Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

learn more… | top users | synonyms (2)

2
votes
1answer
343 views

Is the term “Elliptic Curve Discrete Logarithm Problem” a misnomer?

I have just started studying Elliptic Curve Cryptography, and I have this doubt. In ECC the group operation is addition (and not multiplication). So, why is ECDLP stated as a variation of the discrete ...
2
votes
2answers
245 views

What is the fastest elliptic curve operation f(P) in affine coordinates such that f^n(P)=P only if n is large?

I'm working with the affine representations of points of the Secp256k1 elliptic curve (from Bitcoin). I've read many papers that show that computing some functions, like $f(P)=3P$ can be computed ...
2
votes
2answers
283 views

Why does NaCL have different keys for signing and encryption?

I want to start using NaCL to sign messages that will go into a message queue, and I noticed that it generates different keys for each operation. Is there a reason for this? Can I not use the same PK ...
2
votes
1answer
268 views

ECC partially blind signature scheme verification

Continued from Is there a flaw in this ECC blind signature scheme? The problem I needed a partially blind signature scheme for one of my projects, but couldn't find one on the internet, so I've made ...
2
votes
2answers
225 views

64 bit Elliptic Curve key?

For a simple proof of concept project i'm (attempting!) to do, i've started looking into openSSL elliptic curve cryptography. However instead of the standard key lengths, 160-512. I'm interested in ...
2
votes
2answers
282 views

Elliptic curve brute forcing

I have elliptic curve of equation $y^2 \equiv x^3 -x $. And the coordinate of points $Q$ and $P$. I want to solve $Q=[k]P$ (where $k$ is the unknown) by testing all possible $k$. Is this the right ...
2
votes
2answers
226 views

Explanation of each of the parameters used in ECC

I'm having a very difficult time finding a clear explanation of the parameters used elliptic curve cryptography. I know for certain that $p$ is the number or order or whatever of the given field that ...
2
votes
1answer
158 views

What is the difference between order of base point and curve order in EC? [duplicate]

When I was read about the elliptic curve cryptography I found some definition about domain parameter of elliptic curve like the follow. But I did not understand something $p$: prime number. $a, b$: ...
2
votes
1answer
560 views

Why is 224 bit ecdsa faster than 192 bit ecdsa?

I ran several benchmarks using openssl on 2 different computers and I got a surprising result. for the Nist 192 bit curve the benchmark result is ...
2
votes
3answers
421 views

Can a EC private key be derived from a public key?

I understand that the public key does not expose the private key. That is not the question. The question is: Given a EC public key, can a different, but plausible and functional private key be ...
2
votes
1answer
188 views

Is either brainpoolP320r1 or brainpoolP320t1 a SafeCurve?

Not all elliptic curves are safe to use for cryptography, especially from an ECC safety perspective. The site http://safecurves.cr.yp.to/index.html shows that two tested Brainpool curves, ...
2
votes
1answer
171 views

Verifying multiplicative inverse on a prime field in NIST's ECDSA_Prime.pdf

I am trying to learn about the Elliptic Curve Digital Signature Algorithm (ECDSA) by verifying the results in some example calculations. I found a PDF of example ECDSA calculations from NIST here: ...
2
votes
3answers
272 views

Generating bilinear pairing parameters - running time of finding member of p-torsion group

Update: Question completely rephrased. I want to create the parameters for a bilinear pairing (the Tate pairing in this case). In case you're interested I'm following this thesis, specifically the ...
2
votes
1answer
1k views

ECC - Point Addition/Point Multiplication

So I have a very beginner-esque knowledge of ECDSA and I'm trying to write something in python to take a private key and output the public key (Basically from what I understand just trying to do the ...
2
votes
1answer
291 views

Brute force attack expected running time

I am a bit confused about the expected running times of brute force attacks on different cryptosystems. So let's assume a key size of $2^n$ bits. Symmetric key cryptography: $E(brute)$ = ...
2
votes
2answers
451 views

Scalar Multiplication on Elliptic Curves

In the elliptic curve: $y^2 = x^3 + 20x + 13 \bmod{2111}$. Using the point $P=(3, 10)$ I am wondering how to multiply this point by the scalar $57$? I realize I can write $57*P$ as $2^5*P + 2^4*P + ...
2
votes
1answer
388 views

ECIES protocol - what does the || operation mean?

