
votes
0answers
36 views

Seeking an implementation of the Satoh algorithm for elliptical curve point counting

I would be very grateful if someone has an implementation of the Satoh algorithm (Fast Elliptic Curve Point Counting). Can someone point me to practical algorithm implementations or provide some ...
2
votes
0answers
68 views

How to compute projective cordinate Z in elliptic curve cryptography?

I was working on affine coordinates and struggling with the computation time taken for operations and then I was advised to use projective coordinates so that mul-inverse operation can be avoided Can ...
1
vote
0answers
36 views

Is it possible to re-generate ECPublic key from raw private key and curve params?

As per my understanding, in Elliptical curve cryptography, the EC PrivateKey is nothing but a bigInteger value. If you know the curve specs and you have this private BigInteger value (which I am ...
3
votes
3answers
150 views

Is there any alternative for extended euclidean algorithm to perform modulo division?

I'm implementing point addition and point doubling operations for elliptic curve cryptography. I have implemented extended euclidean algorithm to perform modulo division. It appears the that ...
2
votes
1answer
79 views

How to perfrom modular division while numerator is lesser than the denominator?

I'm implementing point addition and point doubling of elliptic curve cryptography. The formula that I'm using for slope is Point addition: $S = \frac{(P_y-Q_y)}{(P_x-Q_x)}$ where $P$ and $Q$ are the ...
4
votes
1answer
64 views

Optimal same-base exponentiation?

I've (finally) implemented the answer to this question in our library, which stated how to transform montgomery curves (and points) to weierstrass curves (and points). Now, for scalar multiplication, ...
0
votes
1answer
45 views

elliptic curve multiplication with negative factor

I'm learning the multiplication operation on EC. From most material I can found, the multiplication $nP$ is just: $$nP=P+P+\cdots +P+P$$ For negative factor, i.e. $(-n)P$, by above definition and the ...
1
vote
1answer
62 views

A standard extension of ECIES for multiple recipients (broadcast / multiparty)?

I have one sender, and a small number (~5) of recipients. The sender knows each recipient's public EC key. I want the sender to broadcast a single message in such a way that any one of the recipients ...
1
vote
0answers
68 views

Cryptographic operations for NISTP256 can be implemented using montgomery method?

I need to implement cryptographic operations starting with the curve NISTP256. I have been told to implement it using Montgomery method. I read a pfd from http://saluc.engr.uconn.edu/refs/sidechannel/...
11
votes
4answers
1k views

RSA & DH at risk due to math advances, will this eventually affect elliptic curves too?

I was looking into the predictions by some researchers that RSA and Diffie-Hellman may not be secure in the next few years due to advances in math and being able to calculate the discrete logarithm ...
1
vote
0answers
32 views

Edwards / Montgomery ECC over binary extension fields

I recentely had a discussion about the redesign of our ECC code for the library I'm collaborating on and the person I was discussing with came up with Edwards and Montgomery curves over binary ...
3
votes
1answer
425 views

ECC keys vulnerable to brute force attack?

I have started learning about Elliptic curve cryptography. Since the key size required in ECC is relatively lesser than the key size in RSA to provide the same amount of strong encryptions, I wonder ...
3
votes
0answers
51 views

Elliptic Curve Blind Signature Implementation

I have seen this prior post: Elliptic Curve based blind signature implementation Currently I'm sizing up how difficult it would be to attain Elliptic Curve Blind signatures for an application I'm ...
1
vote
0answers
39 views

How to find the integer multiplicand from given two points?

I have two points on an elliptic curve $P(x_1,y_1)$ and $Q(x_2,y_2)$ and a scalar value $x$, where $P=x \cdot Q$. What is the best way that I could figure out the value of $x$? Given that I know all ...
3
votes
2answers
83 views

Is there a way to do single key-pair asymmetric encryption?

All of the information on asymmetric encryption I can find uses key-exchanging to get a mutual symmetric key. What I am trying to do is encrypt a message with a public key and have it only readable ...
4
votes
1answer
98 views

Is there any reason not to use EdDSA with Weierstrass curves?

I'm volunterely working for a crypto library and we're planning on adding Curve25519 support (finally). At the same point I had the idea of adding support for EdDSA in the same run. Our library is ...
1
vote
0answers
43 views

Is this ECC based messaging method secure?

I developing an encrypted messaging for ZeroNet (aP2P file-based network, website: zeronet.io) and would like to have some guidelines if any of this could work. My first idea: In ZeroNet every user ...
0
votes
0answers
18 views

Strength of a cryptography algorithm [duplicate]

I'm just read this article from Atmel corporation in comparing RSA with ECC cryptography algorithms. First of all please read these two paragraphs quoted from the article: P1: Strength of an ...
1
vote
1answer
80 views

Where can I get the correct and precise algorithms for elliptic curve cryptography?

I have been asked to implement cryptographic operations using elliptic curves. I would like to get precise algorithms for various processes like key generation, digital signature and verification. I ...
0
votes
0answers
55 views

How to sign an elliptic curve point using an ECC signature scheme?

In Schnorr based ECC signature scheme, a message $M$ is signed with the private key $\mathit{sk}$ as $$s=\mathit{sk}\cdot h(M,R)+k$$ where $R=k\cdot P$ and $P$ is a base point. If $M$ is a point $(x,y)...
3
votes
1answer
57 views

Are private and public key sizes of Elliptic curve related?

