Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

learn more… | top users | synonyms (2)

4
votes
1answer
712 views

Trying to better understand the failure of the Index Calculus for ECDLP

So I'm going to give you guys my understanding and then if you would be so kind as to tell me where I'm off the mark (hopefully I'm not completely wrong). So basically the index calculus for the ...
4
votes
2answers
920 views

ECC algorithm pollard's $\rho$ complexity

One of the methods to break a ECDLP is Pollard's rho algorithm. When ECDLP is defined over a finite field $F_p$, and given a relation $S=w.T$, where S and T are a member of $F_p$. Then ECDLP is to ...
4
votes
1answer
64 views

How to exctract ECDH parameters from an OpenSSL-generated $G$?

I'm using ECDH for generating ECDH public parameters (p,a,b,G,n), I try to get this values using openssl ecparam -in cert.pem -text -noout For ...
4
votes
1answer
122 views

Why a key pair is used in OpenSSL ECDSA_sign or ECDSA_do_sign instead of only private key ?

If the digital signature in ECC (ECDSA) is made using a private key, why is the OpenSSL library using ECKEY pair as an input parameter instead of the private key only ?
4
votes
1answer
99 views

OpenPGP Public-Key algorithm

What means when pgpdump shows this kind of algorithm in the Public-Key Encrypted Session Key Packet? ...
4
votes
1answer
115 views

Is it ever unsafe to compress an EC point?

I am working with a library that outputs EC points in uncompressed form. To save space, I'm considering modifying said library to use compressed EC points. Assuming that I keep track of the sign bit ...
4
votes
1answer
283 views

Elliptic Curve Crypto, is a distributed signing method possible using Shamir's Secret Sharing?

Note: A distributed signature scheme exists for RSA: Practical Threshold Signatures, Victor Shoup. Is it possible to adapt such scheme for ECC? A centralized signing machine is vulnerable to ...
4
votes
1answer
181 views

How to handle the GCD(V,P) != 1 case when doing point addition or point doubling in elliptic curve cryptography

The equation for a finite field Elliptic Curve is of this form: $$y^2 \equiv x^3 + a * x + b \pmod{P}$$ When we do common EC operations like point doubling or point addition we need to calculate the ...
4
votes
1answer
229 views

How can I tell which curve a given ECDSA implementation uses? (P-521 or something else)

I'd like to test and see if certain software uses P-521 ECC curves, or if it uses another variant. Without having access to the sourcecode, or the specification, is there any way for me to test which ...
4
votes
2answers
582 views

How to calculate y value from ((y*y) mod prime) efficiently

i am working ECC-224 bit. can any one tell me, how to calculate y value from ((y*y) mod prime) efficiently for large bit numbers.
4
votes
1answer
63 views

Optimal same-base exponentiation?

I've (finally) implemented the answer to this question in our library, which stated how to transform montgomery curves (and points) to weierstrass curves (and points). Now, for scalar multiplication, ...
4
votes
1answer
64 views

Is there any reason not to use EdDSA with Weierstrass curves?

I'm volunterely working for a crypto library and we're planning on adding Curve25519 support (finally). At the same point I had the idea of adding support for EdDSA in the same run. Our library is ...
4
votes
3answers
135 views

Calculating $\mathbb F_{p^2}$-rational points of an elliptic curve defined over $\mathbb F_p$

How can I calculate points on an elliptic curve defined over $\mathbb F_p$, for example $y^2 \equiv x^3 + 1 \pmod p$, with coordinates in $\mathbb F_{p^2}$? (points might have complex number format in ...
4
votes
2answers
214 views

Which multiplicatively homomorphic encryption scheme supports encryption of 0?

I want a multiplicatively homomorphic encryption scheme that supports encryption of 0 (e.g. Elgamal doesn't support). I also want the multiplication to be operated on the ciphertext of 0, i.e., if ...
4
votes
0answers
114 views

Finding the subgroup in isogeny-based cryptography

Isogeny-based cryptography is one of the newest post-quantum cryptography. Hardness of this system is based on finding isogeny between two elliptic curves. Also this is theorem: Elliptic curves ...
4
votes
0answers
48 views

HD (Hierarchical Deterministic) Keys using Safe Curves?

Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...
4
votes
3answers
116 views

Is there any alternative for extended euclidean algorithm to perform modulo division?

I'm implementing point addition and point doubling operations for elliptic curve cryptography. I have implemented extended euclidean algorithm to perform modulo division. It appears the that ...
4
votes
0answers
70 views

Are there any asymmetric composite order group bilinear pairings?

Are there any asymmetric composite order group bilinear pairings? Is there a drawback of asymmetric over symmetric bilinear pairings of composite order either in efficiency or in security ?
4
votes
0answers
227 views

Is there a flaw in this ECC blind signature scheme?

Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ...
4
votes
0answers
202 views

Using the same private key for two ECC key pairs

Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private ...
4
votes
0answers
987 views

Reasons for Chinese SM2 Digital Signature Algorithm

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it specify ...
3
votes
2answers
328 views

Why are there only positive value points on an elliptic curve?

I read about elliptic curve cryptography $E$ over $Z_p$ where $p$ is prime number and $G$ is a base point on the curve. I noticed the points resulting from multiplication e.g. $2G$,$3G$,.....,$(N-1)G$ ...
3
votes
2answers
186 views

Is it possible to choose which point will have the public key of a given Elliptic Curve?

I am wondering if there is a feasible way that, given a specific elliptic curve (such as secp256r1), I could create a keypair where the public key has a given $x$-coordinate. If it is not possible, is ...
3
votes
2answers
467 views

Finite fields and ECC

I understand modular arithmetic(or at least I think I do!) and I've tried to read and learn about how the Math in RSA works(and I think it went pretty well). I've been reading up on ECC and it looks ...
3
votes
2answers
366 views

Are all possible EC private keys valid?

I usually generate a key pair using openssl or Bouncy Castle. I'm using curve secp256k1. The 256bit private keys look fairly random. Do all values of "private ...
3
votes
2answers
367 views

Elliptic Curve Cryptography Encryption Results

I'm playing around with a package that does Elliptic Curve Cryptography from http://jecc.sourceforge.net/ Every time I encrypt a value it produced a different result (same private key). However I'm ...
3
votes
1answer
269 views

Adding points on Elliptic Curves

How do we add the integer points $P=(-1, 4)$ and $Q=(2, 5)$ on the elliptic curve of the form $y^2=x^3+17$ ?
3
votes
2answers
352 views

Modulus for elliptic curve point multiplication

I want to implement a point multiplication ($k \cdot P$) operation on FPGA. I have a BN curve $y^2=x^3+2$, and a scalar value $k$. The $x$ and $y$ coordinates of point $P$ are of 256 bits. In the ...
3
votes
1answer
153 views

Difference between Pseudo Mersenne primes and Generalized Mersenne primes

The field prime numbers $p$ proposed by the NIST standards are referred to as Generalized Mersenne prime numbers [1] and as Pseudo Mersenne prime numbers [2]. Is there a difference between Pseudo ...
3
votes
1answer
313 views

ECC keys vulnerable to brute force attack?

I have started learning about Elliptic curve cryptography. Since the key size required in ECC is relatively lesser than the key size in RSA to provide the same amount of strong encryptions, I wonder ...
3
votes
1answer
124 views

What does signed fixed window method mean in ECC?

I am studying (sliding) window method in Elliptic Curve Cryptography (ECC) but I am confused by the term, signed fixed window method. By the way term is used in a research paper and not in the book ...
3
votes
1answer
243 views

counting points on elliptic curve

Given an elliptic curve with equation $y^2=x^3+ax+b$, and i want to find the number of points $(a,b)\in E(\mathbb{F}_p)$ where the polynomial has repeated roots, how do i do it? I have an intuition it ...
3
votes
1answer
86 views

Counting points on elliptic curve over binary field

How to count number of rational points on elliptic curve over binary field?
3
votes
2answers
73 views

Is there a way to do single key-pair asymmetric encryption?

