Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

learn more… | top users | synonyms (2)

2
votes
1answer
106 views

Elliptic curve ElGamal with homomorphic mapping

I am interested in ElGamal due to the fact that you can achieve some degree of homomorphic properties. I became interested in applying ElGamal to elliptic curves, and found this other question with an ...
2
votes
1answer
52 views

Are private and public key sizes of Elliptic curve related?

I'm new to elliptic curve cryptography. I just want to know in the case where I take a random number (private key) and find its associated public key, does the size of the public key depends upon ...
2
votes
1answer
39 views

Is there a single-use signature scheme, where a second use of the private key discloses it to the world?

With ECDSA (and possibly DSA too) I'm aware that if the same value for $k$ is used with the same private key $D_A$ to sign two different messages, then anyone possessing the two messages $m_0$ and ...
2
votes
1answer
307 views

Forward-secure static-ephemeral ECDH key agreement protocol

The question is whether the following simple key agreement protocol design has good security properties, and how it can or should be improved. Assumptions Alice is a persistent entity with a static ...
2
votes
2answers
280 views

How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
2
votes
1answer
234 views

What are the differences between curve NIST P-521 and Edwards E-521 for signature?

I implemented and used the P-521 curve for ECDSA. Signatures are 132 bytes long. It seems that Edwards E-521 is safer but I did not investigated very deeper. What is its signature length ? How is it ...
2
votes
1answer
186 views

Point addition in NaCl/libsodium (Curve25519)

In NaCl and libsodium, the crypto_scalarmult function implements the operation $Q = kP$ (scalar/point multiplication). There doesn't seem to be a function for point ...
2
votes
1answer
64 views

Average/approximate difference in value between valid consecutive $x$ coordinates in ECC?

From my basic understanding not all values of $x$ coordinates can satisfy a given elliptic curve equation, i.e. some $x$ coordinate values are not valid points on the curve because $x^3+ax+b$ is not a ...
2
votes
1answer
295 views

Is only one shared secret generated by ECDH per key pair?

I'm confused about ECDH. Using their public keys and private keys, two entities can arrive on a shared secret. But from the equations I've seen, it looks like ONLY the numbers present in their key ...
2
votes
1answer
388 views

Koblitz encoding a message to a point, what is the “associated auxiliary base parameter”?

I am looking at the Koblitz method for encoding a message as an elliptic curve point. The first step given in the paper I'm reading is: "Choose an elliptic curve and its associated auxiliary base ...
2
votes
1answer
61 views

In a additive group is it hard to calculate $bg$ given $ag, g, abg$

The ECDH problem defined that given $g,ag,bg$ it is difficult to calculate $abg$. But it is also difficult to calculate $bg$ given $ag,g,abg$. where $g$ is generator and a,b are elements of group.
2
votes
1answer
320 views

Is cryptanalysis of CTB-Locker really impossible?

It seems that CTB-Locker make a lot of victims nowadays, and yet, the full encryption scheme of it is now publicly known [1,2]. Would any of you could find a weakness to exploit in this encryption ...
2
votes
1answer
404 views

What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?

This page on Twist security mentions a combined attack and a twist rho attack, applicable in particular to NIST P-224 curve with cost $2^{58.4}$ something, with no mention precise definition of ...
2
votes
1answer
72 views

Is jacobian to projective conversion unique?

I am doing a small project in ECC. I have used the following equation for converting Projective to Jacobian coordinates: $$D = AC\\ E = BC^{2}\\ F = C$$ and also the following equation to convert ...
2
votes
1answer
115 views

Implementing AugPAKE over ECC

The AugPAKE spec says it can be implemented over elliptic curves. This sounds very promising, but they don't actually back that claim. Can this really be achieved? If so, how would one go about ...
2
votes
1answer
515 views

How do the following new (2013) ECC curves compare in security or efficiency? [closed]

I read about the following "safe" ECC curves and notably, secp256 and all the NIST curves are marked as "unsafe" when compared to more modern curves. I need a curve for signing or encryption, (or ...
2
votes
1answer
453 views

Fast modular reduction

I am looking at ways to speed up modular reduction for the polynomial $$2^{256}-2^{32}-2^9-2^8-2^7-2^6-2^4-1$$ I have read the paper "Generalized Mersenne numbers" by J.A. Solinas, but it does not ...
2
votes
1answer
212 views

ElGamal with elliptic curves I

It is very interesting to see @tylo's answer on ElGamal with elliptic curves. Instead of mapping the message to the elliptic curve point it just reduces an elliptic curve point to its $x$ coodrinate. ...
2
votes
1answer
2k views

Is Curve25519-java secure?

