Elliptic curves are a mathematical structure. In cryptography, it is common to use the structure $y^2 = x^3 + ax^2 + b$ over a finite field. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider specific tags such as discrete-logarithm and ecdsa.

learn more… | top users | synonyms (1)

2
votes
1answer
390 views

Storage of Private Keys

I'm building a bitcoin web application that will require all users to be assigned a wallet for adding funds to their account. I plan on exposing the public key to the user (the bitcoin address). Users ...
2
votes
2answers
86 views

ECDH anonymous key exchange to avoid PKI

I want to use TLS to encrypt the communication between peers in a P2P network. Each peer has a well known 256bit peer identifier (the public key of a 256bit elliptic curve keypair). Both peers need ...
2
votes
1answer
117 views

ECC Complexity order of point addition, scalar point multiplication and selecting random point

I am facing this problem in calculating the order of a process which involves ECC point addition: $P+Q$ , scalar multiplication: $aP$, and selecting random points in the group. The group is of prime ...
2
votes
1answer
131 views

Fast modular reduction

I am looking at ways to speed up modular reduction for the polynomial $$2^{256}-2^{32}-2^9-2^8-2^7-2^6-2^4-1$$ I have read the paper "Generalized Mersenne numbers" by J.A. Solinas, but it does not ...
2
votes
1answer
306 views

Adding and multiplication in jacobian coordinates

How can I derive formulas for adding 2 points and multiplication by a scalar in Jacobian coordinates $(x,y) = (\frac{X}{Z^2},\frac{Y}{Z^3})$ over an elliptic curve?
2
votes
3answers
174 views

EC equivalent for RSA-OAEP

I have some questions regarding aforementioned subject: Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ? Is ECIES-KEM sufficient ?
2
votes
1answer
129 views

Discrete log analog of ECM factoring algorithm?

Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas. Is there an analog of the elliptic curve (ECM) ...
2
votes
1answer
153 views

Generating non-supersingular elliptic curves for symmetric pairings

I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the ...
2
votes
1answer
221 views

Are there reference implementations of ECQV implicit certificates?

I am interested in exploring ECC implicit certificates, specifically using the ECQV protocol. While the actual implementation would not difficult to perform using building blocks provided by most ECC ...
2
votes
0answers
63 views

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part. What is the difference between ”ECDH with a ...
2
votes
0answers
151 views

Elliptic Curve based blind signature implementation

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
2
votes
0answers
115 views

Can keys from Bitcoin's Hierarchical Deterministic Wallets be correlated (reducing privacy)?

I'm trying to understand if the feature "Hierarchical Deterministic Wallets" in Bitcoin allows for complete privacy of all derived keys, and if any of those keys can be associated with each other ...
2
votes
0answers
133 views

Is this ECC encryption key sharing method okay?

Is this encryption key sharing okay to use? Or is much better to use ECIES? $G$ = base point $a$ = Alice’s private key $b$ = Bob’s private key $A = aG$ = Alice’s public key $B = bG$ = Bob’s public ...
2
votes
0answers
190 views

inverse problem about scalar multiplication on elliptic curve

Let $E$ be an elliptic curve over a finite field $F_p$. Given $n$ be a positive integer and $Q$ be a point on $E$, assume that $Q=nP$, how can we find this $P$? We can assume that $n|p-1$. If $n$ is ...
1
vote
3answers
185 views

Which area of Maths should I pursue?

I would like to know which area of Mathematics would be most beneficial to cryptography. Surely Algebraic Number Theory and maybe to a lesser extend, Elliptic Curves, are closely linked to ...
1
vote
1answer
131 views

Is the term “Elliptic Curve Discrete Logarithm Problem” a misnomer?

I have just started studying Elliptic Curve Cryptography, and I have this doubt. In ECC the group operation is addition (and not multiplication). So, why is ECDLP stated as a variation of the discrete ...
1
vote
2answers
125 views

64 bit Elliptic Curve key?

For a simple proof of concept project i'm (attempting!) to do, i've started looking into openSSL elliptic curve cryptography. However instead of the standard key lengths, 160-512. I'm interested in ...
1
vote
1answer
81 views

Does a cofactor of an elliptic curve have to be an integer?

