Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

learn more… | top users | synonyms (2)

1
vote
0answers
100 views

request for data to test deterministic ecdsa signature algorithm for secp256k1

I’m implementing the RFC 6979 procedure to compute a message signature. I want to test my program on the secp256k1 elliptic curve. Note the “k” in secp256k1, i.e. the Koblitz curve. If you have the ...
2
votes
1answer
196 views

Polynomial division hardware implementation

I am beginning the implementation of the polynomial binary division algorithm now as I understood i will be checking the MSB bit if 1 to XOR and shift the sum if 0 i will only shift. What I am not ...
0
votes
0answers
103 views

processing time for multiplication and exponentiation in pairing base cryptography

I'm using the Boneh-Boyen-Shacham signature scheme and want to estimate complexity in my scheme. As reported in "Scott M., Efficient Implementation of Cryptographic pairings", if we set parameters ...
0
votes
0answers
123 views

Polynomial Inversion over Galois Field

Hello guys I am looking to calculate the Inverse of a given polynomial in Galois field I have found the little Fermat's algorithm and the Itoh-Tsujii I am getting a bit confused with both algorithm ...
2
votes
1answer
112 views

Roots in modulo field

I have a point $(X,Y)$ on an elliptical curve $E(a,b)$ where $a=-3$ and $B$ is a large number that is in hexadecimal from -51BD. To compress this point oficially in a program, we know that every $X$ ...
1
vote
1answer
88 views

Modulo Square Roots [duplicate]

Here's my issue and someone can help me understand it so I can program it correctly. I have a point(X,Y) on an Elliptical Curve E(a,b) where a=-3 and B is a large number that is in hexidecimal from ...
1
vote
3answers
424 views

Point decompression on an elliptic curve

I'm programming an elliptic curve cryptosystem and I'm having difficulty with decompressing points. The following information is from my project specification as to my understanding: Given a point ...
2
votes
0answers
184 views

Choosing an optimal generator for an irreducible polynomial over a binary field?

I am reading the Certicom tutorial “An Example of an Elliptic Curve Group over F2m ” and I have following questions: How do they assume that generator $g = (0010)$ is correct for this polynomial? ...
3
votes
2answers
575 views

Creating serial key generator using ECDSA, how to get signature short enough?

I've written some questions in this stackoverflow and got great responses but now I'm trying to wrap it all together. I have for the last couple of weeks been building a serial key generator project ...
3
votes
1answer
313 views

ECC - ElGamal with Montgomery or Edwards type curves (curve25519, ed25519) - possible?

I know the usual way of using getting shared secrets for encryption with ECC is DH, however, this only works with two keypairs of exactly the same kind, for example two curve25519- or two ...
2
votes
1answer
288 views

Finding Elliptical curve points and encoding text using them

I recently got into learning Elliptical curve cryptography and are currently building a project in C#. Everything is working well so far, I can encode and decode points, and thanks to this forum I ...
1
vote
1answer
436 views

Elliptical curve cryptography key generation time

I am currently trying to learn more about Elliptical curve crypthography and have finally started to get things working and undestanding the different pieces. I've written a small project in C# and ...
2
votes
1answer
179 views

What is the difference between order of base point and curve order in EC? [duplicate]

When I was read about the elliptic curve cryptography I found some definition about domain parameter of elliptic curve like the follow. But I did not understand something $p$: prime number. $a, b$: ...
0
votes
0answers
88 views

Elliptic curve trapdoor function without modular arithmetic?

From what I understand, an elliptic contains a set points satisfying the equation $y^2=x^3 + ax + b$ together with the point at infity. It seems clear how multiplication with a scalar and a point ...
0
votes
1answer
117 views

How many characters per block in an El Gamal ECC cryptosystem?

Looking for the number of characters that can be encrypted using the The elliptic curve ElGamal cryptosystem of each block, I found these lines. But I cannot understand them: Actually in our case ...
3
votes
1answer
117 views

How many of primitive point on the elliptic curve?

In elliptic curves for cryptography, I know $nG=O$, where $G$ is a base point represented by $G=(x_g,y_g)\ on\ E(F_P)$, where $n$ is Order of point $G$. For example, $P(0,6)$ is a primitive point on ...
2
votes
2answers
124 views

What is primary security in ECC?