I have only about 2 weeks of cryptography experience mostly in the form of questions on bitcoin.se. Is Curve25519-java up to date with current Curve25519 standards? Is Curve25519 itself secure? ...
2
votes
1answer
242 views

Elliptic Curve Verifiable Secret Sharing

I'm reading this paper, which on page 3(Section IV.C) presents a Jointly Random Verifiable Secret Sharing Scheme for Elliptic curves. The algorithm makes sense to me save for this part: "Each ...
2
votes
2answers
712 views

Graphically representing points on Elliptic Curve over finite field

I have taken elliptic curve $E\colon y^2=x^3-4x+20$, defined over $\mathbb{F}_{29}$. The number of points on the curve, $\left|E(\mathbb{F}_{29})\right|=37$. I took base point $P=(1,5)$, and got ...
2
votes
1answer
483 views

openSSL ECDH private key size

When you are using a named curve like P-256 in openSSL, is there any standard key size for ECDH private key keys? If you look at the ec_key.c file in the openSSL ...
2
votes
1answer
222 views

Elliptic Curve is DH function or PKI?

can we reuse same ECC key on TLS for long terms or it must be used just once? (i mean can we use ECC like RSA?) is there patent free ECC implementation ?
2
votes
1answer
345 views

Choosing good parameter for Lenstra's elliptic curve factorization

In Wikipedia, there is an article explaining Lenstra's factorization algorithm. As far as I got it, we choose some $e \in \mathbb{N}$ and a point $P$ on the curve and then calculate $eP$. While ...
2
votes
1answer
475 views

Is there a method to break an EC curve for all key-pairs (Q,d) such that (Q=d*G) faster than breaking every single key-pair?

Related to this question: Is there any memory trade-off that helps such attack? Obviously if the field size is very small (say 40 bits) it´s possible, but what if the field size is 160 bits long? or ...
2
votes
1answer
48 views

How to convert roots of Weber polynomial to Hilbert class polynomial over modulo prime?

Using any non square root discriminant $D$, we should be able to find the Weber class polynomial. How can I convert the roots of a Weber polynomial to a Hilbert class polynomial over modulo prime?
2
votes
1answer
69 views

Elliptic Curve ElGamal and DSA - smooth group order and element of large prime order

In regular ElGamal and DSA, we choose large primes $p$ and $q$ such that $p\equiv 1\pmod{q}$, and a group element $g$ of order $q$ by computing $a^{(p-1)/q}$ for some random $a$. This is to prevent ...
2
votes
1answer
166 views

OpenSSL ECDH key exchange mechanism

I am using FIPS based OpenSSL module for encryption of sensitive data for my desktop socket server and client applications. I am using ECDH for key agreement.The keys public and private pair is ...
2
votes
2answers
92 views

Authenticated EC key exchange without a signing/signature scheme?

From my little understanding of EC-based authenticated key exchange protocols, I believe that it is not possible for authenticated key exchange without a signing/signature scheme. Is this correct? ...
2
votes
1answer
289 views

Finding Elliptical curve points and encoding text using them

I recently got into learning Elliptical curve cryptography and are currently building a project in C#. Everything is working well so far, I can encode and decode points, and thanks to this forum I ...
2
votes
1answer
302 views

Prevent MITM attack while encrypting data by using ElGamal ECC?

I am using ElGamal ECC to encrypt my plain text data. I want to ensure that my data is safe from a Man-In-The-Middle attack. What methodology I can adopt to achieve this goal? How can we prevent a ...
2
votes
2answers
329 views

ECDH anonymous key exchange to avoid PKI

I want to use TLS to encrypt the communication between peers in a P2P network. Each peer has a well known 256bit peer identifier (the public key of a 256bit elliptic curve keypair). Both peers need ...
2
votes
1answer
477 views

ECC Complexity order of point addition, scalar point multiplication and selecting random point

I am facing this problem in calculating the order of a process which involves ECC point addition: $P+Q$ , scalar multiplication: $aP$, and selecting random points in the group. The group is of prime ...
2
votes
2answers
673 views

How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?