What are the implications of a curve having a non-integer co-factor for its generator point? Is that even possible?
1
vote
2answers
140 views

Is there a problem with this non-ECDSA message signing?

Is there a problem with signing a message like this? ...
1
vote
1answer
96 views

Is either brainpoolP320r1 or brainpoolP320t1 a SafeCurve?

Not all elliptic curves are safe to use for cryptography, especially from an ECC safety perspective. The site http://safecurves.cr.yp.to/index.html shows that two tested Brainpool curves, ...
1
vote
1answer
112 views

Three-way key exchange with elliptic curves without pairing

Assume that there are three users, each with their own secret key $d_i$ and the corresponding public key $Q_i = d_i \cdot P$, such that $Q_i$ is a point on an elliptic curve and $P$ is a base point on ...
1
vote
1answer
225 views

Efficient algorithm for remainder calculation over prime field for ECC implementation?

I am working on 224-bit elliptic curve cryptography. In this 224-bit * 224-bit multiplication results 448-bit output. I am reducing 448-bit into prime field range( prime number $2^{224}-2^{96}+1$) ...
1
vote
3answers
311 views

File encryption with one keypair?

I'm working on a program that uses an ECC keypair in a (password protected) PKCS12 file (.pfx) to encrypt files. I like this method because I think it will be higher security (using ECDH to negotiate ...
1
vote
1answer
365 views

ECIES protocol - what does the || operation mean?

I am studying elliptic curves problems, which also includes study of related protocols such as ECIES. A there is a problem I don't understand operation $||$. What this operation mean? Some stuff is ...
1
vote
1answer
372 views

ECC - Point Addition/Point Multiplication

So I have a very beginner-esque knowledge of ECDSA and I'm trying to write something in python to take a private key and output the public key (Basically from what I understand just trying to do the ...
1
vote
2answers
234 views

ECM Implementation is really slow

I followed the algorithms 14.4 (computes 1st and 3rd coordinates in (X,Y,Z)#k modulo n) and 14.5 (factorization using ECM) in David Bressoud's book 'Factorization and Primality Testing'. I think the ...
1
vote
3answers
97 views

Encryption time in ECC

In RSA, encryption time is usually much less than decryption time due to having a small public exponent. Can this be achieved in Elliptic Curve Crypto (ECC)?
1
vote
1answer
55 views

Why does knowing the number of points on a curve help solve ECCDLP?

Perhaps, this is a really obvious question, but I am still having trouble understanding how this all fits together. Why is knowing the number of points on an Elliptic Curve helpful in cracking it? ...
1
vote
1answer
143 views

ECDSA Public Key generation

Referring to both Wikipedia page and ECDSA-cert paper I can understand that, given $\mathcal{E} = \mathcal{E}(a,\,b,\,\mathbb{F}_{2^m})$ as our elliptic curve on $\mathbb{F}_{2^m}$ group $G \in ...
1
vote
1answer
99 views

If its possible to derive the public key from a private key, why can't we go in reverse?

I'm looking at source code for BitcoinJ that derives a public key from the private key. ...
1
vote
1answer
128 views

ElGamal with elliptic curves I

It is very interesting to see @tylo's answer on ElGamal with elliptic curves. Instead of mapping the message to the elliptic curve point it just reduces an elliptic curve point to its $x$ coodrinate. ...
1
vote
1answer
135 views

What are some restrictions when converting Montgomery Curves into Weierstrass Curves?

I want to represent a Montgomery Curve (curve25519) in Weierstrass form as a personal exercise. After doing some math and referencing the conversion equation at ...
1
vote
1answer
108 views

Elliptic Curve Verifiable Secret Sharing

I'm reading this paper, which on page 3(Section IV.C) presents a Jointly Random Verifiable Secret Sharing Scheme for Elliptic curves. The algorithm makes sense to me save for this part: "Each ...
1
vote
1answer
344 views

Signature algorithm SHA 1-2 with ECDSA

Can someone please explain what key sizes are required for the ECDSA algorithm? I tried a 128 bit EC Key for SHA1withECDSA and it throws an error. However with 256 bit key I could run the algorithm. ...
1
vote
1answer
148 views

With TLS and ECDHE, how does curve selection work?