I am studying elliptic curves problems, which also includes study of related protocols such as ECIES. A there is a problem I don't understand operation $||$. What this operation mean? Some stuff is ...
2
votes
1answer
65 views

How to perfrom modular division while numerator is lesser than the denominator?

I'm implementing point addition and point doubling of elliptic curve cryptography. The formula that I'm using for slope is Point addition: $S = \frac{(P_y-Q_y)}{(P_x-Q_x)}$ where $P$ and $Q$ are the ...
2
votes
2answers
21 views

With EC secp256k1 is there a way of transforming a function of the private key to a function of the public key?

A key pair has a private key $D_A$ and a public key $Q_A$. $D_A$ is an integer less than the curve's $n$. Is there any (boolean) function of the private key $f(D_A)$ which can be transformed into a ...
2
votes
1answer
87 views

Can I use an ECDH Shared Secret from the same Private / Public Key Pair?

I'd like to know if using the ECDH shared secret of a static EC Private Key with it's own corresponding static EC Public Key causes a problem / weakness. (edit) not asking if it's ok to re-use the ...
2
votes
1answer
66 views

Is it right about an example of bilinear map $e$?

The equation for the elliptic curve is $y^{2} = x^{3} + x$ and is defined over the field $F_{q}$ for some prime $q\equiv 3 \pmod 4$, and set $q=307$. Choose random generator $g=[182, 240]$. My ...
2
votes
1answer
111 views

What aspect of elliptic curve encryption paradigms makes them especially susceptible to quantum based attack algorithms?

This was a statement made during a talk at today's DFN-CERT conference but unfortunately it wasn't explained further. Can anyone shed light on why elliptic curves are susceptible to quantum based ...
2
votes
1answer
104 views

Roots in modulo field

I have a point $(X,Y)$ on an elliptical curve $E(a,b)$ where $a=-3$ and $B$ is a large number that is in hexadecimal from -51BD. To compress this point oficially in a program, we know that every $X$ ...
2
votes
2answers
119 views

What is primary security in ECC?

I read the following paragraph in a book about Elliptic Curve Cryptography, but didn't understand it: The primary security in ECC is the parameter $n$; where $n$ is Order of point $G$, that is $n$ ...
2
votes
1answer
785 views

Why does openssl use SHA1 in ECC when I use secp384r1 curve

I need a small clarification that why openssl using SHA1 in ECC when I am using secp384r1 curve, but in rfc they are saying we should use SHA2. Thing here is am using nanoECC in my DTLS, nanoECC ...
2
votes
1answer
270 views

How is the curve equation used in ECC?

I have a hard time learning exactly how the elliptic curve equation is used in the ECC. $$y^2 = x^3+ax+b$$ If someone knows and could explain to me in simple steps how this is done or a link to it ...
2
votes
1answer
119 views

How do I know if a given curve requires a FpCurve F2mCurve or ECCCurve?

I'm trying to read a public key into Bouncy Castle (secp256k1) and need to choose from the following objects FpPoint; FpCurve; or ...
2
votes
1answer
301 views

Can Secp 256 K1 curves “map” to a value on FIPS 186-3 or P-256?

I'm looking at Secp 256K1 vs UProve's FIPS 186-3 or P-256 implementation. Is there any relationship between the curves such that I can consistently "map" or "project" values from one curve to ...
2
votes
1answer
412 views

Is using Ed25519 parameters in ECDSA safe?

I recently discovered the Curve25519 key exchange lib and the Ed25519 signature lib. Due to the speculations about NIST-designed curves, there is a chance that I ditch them and use the curves above ...
2
votes
1answer
279 views

Elliptic curve cryptography attack vector

I would expect a complicated answer for what seems like a simple question about Elliptic curve cryptography. I've read several entries here such as "Elliptic curve cryptography related key attacks" ...
2
votes
1answer
157 views

Verify Messages to Embedded Device

I'm building an embedded device that I plan on distributing. Periodically the device will poll my server to check for updates and commands. I'd like the device to verify that any messages(JSON strings ...
2
votes
1answer
1k views

BouncyCastle Elliptic Curve implementation

I'm implementing ECDH key exchange in C# using the BouncyCastle library and I'm having a hard time understanding the elliptic curve side (FpCurve). ...
2
votes
1answer
45 views

Are private and public key sizes of Elliptic curve related?