I read the following paragraph in a book about Elliptic Curve Cryptography, but didn't understand it: The primary security in ECC is the parameter $n$; where $n$ is Order of point $G$, that is $n$ ...
2
votes
0answers
157 views

As a cryptographer, what are the things I should care about in my implementation of pairing functions?

As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing. I am ...
1
vote
0answers
198 views

How represent message in Menezes–Vanstone elliptic curve cryptography

I ask about represent message in Menezes–Vanstone elliptic curve cryptography I now encrypt function as follow $C_1 = (M_1 * K_1) mod\ P$ $C_2=(M2 * k_2) mod\ P$ My question is about how much the ...
1
vote
0answers
61 views

DLOG in $\mathbb{F}_{p^n}^*$?

Assume that we are given an element $g\in \mathbb{F}_{p^n}^*$ and $g$ does not belong to any of the smaller subfields contained in $\mathbb{F}_{p^n}$. If the degree of $g$ is some number $q$, how much ...
2
votes
1answer
403 views

What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?

This page on Twist security mentions a combined attack and a twist rho attack, applicable in particular to NIST P-224 curve with cost $2^{58.4}$ something, with no mention precise definition of ...
6
votes
1answer
472 views

Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
2
votes
1answer
950 views

Why does openssl use SHA1 in ECC when I use secp384r1 curve

I need a small clarification that why openssl using SHA1 in ECC when I am using secp384r1 curve, but in rfc they are saying we should use SHA2. Thing here is am using nanoECC in my DTLS, nanoECC ...
1
vote
1answer
193 views

What can be learned from the ciphertext of LibSodium's crypto_box_detached()?

LibSodium, (https://github.com/jedisct1/libsodium), has a function crypto_box_detached() which does authenticated encryption using the public key of the recipient ...
1
vote
1answer
124 views

Protection of Elliptic Curve Implementations against side-channel attacks [closed]

Recent fast elliptic curve implementations, for example a presentation at Eurocrypt 2014 (earlier presentation slides, the paper) talks about protection against only timing attacks. Why only timing ...
1
vote
3answers
228 views

Elliptic curve parameters

What's the meaning of 160 bit Curve in Elliptic curve ? or 192 or 224 or 256 and etc. And What is the standard for selecting this number of bit ? why they don't say 100 bit curve?
1
vote
1answer
286 views

How can convert affine to Jacobian coordinates?

I have a point in affine coordinates: $(x,y)$. What should I do when I want to convert to $(X,Y,Z)$ in Jacobian coordinates? I need it for calculating ECC in a prime field.
1
vote
0answers
87 views

advantages of hashing over elliptic curve signatures for a proof of work protocol

I'm trying to create a proof-of-work protocol for a proof-of-concept software, and it's basically something like this: ...
1
vote
0answers
110 views

Which mathematical operations does secp256k1 point multiplication use?

To convert a bitcoin private key to a public key, the secp256k1 point multiplication math is used. Could I – theoretically – convert a private key to a public key just using the four arithmetic ...
3
votes
1answer
585 views

What is the difference between “secp…” and “sect…”?

The National Institute of Standards and Technology (NIST) recommended elliptic curve domain parameters to have names such as “secp…” and “sect…”. For example: “secp224k1” and “sect571k1”. What is ...
4
votes
3answers
224 views

Why are we not using multiple ciphers per message?

I am aware of at least rsa, elgamal-encryption, and variations of elliptic-curves relying on different problems and that those problems are considered hard. However, if someone figures out a way to ...
1
vote
0answers
400 views

What is the (uncompressed) x,y-representation of a curve point on the P-256 NIST elliptic curve?

I am trying to understand the FIDO U2F Raw Message Format, especially the format in which a user public key should be provided. The documentation says the following: A user public key [65 bytes]. ...
0
votes
1answer
112 views

Is elliptic curve point multiplication semantically secure?

