Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

learn more… | top users | synonyms (2)

1
vote
0answers
198 views

How represent message in Menezes–Vanstone elliptic curve cryptography

I ask about represent message in Menezes–Vanstone elliptic curve cryptography I now encrypt function as follow $C_1 = (M_1 * K_1) mod\ P$ $C_2=(M2 * k_2) mod\ P$ My question is about how much the ...
1
vote
0answers
100 views

request for data to test deterministic ecdsa signature algorithm for secp256k1

I’m implementing the RFC 6979 procedure to compute a message signature. I want to test my program on the secp256k1 elliptic curve. Note the “k” in secp256k1, i.e. the Koblitz curve. If you have the ...
0
votes
0answers
105 views

processing time for multiplication and exponentiation in pairing base cryptography

I'm using the Boneh-Boyen-Shacham signature scheme and want to estimate complexity in my scheme. As reported in "Scott M., Efficient Implementation of Cryptographic pairings", if we set parameters ...
0
votes
0answers
123 views

Polynomial Inversion over Galois Field

Hello guys I am looking to calculate the Inverse of a given polynomial in Galois field I have found the little Fermat's algorithm and the Itoh-Tsujii I am getting a bit confused with both algorithm ...
2
votes
1answer
112 views

Roots in modulo field

I have a point $(X,Y)$ on an elliptical curve $E(a,b)$ where $a=-3$ and $B$ is a large number that is in hexadecimal from -51BD. To compress this point oficially in a program, we know that every $X$ ...
1
vote
1answer
89 views

Modulo Square Roots [duplicate]

Here's my issue and someone can help me understand it so I can program it correctly. I have a point(X,Y) on an Elliptical Curve E(a,b) where a=-3 and B is a large number that is in hexidecimal from ...
1
vote
0answers
148 views

Bilinear pairing

I am working on Efficient Construction of Pairings which are being realized by Miller's algorithm. In this algorithm the basic steps are point doubling and line function computation point addition ...
2
votes
1answer
289 views

Finding Elliptical curve points and encoding text using them

I recently got into learning Elliptical curve cryptography and are currently building a project in C#. Everything is working well so far, I can encode and decode points, and thanks to this forum I ...
1
vote
1answer
437 views

Elliptical curve cryptography key generation time

I am currently trying to learn more about Elliptical curve crypthography and have finally started to get things working and undestanding the different pieces. I've written a small project in C# and ...
2
votes
1answer
179 views

What is the difference between order of base point and curve order in EC? [duplicate]

When I was read about the elliptic curve cryptography I found some definition about domain parameter of elliptic curve like the follow. But I did not understand something $p$: prime number. $a, b$: ...
7
votes
1answer
855 views

Elliptic curves for ECDSA

I'm trying to implement parameters generation for ECDSA according to SEC1 v2.0: ...
0
votes
0answers
88 views

Elliptic curve trapdoor function without modular arithmetic?

From what I understand, an elliptic contains a set points satisfying the equation $y^2=x^3 + ax + b$ together with the point at infity. It seems clear how multiplication with a scalar and a point ...
3
votes
1answer
117 views

How many of primitive point on the elliptic curve?

In elliptic curves for cryptography, I know $nG=O$, where $G$ is a base point represented by $G=(x_g,y_g)\ on\ E(F_P)$, where $n$ is Order of point $G$. For example, $P(0,6)$ is a primitive point on ...
2
votes
2answers
124 views

What is primary security in ECC?

I read the following paragraph in a book about Elliptic Curve Cryptography, but didn't understand it: The primary security in ECC is the parameter $n$; where $n$ is Order of point $G$, that is $n$ ...
2
votes
0answers
157 views

As a cryptographer, what are the things I should care about in my implementation of pairing functions?

As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing. I am ...
2
votes
1answer
404 views

What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?

This page on Twist security mentions a combined attack and a twist rho attack, applicable in particular to NIST P-224 curve with cost $2^{58.4}$ something, with no mention precise definition of ...
1
vote
0answers
61 views

DLOG in $\mathbb{F}_{p^n}^*$?