I am currently trying to create an ECCCurve for E-521. Unfortunately, it is not currently a named curve in the library I am using, so I will have to define it manually. I am using the definition of ...
2
votes
1answer
126 views

Where can I double check my elliptic curve results?

I am trying to do some elliptic curve calculations by hand, just to refresh myself on how the system works. I calculated some points and did some operations by hand. I am trying to double check my ...
2
votes
1answer
220 views

Is this ECC encryption key sharing method okay?

Is this encryption key sharing okay to use? Or is much better to use ECIES? $G$ = base point $a$ = Alice’s private key $b$ = Bob’s private key $A = aG$ = Alice’s public key $B = bG$ = Bob’s public ...
2
votes
1answer
478 views

inverse problem about scalar multiplication on elliptic curve

Let $E$ be an elliptic curve over a finite field $F_p$. Given $n$ be a positive integer and $Q$ be a point on $E$, assume that $Q=nP$, how can we find this $P$? We can assume that $n|p-1$. If $n$ is ...
2
votes
3answers
233 views

EC equivalent for RSA-OAEP

I have some questions regarding aforementioned subject: Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ? Is ECIES-KEM sufficient ?
2
votes
1answer
179 views

Discrete log analog of ECM factoring algorithm?

Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas. Is there an analog of the elliptic curve (ECM) ...
2
votes
1answer
217 views

Generating non-supersingular elliptic curves for symmetric pairings

I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the ...
2
votes
1answer
79 views

Construction of division polynomials

I'm trying to understand the construction of the division polynomials used in Schoof's algorithm. I firstly followed this report of Charlap and Robbins. I stuck with the definition of the leading ...
2
votes
0answers
42 views

Example of Projective Coordinates

Given the affine form of coordinates $(x,y)$ such as $(5,3)$, if I want to convert $(5,3)$ to projective coordinates $(x,y,z)$, should the form of point be $(5,3,1)$? It is triplet not a point, right? ...
2
votes
0answers
78 views

Can we break ECDLP with this machine?

Let $P$ and $Q$ are two points of NIST elliptic curve $E$ (defined over $F_{2^m}$ with prime $m$) and $k$ is a private key such that $k.P=Q$. Also we have a machine that is able to leak some ...
2
votes
0answers
59 views

Convert messages to elliptic curve points [duplicate]

Let $E$ be an elliptic curve; $\alpha,\beta$ two points of $E$; and $a$ a private key such that $\beta=a\cdot\alpha$. We choose random integer $k$ and plain text $x\in E$. Encryption and decryption ...
2
votes
0answers
66 views

How to compute projective cordinate Z in elliptic curve cryptography?

I was working on affine coordinates and struggling with the computation time taken for operations and then I was advised to use projective coordinates so that mul-inverse operation can be avoided Can ...
2
votes
0answers
65 views

EdDSA Verification vs. Cofactorless Verification

In the EdDSA for more curve paper the authors defines: Keys An EdDSA secret key is a $b$-bit string $k$. The hash $H(k) = (h_0, h_1, ... , h_{2b−1})$ determines an integer $s = ...
2
votes
0answers
55 views

Using a product of a series of curve25519 scalars as a private key

There are a few systems like the GNU Name System and the Sphinx mixnet packet format that employ a series of curve25519 scalars all multiplied together as a private key. Are there any caveats to ...
2
votes
0answers
50 views

Construct points with the same discrete logarithm

Assume we have an elliptic curve $E$ with a Tate (or Ate,...) pairing $G_1 \times G_2 \mapsto G_T$ Now the task is to find $g_1, g_1' \in G_1$ and $g_2, g_2' \in G_2$ such that the discrete logarithm ...
2
votes
0answers
45 views

Testing PRNG quality from ECC public keys?

Having a large set of ECC public keys $P_i = n_iB$ on a fixed curve $E$ over a prime field, is there a way to determine if coefficients $n_i$ were generated using a bad PRNG? In other words, can a ...
2
votes
0answers
63 views

Differential addition on Montgomery curve

Point multiplication using Montgomery ladder technique over Montgomery curves only require x coordinate, which in many situation leads to faster implementation as compared to point multiplication over ...