Elliptic curves are a mathematical structure. In cryptography, it is common to use the structure $y^2 = x^3 + ax^2 + b$ over a finite field. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider specific tags such as discrete-logarithm and ecdsa.

learn more… | top users | synonyms (1)

3
votes
1answer
101 views

Sextic twist optimization of BN pairing - cubic root extraction required?

I found the following paper really interesting: http://www.researchgate.net/publication/220378229_A_family_of_implementation-friendly_BN_elliptic_curves/file/79e4150b3a773beecd.pdf It allows ...
3
votes
1answer
334 views

Elliptic Curve Encryption Ciphertext Size

I'd like to know how much bigger is the ciphertext when encrypting a message using ECC encrytpion? ECIES (or ElGamal)
3
votes
2answers
160 views

Asymmetric key derivation – Who derives the new pub key can't know the new private key

I'm looking for a peer reviewed protocol or algorithm that can do this, preferentially I need something based on elliptic-curves cryptography. Alice know the main public key of Bob (B-PUB-1). Alice ...
3
votes
1answer
128 views

Are RSA or ECC vulnerable to an attack where the same (unknown) plaintext is encrypted with multiple public keys?

I'm not sure what this attack model is called - it's not known-plaintext and also not quite cipher-text-only. It is similar to this question except the general case (not just two keys) and using keys ...
3
votes
1answer
154 views

Derive a public EC key from two public EC keys

Alice has two EC key pairs: $a_1$, $a_2$ are private keys (integers), $A_1$, $A_2$ are the corresponding public keys (points). Alice and Bob want to create a new public key $C$. Alice must prove that ...
3
votes
1answer
230 views

Elliptic curve parameter generation

I am curious of the details of how one would go about generating elliptic curve parameters. (I know standardized parameters exist, but I'm trying to understand both how they were generated and the ...
3
votes
1answer
242 views

Is there a field guide to ECC for the IT Security layman?

I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ...
3
votes
0answers
108 views

Is there a flaw in this ECC blind signature scheme?

Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ...
3
votes
0answers
132 views

Using the same private key for two ECC key pairs

Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private ...
3
votes
2answers
183 views

Using single EC cert/keying material to derive symmetric encryption key (for storage)?

The situation involves a single party (single certificate) who would want to AES encrypt a file that they can later decrypt. Assume the EC certificate + EC keys have a purpose i.e. "File encryption" ...
3
votes
1answer
97 views

Measure ECC key size

I have implemented a ECC key generation scheme successfully. Now I need to find ECC key sizes of each generating key pairs. I assumed that ECC key size is the size of the ECC private Key. So I would ...
2
votes
1answer
200 views

Adding points on Elliptic Curves

How do we add the integer points $P=(-1, 4)$ and $Q=(2, 5)$ on the elliptic curve of the form $y^2=x^3+17$ ?
2
votes
1answer
147 views

counting points on elliptic curve

Given an elliptic curve with equation $y^2=x^3+ax+b$, and i want to find the number of points $(a,b)\in E(\mathbb{F}_p)$ where the polynomial has repeated roots, how do i do it? I have an intuition it ...
2
votes
1answer
139 views

Elliptic Curve Factorization: Why are elliptic curves suited for this kind of task?

Currently I'm working on a presentation of a paper that talks about the factorization of large numbers. In the paper elliptic curves are presented as a way to factorize large numbers. After hearing a ...
2
votes
1answer
293 views

Subtracting a point in elliptic curve cryptography?

I've had lots of practice adding points for my crypto class. However I've run into a situation where I need to subtract two points for decryption: ...
2
votes
2answers
195 views

What is the fastest elliptic curve operation f(P) in affine coordinates such that f^n(P)=P only if n is large?

I'm working with the affine representations of points of the Secp256k1 elliptic curve (from Bitcoin). I've read many papers that show that computing some functions, like $f(P)=3P$ can be computed ...
2
votes
3answers
77 views

Can a EC private key be derived from a public key?