All of the information on asymmetric encryption I can find uses key-exchanging to get a mutual symmetric key. What I am trying to do is encrypt a message with a public key and have it only readable ...
3
votes
1answer
284 views

Do Weak Elliptic Curves Exist?

I'm running into very contradictory opinions when try to understand if weak elliptic curves exist. I'm not interested in the case when a curve's weakness is attributed to properties of an EC's prime, ...
3
votes
1answer
132 views

What are the differences between the elliptic curve equations?

I think we're all aware of the "classical" Weierstrass (short?) elliptic curve equation: $y^2\equiv x^3 + ax +b \pmod p$. Well known examples of these curves include the NIST's and Brainpool ones. ...
3
votes
1answer
96 views

what is the public information in Elliptic curve cryptosystems [closed]

Currently my knowledge about Elliptic curve is quite limited to the textbook and I don't know how a practical Elliptic curve cryptosystem works. I read an example about key exchange using Elliptic ...
3
votes
2answers
191 views

In ECC, how do I prove that point addition is commutative?

I am studying elliptic curve cryptography and this question is related to the commutative property of point addition operation. Point addition $P_3(x_3,y_3)$ of two points $P_1(x_1, y_1)$ and ...
3
votes
1answer
845 views

Montgomery Ladder vs Double-and-Add

I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm. I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
3
votes
1answer
205 views

Impact of algorithms for factoring using elliptic curves over $\mathbb{Q}$

Recently a few papers have appeared that describe a new approach to factoring, using elliptic curves over $\mathbb{Q}$. See, e.g., Factoring integers and computing elliptic curve rational points, ...
3
votes
1answer
47 views

Favor hash size or field size when systems are disparate?

I'm working on an implementation of Krawczyk's Hashed MQV (HMQV). I'm using Crypto++, which is a C++ library. C++ has some features where classes that represent the crypto objects can be combined ...
3
votes
2answers
415 views

Solving Quadratic equations in Galois Field (2^163)

Hello I am working on implementing a message to elliptic curve point mapping hardware circuit I have done some research and found out the koblitz mapping method: I will be using a field of binary ...
3
votes
1answer
115 views

How many of primitive point on the elliptic curve?

In elliptic curves for cryptography, I know $nG=O$, where $G$ is a base point represented by $G=(x_g,y_g)\ on\ E(F_P)$, where $n$ is Order of point $G$. For example, $P(0,6)$ is a primitive point on ...
3
votes
1answer
255 views

Which is better ECDHE with TLS 1.0

I have a webserver which only supports TLS 1.0 and I am not sure about something: Which is the better cipher in this group when aiming for the best security? ...
3
votes
1answer
1k views

Possible ECC backdoor and its impact on Internet traffic

In a recent article, Bruce Schneier suggested that he prefers classic discrete log crypto over ECC because "I no longer trust the constants. I believe the NSA has manipulated them through their ...
3
votes
2answers
166 views

Finite fields in elliptic curve

I have an elliptic curve defined over finite field where $S_1=aP$ . Is it valid to say that $S_1P$ can also be computed. $P$ is the generator of the group. What my real question is that. Should '$a$' ...
3
votes
1answer
731 views

Adding and multiplication in jacobian coordinates

How can I derive formulas for adding 2 points and multiplication by a scalar in Jacobian coordinates $(x,y) = (\frac{X}{Z^2},\frac{Y}{Z^3})$ over an elliptic curve?
3
votes
1answer
348 views

How to properly add ECDSA private keys?

I'm currently working on an application that requires me to add two ECDSA private keys in order to make a new private key. The result has to have the property, that its corresponding public key is the ...
3
votes
1answer
65 views

How to perfrom modular division while numerator is lesser than the denominator?

I'm implementing point addition and point doubling of elliptic curve cryptography. The formula that I'm using for slope is Point addition: $S = \frac{(P_y-Q_y)}{(P_x-Q_x)}$ where $P$ and $Q$ are the ...
3
votes
1answer
93 views

Can a billion elliptic curve keys be generated on a laptop in less than an hour?

I want my application to generate an EC key pair. The first four bytes of the sha256 hash of the public key should contain a known IP address. As hashes are one-way functions, I need to brute force ...