I'm new to elliptic curve cryptography. I just want to know in the case where I take a random number (private key) and find its associated public key, does the size of the public key depends upon ...
2
votes
1answer
33 views

Is there a single-use signature scheme, where a second use of the private key discloses it to the world?

With ECDSA (and possibly DSA too) I'm aware that if the same value for $k$ is used with the same private key $D_A$ to sign two different messages, then anyone possessing the two messages $m_0$ and ...
2
votes
1answer
161 views

Forward-secure static-ephemeral ECDH key agreement protocol

The question is whether the following simple key agreement protocol design has good security properties, and how it can or should be improved. Assumptions Alice is a persistent entity with a static ...
2
votes
2answers
164 views

How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
2
votes
1answer
156 views

What are the differences between curve NIST P-521 and Edwards E-521 for signature?

I implemented and used the P-521 curve for ECDSA. Signatures are 132 bytes long. It seems that Edwards E-521 is safer but I did not investigated very deeper. What is its signature length ? How is it ...
2
votes
1answer
60 views

Average/approximate difference in value between valid consecutive $x$ coordinates in ECC?

From my basic understanding not all values of $x$ coordinates can satisfy a given elliptic curve equation, i.e. some $x$ coordinate values are not valid points on the curve because $x^3+ax+b$ is not a ...
2
votes
1answer
240 views

Is only one shared secret generated by ECDH per key pair?

I'm confused about ECDH. Using their public keys and private keys, two entities can arrive on a shared secret. But from the equations I've seen, it looks like ONLY the numbers present in their key ...
2
votes
1answer
57 views

In a additive group is it hard to calculate $bg$ given $ag, g, abg$

The ECDH problem defined that given $g,ag,bg$ it is difficult to calculate $abg$. But it is also difficult to calculate $bg$ given $ag,g,abg$. where $g$ is generator and a,b are elements of group.
2
votes
1answer
299 views

Is cryptanalysis of CTB-Locker really impossible?

It seems that CTB-Locker make a lot of victims nowadays, and yet, the full encryption scheme of it is now publicly known [1,2]. Would any of you could find a weakness to exploit in this encryption ...
2
votes
1answer
350 views

What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?

This page on Twist security mentions a combined attack and a twist rho attack, applicable in particular to NIST P-224 curve with cost $2^{58.4}$ something, with no mention precise definition of ...
2
votes
1answer
69 views

Is jacobian to projective conversion unique?

I am doing a small project in ECC. I have used the following equation for converting Projective to Jacobian coordinates: $$D = AC\\ E = BC^{2}\\ F = C$$ and also the following equation to convert ...
2
votes
1answer
108 views

Implementing AugPAKE over ECC

The AugPAKE spec says it can be implemented over elliptic curves. This sounds very promising, but they don't actually back that claim. Can this really be achieved? If so, how would one go about ...
2
votes
1answer
457 views

How do the following new (2013) ECC curves compare in security or efficiency? [closed]

I read about the following "safe" ECC curves and notably, secp256 and all the NIST curves are marked as "unsafe" when compared to more modern curves. I need a curve for signing or encryption, (or ...
2
votes
1answer
397 views

Fast modular reduction

I am looking at ways to speed up modular reduction for the polynomial $$2^{256}-2^{32}-2^9-2^8-2^7-2^6-2^4-1$$ I have read the paper "Generalized Mersenne numbers" by J.A. Solinas, but it does not ...
2
votes
1answer
196 views

ElGamal with elliptic curves I

It is very interesting to see @tylo's answer on ElGamal with elliptic curves. Instead of mapping the message to the elliptic curve point it just reduces an elliptic curve point to its $x$ coodrinate. ...
2
votes
1answer
204 views

Elliptic Curve Verifiable Secret Sharing

I'm reading this paper, which on page 3(Section IV.C) presents a Jointly Random Verifiable Secret Sharing Scheme for Elliptic curves. The algorithm makes sense to me save for this part: "Each ...
2
votes
2answers
634 views

Graphically representing points on Elliptic Curve over finite field

I have taken elliptic curve $E\colon y^2=x^3-4x+20$, defined over $\mathbb{F}_{29}$. The number of points on the curve, $\left|E(\mathbb{F}_{29})\right|=37$. I took base point $P=(1,5)$, and got ...
2
votes
1answer
450 views

openSSL ECDH private key size

When you are using a named curve like P-256 in openSSL, is there any standard key size for ECDH private key keys? If you look at the ec_key.c file in the openSSL ...