I understand that the public key does not expose the private key. That is not the question. The question is: Given a EC public key, can a different, but plausible and functional private key be ...
2
votes
2answers
143 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
2
votes
1answer
94 views

Why are there only positive value points on an elliptic curve?

I read about elliptic curve cryptography $E$ over $Z_p$ where $p$ is prime number and $G$ is a base point on the curve. I noticed the points resulting from multiplication e.g. $2G$,$3G$,.....,$(N-1)G$ ...
2
votes
1answer
126 views

ECC partially blind signature scheme verification

Continued from Is there a flaw in this ECC blind signature scheme? The problem I needed a partially blind signature scheme for one of my projects, but couldn't find one on the internet, so I've made ...
2
votes
1answer
102 views

Verifying multiplicative inverse on a prime field in NIST's ECDSA_Prime.pdf

I am trying to learn about the Elliptic Curve Digital Signature Algorithm (ECDSA) by verifying the results in some example calculations. I found a PDF of example ECDSA calculations from NIST here: ...
2
votes
1answer
292 views

Why can ECC key sizes be smaller than RSA keys for similar security?

I understand how ECC is based on the discrete log problem and RSA on integer factorization. I've read several references that show how a solution to either of these problems can typically be adapted ...
2
votes
3answers
157 views

Generating bilinear pairing parameters - running time of finding member of p-torsion group

Update: Question completely rephrased. I want to create the parameters for a bilinear pairing (the Tate pairing in this case). In case you're interested I'm following this thesis, specifically the ...
2
votes
2answers
365 views

Can curve25519 keys be used with ed25519 keys?

Can curve25519 keys be used with ed25519? I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java. ...
2
votes
1answer
164 views

Brute force attack expected running time

I am a bit confused about the expected running times of brute force attacks on different cryptosystems. So let's assume a key size of $2^n$ bits. Symmetric key cryptography: $E(brute)$ = ...
2
votes
2answers
187 views

Scalar Multiplication on Elliptic Curves

In the elliptic curve: $y^2 = x^3 + 20x + 13 \bmod{2111}$. Using the point $P=(3, 10)$ I am wondering how to multiply this point by the scalar $57$? I realize I can write $57*P$ as $2^5*P + 2^4*P + ...
2
votes
1answer
204 views

How are Elliptic Curve Cryptography and Pairing Based Cryptography related?

I have been doing a project that uses the PBC library developed by Ben Lynn. But I am still not clear on how PBC is related to ECC. I know that this is a site for complex crypto QA, but I did not know ...
2
votes
1answer
284 views

How to properly add ECDSA private keys?

I'm currently working on an application that requires me to add two ECDSA private keys in order to make a new private key. The result has to have the property, that its corresponding public key is the ...
2
votes
1answer
76 views

What differences between Menezes–Vanstone ECC and ElGamal ECC?

After researching ECC encryption, I found that we can use ElGamal cryptosystem with elliptic curve and can we use Menezes-Vanstone cryptosystem with elliptic curve. What is the essential difference ...
2
votes
1answer
112 views

What are differences between $E(F_p)$ and $E(Z_p)$?

When I read some books about elliptic curve cryptography noticed that. sometimes symbolized elliptic curve over $F_p$ is $E(F_p)$ and sometimes symbolized elliptic curve over $Z_p$ is $E(Z_p)$. I ...
2
votes
1answer
208 views

How is the curve equation used in ECC?

I have a hard time learning exactly how the elliptic curve equation is used in the ECC. $$y^2 = x^3+ax+b$$ If someone knows and could explain to me in simple steps how this is done or a link to it ...
2
votes
1answer
59 views

How do I know if a given curve requires a FpCurve F2mCurve or ECCCurve?

I'm trying to read a public key into Bouncy Castle (secp256k1) and need to choose from the following objects FpPoint; FpCurve; or ...
2
votes
1answer
271 views

Is using Ed25519 parameters in ECDSA safe?