I'm new to elliptic curve cryptography. I just want to know in the case where I take a random number (private key) and find its associated public key, does the size of the public key depends upon ...
3
votes
1answer
113 views

A (current or soon-to-be) NIST-recommended alternative to ECC?

So this comes from the professional rumor-mill, and I'm wondering if anyone might either debunk or shed light on this. My understanding is ECC is generally now preferred over RSA simply due to how ...
2
votes
0answers
66 views

EdDSA Verification vs. Cofactorless Verification

In the EdDSA for more curve paper the authors defines: Keys An EdDSA secret key is a $b$-bit string $k$. The hash $H(k) = (h_0, h_1, ... , h_{2b−1})$ determines an integer $s = 2^n+\sum_{c≤i<n}...
1
vote
0answers
44 views

ECDH security when no KDF is used

Let's suppose our device performs ECDH with a fixed, unknown, private key $prv$. It accepts as input any point $Q$ lying in the proper subgroup of the proper ellipict curve, then computes: $P = prv*Q$...
2
votes
1answer
43 views

Is there a single-use signature scheme, where a second use of the private key discloses it to the world?

With ECDSA (and possibly DSA too) I'm aware that if the same value for $k$ is used with the same private key $D_A$ to sign two different messages, then anyone possessing the two messages $m_0$ and $...
3
votes
2answers
60 views

How does the size of the prime affect Elliptic Curve Bit Security?

I am using the MIRACL Library to implement an Elliptic Curve Diffie Hellman based Key Exchange according to ECDH-Scheme-Wikipedia. Referring to the Miracl Docs they suggest a few curves. Each curve ...
2
votes
2answers
49 views

With EC secp256k1 is there a way of transforming a function of the private key to a function of the public key?

A key pair has a private key $D_A$ and a public key $Q_A$. $D_A$ is an integer less than the curve's $n$. Is there any (boolean) function of the private key $f(D_A)$ which can be transformed into a ...
1
vote
1answer
175 views

With ECDSA is there a way for the verifier to calculate any properties of $k$?

With ECDSA, given $(r,s)$ and $m$, is there a way for a verifier to calculate any (boolean) properties of $k$, without knowing $k$ or the private key $D_A$? (I understand that $k$ should be random, ...
2
votes
3answers
346 views

Is there a 1:1 mapping between private and public EC keys?

After asking: Are all possible EC private keys valid? I learned that all 32 byte (256 bit) values greater than 0 and less than n are all valid private keys. This means that 99% of all 256 bit values ...
3
votes
2answers
423 views

Are all possible EC private keys valid?

I usually generate a key pair using openssl or Bouncy Castle. I'm using curve secp256k1. The 256bit private keys look fairly random. Do all values of "private ...
1
vote
1answer
78 views

Is it safe to generate ECDSA keys from the hash of the previous, over and over again?

I have memorized a very long and secure passphrase, that when hashed with sha256, I can use the result as an ECDSA private key, and use it as a brain-address for Bitcoin. Now I need more bitcoin ...
1
vote
2answers
118 views

Is signing a plaintext sufficient?

If I have N bytes of plaintext, does signing it with my private key prove (to holders of my public key) that I have signed that exact plaintext messages? i.e. could an attacker use the plaintext and ...
5
votes
0answers
41 views

Is it possible and safe to use SAKKE for signing/verification, rather than for encryption?

Is it safe to use the Sakai–Kasahara key encryption algorithm (SAKKE) for signing/verification, rather than for encryption? (Example at bitbucket.org) In particular, I want many Bobs to be able to ...
1
vote
1answer
40 views

How to use a secret to allow the generation of public keys, where the private keys can be calculated later

Alice has a secret S and publishes some public information P, about S which is insufficient ...
1
vote
0answers
35 views

ECSchnorr Still getting wrong (hash?) results [closed]

I'm writing Schnorr signature algorithm on elliptic curves. I get instructions from here (page 128) Here's my code ...
4
votes
2answers
178 views

Curve25519 - Alice can decrypt her own message to Bob?

I'm developing an application with multiple clients and one server. All clients will have the same hard-coded Curve25519 key pair as well as the server's public key. The server will have its own key ...
3
votes
1answer
349 views

Do Weak Elliptic Curves Exist?

I'm running into very contradictory opinions when try to understand if weak elliptic curves exist. I'm not interested in the case when a curve's weakness is attributed to properties of an EC's prime, ...
4
votes
1answer
99 views

Are EC public/private keys significantly weakened by having a known byte?

I would like to use different EC keys for different purposes in an app, and I would like to easily see the purpose for which particular key (pair) was generated. With ~65K attempts, I can generate a ...
2
votes
1answer
74 views

Multiplication in elliptical curve cryptography

I'm practising for a cryptography test and came across this question: Let us assume that for a specific elliptic curve the formulas for the computation of $(x_3, y_3)=R+S$ are given by: $X_3=...
1
vote
1answer
91 views

All the affine points on the curve

I have calculated the affine points on the curve $x^2 + y^2 = 1 − 3x^2y^2$ over the field ${\mathbb{Z}}_{11}.$ Using $y^2 = \frac{1-x^2}{1+3x^2}$ I got the following points: $(0,1),(0,10),(1,0),(2,2)...