Assume that we are given an element $g\in \mathbb{F}_{p^n}^*$ and $g$ does not belong to any of the smaller subfields contained in $\mathbb{F}_{p^n}$. If the degree of $g$ is some number $q$, how much ...
6
votes
1answer
473 views

Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
2
votes
1answer
953 views

Why does openssl use SHA1 in ECC when I use secp384r1 curve

I need a small clarification that why openssl using SHA1 in ECC when I am using secp384r1 curve, but in rfc they are saying we should use SHA2. Thing here is am using nanoECC in my DTLS, nanoECC ...
1
vote
1answer
193 views

What can be learned from the ciphertext of LibSodium's crypto_box_detached()?

LibSodium, (https://github.com/jedisct1/libsodium), has a function crypto_box_detached() which does authenticated encryption using the public key of the recipient ...
1
vote
1answer
286 views

How can convert affine to Jacobian coordinates?

I have a point in affine coordinates: $(x,y)$. What should I do when I want to convert to $(X,Y,Z)$ in Jacobian coordinates? I need it for calculating ECC in a prime field.
0
votes
0answers
107 views

becoming a cryptographer after math studies [duplicate]

After studying philosophy and being a philosophy teacher, I took back studies 4 years ago and I did a bachelor in maths. I'm in maths grad school now (I'm 32), and I would like to work in ...
1
vote
0answers
111 views

Which mathematical operations does secp256k1 point multiplication use?

To convert a bitcoin private key to a public key, the secp256k1 point multiplication math is used. Could I – theoretically – convert a private key to a public key just using the four arithmetic ...
1
vote
1answer
124 views

Protection of Elliptic Curve Implementations against side-channel attacks [closed]

Recent fast elliptic curve implementations, for example a presentation at Eurocrypt 2014 (earlier presentation slides, the paper) talks about protection against only timing attacks. Why only timing ...
1
vote
3answers
228 views

Elliptic curve parameters

What's the meaning of 160 bit Curve in Elliptic curve ? or 192 or 224 or 256 and etc. And What is the standard for selecting this number of bit ? why they don't say 100 bit curve?
1
vote
0answers
87 views

advantages of hashing over elliptic curve signatures for a proof of work protocol

I'm trying to create a proof-of-work protocol for a proof-of-concept software, and it's basically something like this: ...
3
votes
1answer
589 views

What is the difference between “secp…” and “sect…”?

The National Institute of Standards and Technology (NIST) recommended elliptic curve domain parameters to have names such as “secp…” and “sect…”. For example: “secp224k1” and “sect571k1”. What is ...
4
votes
3answers
224 views

Why are we not using multiple ciphers per message?

I am aware of at least rsa, elgamal-encryption, and variations of elliptic-curves relying on different problems and that those problems are considered hard. However, if someone figures out a way to ...
1
vote
0answers
403 views

What is the (uncompressed) x,y-representation of a curve point on the P-256 NIST elliptic curve?

I am trying to understand the FIDO U2F Raw Message Format, especially the format in which a user public key should be provided. The documentation says the following: A user public key [65 bytes]. ...
0
votes
1answer
410 views

Bouncy Castle elliptic curve from explicit parameters (E-521)

I'd like to use a curve that's not included in the Bouncy Castle EC named curves spec, specifically E-521. According to the BC javadocs, you need a few values in order to do this: q, a, and b for the ...
0
votes
1answer
112 views

Is elliptic curve point multiplication semantically secure?

Is elliptic curve point multiplication semantically secure? I'd like to know if there are some sets of elliptic curve parameters (e.g. NIST curves) that are proved to be semantically secure or that ...
12
votes
1answer
2k views

Why do the elliptic curves recommended by NIST use 521 bits rather than 512?

Wikipedia says in reference to the elliptic curves officially recommended by NIST in FIPS 186-3: Five prime fields for certain primes p of sizes 192, 224, 256, 384, and 521 bits. For each of the ...
2
votes
1answer
669 views

Why is 224 bit ecdsa faster than 192 bit ecdsa?

I ran several benchmarks using openssl on 2 different computers and I got a surprising result. for the Nist 192 bit curve the benchmark result is ...
0
votes
1answer
84 views

How can i calculate prime of Elliptic Curve?