Given that a TLS client and server have already agreed upon ECDHE for session key establishment, how does the selection of the actual elliptic curve ("domain parameters") being used for deriving the ...
1
vote
1answer
112 views

Efficiency of computing $e(P,Q)$ Vs $g^a \pmod{p}$?

The definition of $e$ can be seen here. I want to know the accurate comparison of efficiency between $e(\cdot,\cdot)$ and $g^a \pmod{p}$. If computing $e(P,Q)$ is less efficient than computing $g^a ...
1
vote
1answer
181 views

Can Secp 256 K1 curves “map” to a value on FIPS 186-3 or P-256?

I'm looking at Secp 256K1 vs UProve's FIPS 186-3 or P-256 implementation. Is there any relationship between the curves such that I can consistently "map" or "project" values from one curve to ...
1
vote
1answer
187 views

Relationship between Elliptic Curve Discrete Log, Integer Discrete Log, and Integer Factorization

I am trying to look into a relation between the following three problems which are widely used to build public crypto systems: Integer Discrete log Elliptic Curve Discrete log Integer Factorization ...
1
vote
1answer
188 views

ECC Point Multiplication of Product

I can calculate $Q = a\,b\,G$ in several ways: $Q = a \, (b \, G)$ or $Q = b \, (a \, G)$. These give the same result, as expected. But if I do $c = (a \, b) \bmod n$ where $a \, b$ is much greater ...
1
vote
2answers
226 views

While generating a random Elliptic curve what are the conditions i have to considerd?

I want to generate a random elliptic curve over a prime field. What are the conditions I should satisfy? For the NIST recommended standard ECC-224 bit curve with prime $p=2^{224}-2^{96}+1$, a ...
1
vote
1answer
125 views

What are unified addition and differential addition in elliptic curve point arithmetic?

A lot of papers use these terms but I do not find a proper explanation of them. Can somebody tell the meaning / difference / intuition / application and if possible with an example.
1
vote
1answer
92 views

How to convert projective to jacobian co-ordinate in ECC?

I am doing a small project using elliptic curve in cryptography. My doubt is, can I directly convert a projective to a Jacobian coordinate system without using the affine conversion in elliptic curve ...
1
vote
1answer
71 views

order of elliptic curve divisible by prime

Why order "u" of an elliptic curve "E" defined over a finite field "GF (q)" (u = | E / GF (q) |) must be divisible by a large prime number r to be appropriate for cryptographic purposes?
1
vote
1answer
230 views

How do the following new (2013) ECC curves compare in security or efficiency? [closed]

I read about the following "safe" ECC curves and notably, secp256 and all the NIST curves are marked as "unsafe" when compared to more modern curves. I need a curve for signing or encryption, (or ...
1
vote
1answer
115 views

How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?

I am currently trying to create an ECCCurve for E-521. Unfortunately, it is not currently a named curve in the library I am using, so I will have to define it manually. I am using the definition of ...
1
vote
1answer
560 views

Is Curve25519-java secure?

I have only about 2 weeks of cryptography experience mostly in the form of questions on bitcoin.se. Is Curve25519-java up to date with current Curve25519 standards? Is Curve25519 itself secure? ...
1
vote
1answer
144 views

Curve parameter for hyperelliptic curve cryptography?

RFC5639 defines some curve parameter for Elliptic curve cryptography. Aren't there any curve parameter database for Hyperelliptic curve cryptography? What I can only find was that written in this ...
1
vote
1answer
89 views

Where can I double check my elliptic curve results?

I am trying to do some elliptic curve calculations by hand, just to refresh myself on how the system works. I calculated some points and did some operations by hand. I am trying to double check my ...
1
vote
1answer
311 views

Smart Card Basics

I want to implement some of the basic encryption algorithms on smart card, could any body guide me how to program a smart card, which tools (hardware and software) I should have, and if these tools ...
1
vote
1answer
153 views

Elliptic Curve is DH function or PKI?

can we reuse same ECC key on TLS for long terms or it must be used just once? (i mean can we use ECC like RSA?) is there patent free ECC implementation ?