I recently discovered the Curve25519 key exchange lib and the Ed25519 signature lib. Due to the speculations about NIST-designed curves, there is a chance that I ditch them and use the curves above ...
2
votes
1answer
212 views

Elliptic curve cryptography attack vector

I would expect a complicated answer for what seems like a simple question about Elliptic curve cryptography. I've read several entries here such as "Elliptic curve cryptography related key attacks" ...
2
votes
1answer
105 views

Verify Messages to Embedded Device

I'm building an embedded device that I plan on distributing. Periodically the device will poll my server to check for updates and commands. I'd like the device to verify that any messages(JSON strings ...
2
votes
1answer
128 views

How to derive formulas for addition and multiplication in Jacobian coordinates

Is there a way to derive the formulas for point addition and multiplication on elliptic curves in Jacobian format by yourself? How could I have derived these formulas by myself?
2
votes
1answer
235 views

How to represent point-at-infinity in affine coordinate

In projective coordinates point-at-infinity can be identified with z=0. How to identify the point-at-infinity in affine coordinate. Whether x=0 and y=0 can be considered as point-at-infinity in ...
2
votes
2answers
559 views

ECC algorithm pollard's $\rho$ complexity

One of the methods to break a ECDLP is Pollard's rho algorithm. When ECDLP is defined over a finite field $F_p$, and given a relation $S=w.T$, where S and T are a member of $F_p$. Then ECDLP is to ...
2
votes
1answer
51 views

Is jacobian to projective conversion unique?

I am doing a small project in ECC. I have used the following equation for converting Projective to Jacobian coordinates: $$D = AC\\ E = BC^{2}\\ F = C$$ and also the following equation to convert ...
2
votes
1answer
197 views

Montgomery Ladder vs Double-and-Add

I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm. I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
2
votes
1answer
46 views

ECDSA signature verifiable 1-way transformations

Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$). I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ...
2
votes
1answer
63 views

Implementing AugPAKE over ECC

The AugPAKE spec says it can be implemented over elliptic curves. This sounds very promising, but they don't actually back that claim. Can this really be achieved? If so, how would one go about ...
2
votes
1answer
276 views

Mapping of message onto elliptic curve and reverse it

I would like to perform a variant of Elliptic Curve ElGamal in java using the BouncyCastle libraries. I currently face the difficulty of mapping a message $m$ onto the elliptic curve $E_p$. I have so ...
2
votes
2answers
499 views

Using ECDSA keys for encryption

I know that ECDSA is used for signature only, but I wonder if I can use the public/private Elliptic Curve keys for encryption too. I have ECDSA SSH public keys and I wonder if I can use them to ...
2
votes
2answers
204 views

Graphically representing points on Elliptic Curve over finite field

I have taken elliptic curve $E\colon y^2=x^3-4x+20$, defined over $\mathbb{F}_{29}$. The number of points on the curve, $\left|E(\mathbb{F}_{29})\right|=37$. I took base point $P=(1,5)$, and got ...
2
votes
3answers
247 views

understanding pairing $e:G \times G \to G_T$ and ( Decision)BDH assumption

From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$ I have some trouble to understand this map $e:G \times G \to G_T$. Am I ...
2
votes
1answer
113 views

Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack

The curve $E(\mathbb{F}_{47}):y^2=x^3+x+38$ has order $61$ and $61|47^3-1$ so the embedding degree of $E$ is $3$ and therefore the MOV attack, presumably using some sort of distortion map and a ...
2
votes
1answer
208 views

Choosing good parameter for Lenstra's elliptic curve factorization

In Wikipedia, there is an article explaining Lenstra's factorization algorithm. As far as I got it, we choose some $e \in \mathbb{N}$ and a point $P$ on the curve and then calculate $eP$. While ...
2
votes
1answer
847 views

BouncyCastle Elliptic Curve implementation

I'm implementing ECDH key exchange in C# using the BouncyCastle library and I'm having a hard time understanding the elliptic curve side (FpCurve). ...
2
votes
1answer
390 views

Storage of Private Keys

I'm building a bitcoin web application that will require all users to be assigned a wallet for adding funds to their account. I plan on exposing the public key to the user (the bitcoin address). Users ...