In many articles i have found directly the calculation of prime elliptic curve. How can i calculate this prime $p$ ? For example if I consider NIST P-256, $ p = 2^{256}-2^{224}+2^{192}+2^{96}-1$. Why ...
6
votes
1answer
379 views

Point addition equation in projective co ordinates

How can I get point addition equation for elliptic curves in projective co ordinate system? Can I get it by changing $$ x = X/Z $$ and $$ y =Y/Z $$ in the equation for affine co ordinates' group law? ...
0
votes
0answers
122 views

Scalar multiplication of elliptic curve point by a fraction

I'm implementing an algorithm that works on a generic finite cyclic group written in the classic multiplicative notation: (G,*) = < g > , n = |g| At a ...
0
votes
1answer
89 views

How to calculate kinv from the given k value

I am implementing an ECDSA NIST test vectors verification application. The test vectors are taken from http://csrc.nist.gov/groups/STM/cavp/#09. One of the test vectors is given below: ...
5
votes
4answers
8k views

How does one calculate the scalar multiplication on elliptic curves?

I found this example online: In the elliptic curve group defined by $$y^2 = x^3 + 9x + 17 \quad \text{over } \mathbb{F}_{23},$$ what is the discrete logarithm $k$ of $Q = (4,5)$ to the base ...
5
votes
1answer
601 views

Storage of Private Keys

I'm building a bitcoin web application that will require all users to be assigned a wallet for adding funds to their account. I plan on exposing the public key to the user (the bitcoin address). Users ...
2
votes
1answer
321 views

Can Secp 256 K1 curves “map” to a value on FIPS 186-3 or P-256?

I'm looking at Secp 256K1 vs UProve's FIPS 186-3 or P-256 implementation. Is there any relationship between the curves such that I can consistently "map" or "project" values from one curve to ...
5
votes
1answer
669 views

Families of public/private keys in elliptic curve cryptography

I'm looking for a related key scheme for elliptic curve cryptography. The basic idea would be that there would be a master public key and a master private key. From the master public key, you could ...
2
votes
0answers
60 views

ECIES: Purpose of optional shared information?

According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows: Generate a random shared secret $Z$ according to ECIES, which will never be ...
1
vote
1answer
133 views

ECIES: Purpose of MAC?

Assumptions: $A$ wants to communicate with $B$ $A$ knows a public key $P_B$ which is trusted by a third party and belongs to $B$ $A$ knows the address of someone who pretends to be $B$ $A$ wants ...
-2
votes
1answer
94 views
2
votes
1answer
302 views

Prevent MITM attack while encrypting data by using ElGamal ECC?

I am using ElGamal ECC to encrypt my plain text data. I want to ensure that my data is safe from a Man-In-The-Middle attack. What methodology I can adopt to achieve this goal? How can we prevent a ...
1
vote
0answers
165 views

Type G Bilinear Pairings

I was reading PBC and its implementations for finding pairing parameters. I am particularly interested in implementing a BLS signature scheme with 20-byte (160-bit) signatures ("short signatures"). ...
3
votes
1answer
177 views

Proving Non-Existence of ECC Backdoors

In light of the NIST Dual EC DRBG scandal, I was intrigued by a NIST slide (slide 9) that said the two points P and Q can be chosen so that the chooser can prove they don't have a backdoor. This ...
0
votes
0answers
266 views

RSA and ECDSA Certificate Sizes

Is there a table (or a whitepaper from official sources) that compares the size of X509 certificates generated with RSA (starting from 1024 bits) and ECDSA (starting from 160 bits) ? Thanks for the ...
1
vote
0answers
131 views

ECC cryptography with shorter signature when not needing high security?

I am new here and fairly new to cryptography, so if I say something wrong, let me know. I am trying to set up a system where a user can receive a temporary license key over the phone, put it into ...
2
votes
1answer
2k views

Is Curve25519-java secure?

I have only about 2 weeks of cryptography experience mostly in the form of questions on bitcoin.se. Is Curve25519-java up to date with current Curve25519 standards? Is Curve25519 itself secure? ...