Is elliptic curve point multiplication semantically secure? I'd like to know if there are some sets of elliptic curve parameters (e.g. NIST curves) that are proved to be semantically secure or that ...
0
votes
1answer
407 views

Bouncy Castle elliptic curve from explicit parameters (E-521)

I'd like to use a curve that's not included in the Bouncy Castle EC named curves spec, specifically E-521. According to the BC javadocs, you need a few values in order to do this: q, a, and b for the ...
0
votes
1answer
84 views

How can i calculate prime of Elliptic Curve?

In many articles i have found directly the calculation of prime elliptic curve. How can i calculate this prime $p$ ? For example if I consider NIST P-256, $ p = 2^{256}-2^{224}+2^{192}+2^{96}-1$. Why ...
2
votes
1answer
663 views

Why is 224 bit ecdsa faster than 192 bit ecdsa?

I ran several benchmarks using openssl on 2 different computers and I got a surprising result. for the Nist 192 bit curve the benchmark result is ...
0
votes
0answers
122 views

Scalar multiplication of elliptic curve point by a fraction

I'm implementing an algorithm that works on a generic finite cyclic group written in the classic multiplicative notation: (G,*) = < g > , n = |g| At a ...
0
votes
1answer
89 views

How to calculate kinv from the given k value

I am implementing an ECDSA NIST test vectors verification application. The test vectors are taken from http://csrc.nist.gov/groups/STM/cavp/#09. One of the test vectors is given below: ...
2
votes
0answers
60 views

ECIES: Purpose of optional shared information?

According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows: Generate a random shared secret $Z$ according to ECIES, which will never be ...
1
vote
1answer
133 views

ECIES: Purpose of MAC?

Assumptions: $A$ wants to communicate with $B$ $A$ knows a public key $P_B$ which is trusted by a third party and belongs to $B$ $A$ knows the address of someone who pretends to be $B$ $A$ wants ...
12
votes
4answers
7k views

Is secp256r1 more secure than secp256k1?

Curves secp256r1 and secp256k1 are both examples of two elliptic curves used in various asymmetric cryptography. Googling for these shows most of the top results are Bitcoin related. I've heard the ...
-2
votes
1answer
94 views

How Proof all Subgroup point of prime order elliptic curve have prime order [#G=#E]? [closed]

anyone knows any reference that proof it ? Please Help .
2
votes
1answer
300 views

Prevent MITM attack while encrypting data by using ElGamal ECC?

I am using ElGamal ECC to encrypt my plain text data. I want to ensure that my data is safe from a Man-In-The-Middle attack. What methodology I can adopt to achieve this goal? How can we prevent a ...
1
vote
0answers
164 views

Type G Bilinear Pairings

I was reading PBC and its implementations for finding pairing parameters. I am particularly interested in implementing a BLS signature scheme with 20-byte (160-bit) signatures ("short signatures"). ...
3
votes
1answer
177 views

Proving Non-Existence of ECC Backdoors

In light of the NIST Dual EC DRBG scandal, I was intrigued by a NIST slide (slide 9) that said the two points P and Q can be chosen so that the chooser can prove they don't have a backdoor. This ...
0
votes
0answers
265 views

RSA and ECDSA Certificate Sizes

Is there a table (or a whitepaper from official sources) that compares the size of X509 certificates generated with RSA (starting from 1024 bits) and ECDSA (starting from 160 bits) ? Thanks for the ...
1
vote
0answers
131 views

ECC cryptography with shorter signature when not needing high security?

I am new here and fairly new to cryptography, so if I say something wrong, let me know. I am trying to set up a system where a user can receive a temporary license key over the phone, put it into ...
7
votes
2answers
391 views

Rely on NSA Suite B Cryptography?

NSA's Suite B Cryptography suggests some cryptographic algorithms for encryption, digital signatures, message digests and key agreements. The selected algorithms and their key size are suggested by ...
2
votes
0answers
152 views

Hardware Implementation of Pairing over BN curves

I am in the middle of FPGA based Hardware architecture design for the computation of Pairing (particularly R-ate Pairing) over BN curves. Where, the point addition, and point doubling should be ...
6
votes
1answer
379 views

Point addition equation in projective co ordinates

How can I get point addition equation for elliptic curves in projective co ordinate system? Can I get it by changing $$ x = X/Z $$ and $$ y =Y/Z $$ in the equation for affine co ordinates' group law? ...